0

Having the ability to identify a PID for a process, let's say HTTPD for example, how can I determine later on, on that same server, if that PID/Process is still the original one ?

For instance, I could have an HTTPD process under PID 123. A few minutes later that process could be terminated and a new HTTPD process created under (coincidentally) PID 123. If I am monitoring a PID, I would not identify that HTTPD had ever been terminated.

What are the aspects I can rely to determine uniqueness on that are identifiable under /proc/<PID>

Ideally, a DTTM created, would be optimal, although I am not sure where this information is available in the kernel's reppresentation under /prod/PID

GPATA
  • 3
  • 1

1 Answers1

2

You may want to look at the creation date of the /proc/PID directory. It will be the same as the startup time. If the processus is destroyed and when it is re-run takes the same PID, it will change the start date (the directory date)

Dom
  • 6,743
  • 1
  • 20
  • 24