Process & Resource Monitoring (Top/Htop/Ps/Systemd)

Stop chasing PIDs that disappear before you can inspect them

🧩 The Challenge

You know that feeling when a script or a rogue process flickers in and out of existence, leaving you with a half-broken service and no log entries? I’ve spent way too many nights refreshing htop like a lunatic just hoping to catch a PID that only lives for a few milliseconds.

💡 The Fix

Use auditctl to force the kernel to scream whenever a specific process or exec call happens. It captures the activity in the background so you can actually read the breadcrumbs after the fact.

auditctl -a exit,always -F arch=b64 -S execve -k track_ghost
ausearch -k track_ghost

⚙️ Why It Works

Setting a syscall watch like this forces the kernel to log every execution attempt to the audit daemon, regardless of how quickly the process dies. Even if the task vanishes, your audit log remains behind as a permanent record of what command it tried to run.

🚀 Pro-Tip: Don’t forget to delete the rule with -d after you catch your culprit or your logs will explode.

Linux Tips & Tricks | © ngelinux.com | 11/6/2026