Process & Resource Monitoring (Top/Htop/Ps/Systemd)
Find out who actually killed your process when dmesg is silent
🧩 The Challenge
You come in on a Monday and find your database container vanished into thin air without a trace. It didn’t segfault, and the service file looks clean, so you’re left guessing if the OOM killer stepped in or if someone fat-fingered a kill signal.
đź’ˇ The Fix
Dig into the audit log directly using ausearch. It’s way more reliable than hunting through the giant mess in your standard system logs.
ausearch -m USER_END -m SYSTEM_SHUTDOWN -ts recent⚙️ Why It Works
This pulls the records for processes that were terminated by a user or the system itself, letting you see exactly which PID sent the signal and who was logged in when it happened.
🚀 Pro-Tip: If you don’t have auditd running, install it today or you’re just begging to be blind when things go sideways.
Linux Tips & Tricks | © ngelinux.com | 11/15/2026