Strange Audit LOG entry
One of the processes running on a RHEL 7.2 server (process name: billsrv) is terminating randomly, after receiving a kill -9 command.
I used the audit log to identify who is sending the kill -9 command:
First I killed it manualy. In the audit file I got the following:
*Nov 26 19:09:05 coscms1 audispd: node=coscms1 type=SYSCALL msg=audit(1543252145.658:639488):
arch=c000003e syscall=62 success=yes exit=0 a0=2b88 a1=12 a2=2b88 a3=2b88 items=0
ppid=16150 pid=16151 auid=400 uid=400 gid=400 euid=400 suid=400 fsuid=400 egid=400 sgid=400 fsgid=400 tty=pts4
ses=89169 comm="ksh" exe="/usr/bin/ksh93" key="kill_signals"*
Then after some time the billsrv process killed and I got the following in the Audit file:
Nov 26 20:10:28 coscms1 audispd: node=coscms1 type=SYSCALL msg=audit(1543255828.282:642321):
arch=c000003e syscall=62 success=yes exit=0 a0=5ceb a1=9 a2=5ceb a3=7f3e8dd23cf0 items=0
ppid=29836 pid=23796 auid=400 uid=400 gid=400 euid=400 suid=400 fsuid=400 egid=400 sgid=400 fsgid=400 tty=(none)
ses=89169 comm="billsrv" exe="/users/cms/bin/billsrv" key="kill_signals"
Does the above mean that the process killed itself ? (!!!)
audit rhel7
edited Nov 26 '18 at 23:31
Khalil M
93021327
asked Nov 26 '18 at 20:00
DAGDAG
1
add a comment |
One of the processes running on a RHEL 7.2 server (process name: billsrv) is terminating randomly, after receiving a kill -9 command.
I used the audit log to identify who is sending the kill -9 command:
First I killed it manualy. In the audit file I got the following:
*Nov 26 19:09:05 coscms1 audispd: node=coscms1 type=SYSCALL msg=audit(1543252145.658:639488):
arch=c000003e syscall=62 success=yes exit=0 a0=2b88 a1=12 a2=2b88 a3=2b88 items=0
ppid=16150 pid=16151 auid=400 uid=400 gid=400 euid=400 suid=400 fsuid=400 egid=400 sgid=400 fsgid=400 tty=pts4
ses=89169 comm="ksh" exe="/usr/bin/ksh93" key="kill_signals"*
Then after some time the billsrv process killed and I got the following in the Audit file:
Nov 26 20:10:28 coscms1 audispd: node=coscms1 type=SYSCALL msg=audit(1543255828.282:642321):
arch=c000003e syscall=62 success=yes exit=0 a0=5ceb a1=9 a2=5ceb a3=7f3e8dd23cf0 items=0
ppid=29836 pid=23796 auid=400 uid=400 gid=400 euid=400 suid=400 fsuid=400 egid=400 sgid=400 fsgid=400 tty=(none)
ses=89169 comm="billsrv" exe="/users/cms/bin/billsrv" key="kill_signals"
Does the above mean that the process killed itself ? (!!!)
audit rhel7
edited Nov 26 '18 at 23:31
Khalil M
93021327
asked Nov 26 '18 at 20:00
DAGDAG
1
Check in the kernel log (/var/log/messages) - perhaps it was the OOM killer, which would mean that you ran out of memory.
– Laurenz Albe
Nov 26 '18 at 20:22
Already checked that. There is nothing in /var/log/messages. In terms of memory resources, machine was using at that time less than 30% of the available memory. Thanks for replying anyway!
– DAG
Nov 26 '18 at 21:40
add a comment |
One of the processes running on a RHEL 7.2 server (process name: billsrv) is terminating randomly, after receiving a kill -9 command.
I used the audit log to identify who is sending the kill -9 command:
First I killed it manualy. In the audit file I got the following:
*Nov 26 19:09:05 coscms1 audispd: node=coscms1 type=SYSCALL msg=audit(1543252145.658:639488):
arch=c000003e syscall=62 success=yes exit=0 a0=2b88 a1=12 a2=2b88 a3=2b88 items=0
ppid=16150 pid=16151 auid=400 uid=400 gid=400 euid=400 suid=400 fsuid=400 egid=400 sgid=400 fsgid=400 tty=pts4
ses=89169 comm="ksh" exe="/usr/bin/ksh93" key="kill_signals"*
Then after some time the billsrv process killed and I got the following in the Audit file:
Nov 26 20:10:28 coscms1 audispd: node=coscms1 type=SYSCALL msg=audit(1543255828.282:642321):
arch=c000003e syscall=62 success=yes exit=0 a0=5ceb a1=9 a2=5ceb a3=7f3e8dd23cf0 items=0
ppid=29836 pid=23796 auid=400 uid=400 gid=400 euid=400 suid=400 fsuid=400 egid=400 sgid=400 fsgid=400 tty=(none)
ses=89169 comm="billsrv" exe="/users/cms/bin/billsrv" key="kill_signals"
Does the above mean that the process killed itself ? (!!!)
audit rhel7
edited Nov 26 '18 at 23:31
Khalil M
93021327
asked Nov 26 '18 at 20:00
DAGDAG
1
One of the processes running on a RHEL 7.2 server (process name: billsrv) is terminating randomly, after receiving a kill -9 command.
