Process & Resource Monitoring (Top/Htop/Ps/Systemd)

Find out who actually killed your process when dmesg is silent

🧩 The Challenge

You come in on a Monday and find your database container vanished into thin air without a trace. It didn’t segfault, and the service file looks clean, so you’re left guessing if the OOM killer stepped in or if someone fat-fingered a kill signal.

💡 The Fix

Dig into the audit log directly using ausearch. It’s way more reliable than hunting through the giant mess in your standard system logs.

ausearch -m USER_END -m SYSTEM_SHUTDOWN -ts recent

⚙️ Why It Works

This pulls the records for processes that were terminated by a user or the system itself, letting you see exactly which PID sent the signal and who was logged in when it happened.

🚀 Pro-Tip: If you don’t have auditd running, install it today or you’re just begging to be blind when things go sideways.

Linux Tips & Tricks | © ngelinux.com | 11/15/2026