Looking for way to log process terminations on OS X (Mac)
- by Stan Sieler
I'm looking for a way to log all process terminations on my Mac (OS X 10.6.8).
(And see pid, timestamp, process name)
I've implemented something similar for HP-UX, but it required a kernel-level driver and
intercepting several variations of "exit()" (the normal one, and the one invoked on behalf
of a process while it's aborting).
Why do I want the info?
I've been seeing messages in my system log file (dmesg) like:
CODE SIGNING: cs_invalid_page(0x1000): p=91550[GoogleSoftwareUp] clearing CS_VALID
CODE SIGNING: cs_invalid_page(0x1000): p=92088[GoogleSoftwareUp] clearing CS_VALID
Although dmesg lacks timestamps, apps/Utilities/Console : Database : all : search for CS_VALID
shows that the messages appears about once every 58 1/2 minutes.
I suspect the number after "p=" is a process id (pid) ... but for a process that has long
since terminated by the time I see the message.
So, if there was a process termination log mechanism that recorded the pid, the time of termination,
the reason for termination, and the process name (at time of termination), that would probably
allow me to determine who's causing those errors to be logged!
(No, I'm not running Chrome on my Mac, and "ps -ef | grep -i goog" gets no hits either ...
I'm not consciously running any Google apps on the Mac)
thanks,
Stan
[email protected]
