3

I'm looking for a way to log all process terminations on my Mac (OS X 10.6.8). (And see pid, timestamp, process name)

I've implemented something similar for HP-UX, but it required a kernel-level driver and intercepting several variations of "exit()" (the normal one, and the one invoked on behalf of a process while it's aborting).

Why do I want the info?

I've been seeing messages in my system log file (dmesg) like:

CODE SIGNING: cs_invalid_page(0x1000): p=91550[GoogleSoftwareUp] clearing CS_VALID
CODE SIGNING: cs_invalid_page(0x1000): p=92088[GoogleSoftwareUp] clearing CS_VALID

Although dmesg lacks timestamps, apps/Utilities/Console : Database : all : search for CS_VALID shows that the messages appears about once every 58 1/2 minutes.

I suspect the number after "p=" is a process id (pid) ... but for a process that has long since terminated by the time I see the message.

So, if there was a process termination log mechanism that recorded the pid, the time of termination, the reason for termination, and the process name (at time of termination), that would probably allow me to determine who's causing those errors to be logged!

(No, I'm not running Chrome on my Mac, and ps -ef | grep -i goog gets no hits either ... I'm not consciously running any Google apps on the Mac)

thanks,

Stan sieler@me.com

Edit: Interesting observation Gary, thanks! On my system there seems to be no correlation with the pids in dmesg and the pids in Library/Logs/GoogleSoftwareUpdateAgent.log ... but if you're seeing that correlation that's interesting!

I am getting "Failed to connect to system engine" in my google log, but less often than once an hour. Here are the most recent three:

2012-10-31 23:42:13.019 GoogleSoftwareUpdateAgent[13062/0xb0207000] [lvl=3] -[KSAgentApp(KeystoneThread) runKeystonesInThreadWithArg:] Failed to connect to system engine.
2012-11-01 05:34:33.051 GoogleSoftwareUpdateAgent[18632/0xb0207000] [lvl=3] -[KSAgentApp(KeystoneThread) runKeystonesInThreadWithArg:] Failed to connect to system engine.
2012-11-01 11:26:49.842 GoogleSoftwareUpdateAgent[23871/0xb0207000] [lvl=3] -[KSAgentApp(KeystoneThread) runKeystonesInThreadWithArg:] Failed to connect to system engine.

...roughly once every six hours, and different pids than in dmesg.

petrus
  • 5,297
  • 26
  • 42
Stan Sieler
  • 141
  • 3

1 Answers1

2
less $HOME/Library/Logs/GoogleSoftwareUpdateAgent.log

appears to already be logging the PID:

2012-10-31 09:35:17.003 GoogleSoftwareUpdateAgent[24805/0xb0289000] [lvl=3] -[KSAgentApp(KeystoneThread) runKeystonesInThreadWithArg:] Failed to connect to system engine.

which relates to the dmesg message:

CODE SIGNING: cs_invalid_page(0x1000): p=24805[GoogleSoftwareUp] clearing CS_VALID
Ladadadada
  • 26,337
  • 7
  • 59
  • 90
Gary Liddle
  • 21
  • 2