|
0) When a service is started on system boot by the BSD or SysV initscripts the parent PID of the main process is "1", if it isn't the process was started later or by Something Else. 1) The system and daemon log could show initialisation lines. 2) The MAC-times of lockfiles or any opened files has changed. 3) The process PIDs are way different from processes that where not restarted (if no PID randomisation like GRSecurity provides is used). 4) A process watcher like Monit could restart the application or watch restarts and log it.
|
