473,376 Members | 1,187 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,376 software developers and data experts.

Recording Process Startup (forks/exec etc) in Unix

Hi All,

I am trying to find a way to record when processes on a Unix/Linux system
are started and when (i.e. new process ID, parent process ID, spawning
user,time) as a way of modeling user behavior in order to allow intrusion
detection. I was thinking of perhaps catching the SIGCHILD signal or
recording exec system calls. I could probably run this as root, so this
would probably be a daemon and record these to a logfile for a separate
analysis routine.

I am not opposed to roundabout programming, but I would like to do this
fairly efficiently. I could probably parse out the "/proc" filesystem or
the output of "/bin/ps", but I think that would make this method of
collection cause a performance hit in the system.

Does anyone know of any resources related to this or have any idea of how
to begin? I'd like to keep it in C if possible.

I appreciate your help!

Thanks,

Craig
Nov 13 '05 #1
1 1646
On Mon, 27 Oct 2003 20:45:05 GMT, The Boss
<bo****@deletethis.cs.usm.maine.edu> wrote in comp.lang.c:
Hi All,

I am trying to find a way to record when processes on a Unix/Linux system


Cross posting to this many newsgroups is rude. Especially when it is
off-topic in at least one of them, as it is in comp.lang.c. There are
no processes nor is there a UNIX or Linux in the C language.

Go to news:news.announce.newusers and read some articles on proper
posting manners. Scattering a question to every group with a name
that happens to make you think it might be relevant is just plain bad
manners.

[posted and mailed]

--
Jack Klein
Home: http://JK-Technology.Com
FAQs for
comp.lang.c http://www.eskimo.com/~scs/C-faq/top.html
comp.lang.c++ http://www.parashift.com/c++-faq-lite/
alt.comp.lang.learn.c-c++ ftp://snurse-l.org/pub/acllc-c++/faq
Nov 13 '05 #2

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

2
by: uwnewsgroup | last post by:
When I was using Runtime.exec(String cmd) to run a unix utility (join), and try to get its standard output by using Process.getOutputStream(), it blocks forever. I tried it using Java 1.4 and...
1
by: Peter Åstrand | last post by:
There's a new PEP available: PEP 324: popen5 - New POSIX process module A copy is included below. Comments are appreciated. ---- PEP: 324 Title: popen5 - New POSIX process module
0
by: rtm | last post by:
I am interested in running a process with a timeout. Also I'm interested in analyzing the output of this process. Under Unix, the solution is described clearly in the Perl Cookbook "16.10: ...
6
by: Michael J. Moore | last post by:
Is it the listener process, or some other Oracle process. Also, on a UNIX system, when you do "ps -ef" to see your processes, the PPID points back to a process named "init". Why does the PPID not...
2
by: James Colannino | last post by:
Hey everyone. I'm writing a small application in Python that uses os.fork() to create a separate process in which another application is run in the background. The problem is that I need to know...
4
by: a | last post by:
Hi, The php script that processes user input from a form, starts a new process using exec. In my case, the process may contain arbitrary, user defined functionality. How do I ensure that that...
1
by: JimC | last post by:
Hi all, Here's the problem: my main program forks two children, each of which execl() another program. That program is supposed to wait for the parent program to send a string to it (via...
8
by: mandydhaliwal | last post by:
Hi all, I am porting a win32 c++ program on Linux which first reads a list of processes and their paths from a file.Then this program should launch all of thesese processes. I tried to...
4
by: Ashit Vora | last post by:
Hi, My query is... I have a parent process which forks a child process to perform certain task. I wish to terminate the child process after certain amount of time (say 60 secs). Since I dont...
1
by: CloudSolutions | last post by:
Introduction: For many beginners and individual users, requiring a credit card and email registration may pose a barrier when starting to use cloud servers. However, some cloud server providers now...
0
by: ryjfgjl | last post by:
In our work, we often need to import Excel data into databases (such as MySQL, SQL Server, Oracle) for data analysis and processing. Usually, we use database tools like Navicat or the Excel import...
0
by: taylorcarr | last post by:
A Canon printer is a smart device known for being advanced, efficient, and reliable. It is designed for home, office, and hybrid workspace use and can also be used for a variety of purposes. However,...
0
by: Charles Arthur | last post by:
How do i turn on java script on a villaon, callus and itel keypad mobile phone
0
by: ryjfgjl | last post by:
If we have dozens or hundreds of excel to import into the database, if we use the excel import function provided by database editors such as navicat, it will be extremely tedious and time-consuming...
0
by: ryjfgjl | last post by:
In our work, we often receive Excel tables with data in the same format. If we want to analyze these data, it can be difficult to analyze them because the data is spread across multiple Excel files...
0
BarryA
by: BarryA | last post by:
What are the essential steps and strategies outlined in the Data Structures and Algorithms (DSA) roadmap for aspiring data scientists? How can individuals effectively utilize this roadmap to progress...
1
by: nemocccc | last post by:
hello, everyone, I want to develop a software for my android phone for daily needs, any suggestions?
0
by: Hystou | last post by:
There are some requirements for setting up RAID: 1. The motherboard and BIOS support RAID configuration. 2. The motherboard has 2 or more available SATA protocol SSD/HDD slots (including MSATA, M.2...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.