Logs for Services Killed or Stopped

devUnix · 09-01-2014, 02:33 PM

Is there a way to see the logs of services as to when they were stopped or their PIDs were killed?

For example,

Nagios is alerting:

Code:

PROCS CRITICAL: 0 processes with command name 'nsca'

I see on the server:

Code:

# /etc/init.d/nsca status
nsca dead but pid file exists

The PID file is here:

Code:

# ls -l nsca.pid
-rw-r--r-- 1 nagios nagios 6 Jun 13 07:26 nsca.pid

# cat nsca.pid
32533


# ps up 32533
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND


# grep 32533 /var/log/messages
#

So, I can see the process was started on 6th June but can't determine when it was stopped / killed.

MensaWater · 09-02-2014, 08:46 AM

You could look through the system logs of the client (e.g. /var/log/messages).

Also the Nagios master keeps logs of when it sees events. You can step back through the logs in the web GUI (i.e. select the service that is alerting then select the option for view history for this service) by day. Alternatively you can grep for what you want in the logs which are generally in /var/log/nagios (and /var/log/nagios/archive) on the master server to get the first time it alerted. You may have to convert the time entry seen from epoch to human readable. You can do that with:

perl -e 'print scalar localtime <epoch>;print "\n"'