On Fri, 7 Sep 2007, Dr. David Alan Gilbert wrote:
> * David Stevens ([EMAIL PROTECTED]) wrote:
> > A program called "lsof".
>
> lsof wouldn't help me after the processes have exited and just left the
> ports in timewait would it? In these cases I was seeing a storm of
> port creation by what turned out to be processes that ran for a
> fraction of a second. I don't think lsof would have helped me there.
The only thing I can think of that might hive helped is use of
BSD process accounting. You need to have CONFIG_BSD_PROCESS_ACCT
enabled in your kernel config, have the psacct package installed,
enable process accounting using the accton command, and then you
can use commands like lastcomm or sa to get information about
previously executed commands. I don't know if it records info
on sockets used (don't think so), but it still might have provided
some useful clues as to what was happening.
-Bill
-
To unsubscribe from this list: send the line "unsubscribe linux-net" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