I used the audit log to identify who is sending the kill -9 command:
First I killed it manualy. In the audit file I got the following:
*Nov 26 19:09:05 coscms1 audispd: node=coscms1 type=SYSCALL msg=audit(1543252145.658:639488):
arch=c000003e syscall=62 success=yes exit=0 a0=2b88 a1=12 a2=2b88 a3=2b88 items=0
ppid=16150 pid=16151 auid=400 uid=400 gid=400 euid=400 suid=400 fsuid=400 egid=400 sgid=400 fsgid=400 tty=pts4
ses=89169 comm="ksh" exe="/usr/bin/ksh93" key="kill_signals"*
Then after some time the billsrv process killed and I got the following in the Audit file:
Nov 26 20:10:28 coscms1 audispd: node=coscms1 type=SYSCALL msg=audit(1543255828.282:642321):
arch=c000003e syscall=62 success=yes exit=0 a0=5ceb a1=9 a2=5ceb a3=7f3e8dd23cf0 items=0
ppid=29836 pid=23796 auid=400 uid=400 gid=400 euid=400 suid=400 fsuid=400 egid=400 sgid=400 fsgid=400 tty=(none)
ses=89169 comm="billsrv" exe="/users/cms/bin/billsrv" key="kill_signals"
Does the above mean that the process killed itself ? (!!!)
audit rhel7
audit rhel7
edited Nov 26 '18 at 23:31
Khalil M
93021327
asked Nov 26 '18 at 20:00
DAGDAG
1
edited Nov 26 '18 at 23:31
Khalil M
93021327
asked Nov 26 '18 at 20:00
DAGDAG
1
edited Nov 26 '18 at 23:31
Khalil M
93021327
edited Nov 26 '18 at 23:31
Khalil M
93021327
edited Nov 26 '18 at 23:31
Khalil M
93021327
93021327
asked Nov 26 '18 at 20:00
DAGDAG
1
asked Nov 26 '18 at 20:00
DAGDAG
1
asked Nov 26 '18 at 20:00
DAGDAG
1
1
Check in the kernel log (/var/log/messages) - perhaps it was the OOM killer, which would mean that you ran out of memory.
– Laurenz Albe
Nov 26 '18 at 20:22
Already checked that. There is nothing in /var/log/messages. In terms of memory resources, machine was using at that time less than 30% of the available memory. Thanks for replying anyway!
– DAG
Nov 26 '18 at 21:40
add a comment |
Check in the kernel log (/var/log/messages) - perhaps it was the OOM killer, which would mean that you ran out of memory.
– Laurenz Albe
Nov 26 '18 at 20:22
Already checked that. There is nothing in /var/log/messages. In terms of memory resources, machine was using at that time less than 30% of the available memory. Thanks for replying anyway!
– DAG
Nov 26 '18 at 21:40
Check in the kernel log (
/var/log/messages) - perhaps it was the OOM killer, which would mean that you ran out of memory.– Laurenz Albe
Nov 26 '18 at 20:22
Check in the kernel log (
/var/log/messages) - perhaps it was the OOM killer, which would mean that you ran out of memory.– Laurenz Albe
Nov 26 '18 at 20:22
Already checked that. There is nothing in /var/log/messages. In terms of memory resources, machine was using at that time less than 30% of the available memory. Thanks for replying anyway!
– DAG
Nov 26 '18 at 21:40
Already checked that. There is nothing in /var/log/messages. In terms of memory resources, machine was using at that time less than 30% of the available memory. Thanks for replying anyway!
– DAG
Nov 26 '18 at 21:40
add a comment |
1 Answer
1
active
oldest
votes
My process was receiving a kill signal from the oracle 12 client(!)
https://community.oracle.com/thread/3567492
We disabled the “diagnostic Framework” on client level and everything looks OK.
answered Dec 1 '18 at 8:22
DAGDAG
1
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53488163%2fstrange-audit-log-entry%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
My process was receiving a kill signal from the oracle 12 client(!)
https://community.oracle.com/thread/3567492
We disabled the “diagnostic Framework” on client level and everything looks OK.
answered Dec 1 '18 at 8:22
DAGDAG
1
add a comment |
My process was receiving a kill signal from the oracle 12 client(!)
https://community.oracle.com/thread/3567492
We disabled the “diagnostic Framework” on client level and everything looks OK.
answered Dec 1 '18 at 8:22
DAGDAG
1
add a comment |
My process was receiving a kill signal from the oracle 12 client(!)
https://community.oracle.com/thread/3567492
We disabled the “diagnostic Framework” on client level and everything looks OK.
answered Dec 1 '18 at 8:22
DAGDAG
1
My process was receiving a kill signal from the oracle 12 client(!)
https://community.oracle.com/thread/3567492
We disabled the “diagnostic Framework” on client level and everything looks OK.
answered Dec 1 '18 at 8:22
DAGDAG
1
answered Dec 1 '18 at 8:22
DAGDAG
1
answered Dec 1 '18 at 8:22
DAGDAG
1
answered Dec 1 '18 at 8:22
DAGDAG
1
1
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53488163%2fstrange-audit-log-entry%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Check in the kernel log (
/var/log/messages) - perhaps it was the OOM killer, which would mean that you ran out of memory.– Laurenz Albe
Nov 26 '18 at 20:22
Already checked that. There is nothing in /var/log/messages. In terms of memory resources, machine was using at that time less than 30% of the available memory. Thanks for replying anyway!
– DAG
Nov 26 '18 at 21:40