I have a java application that got SIG TERM. I want to know the pid of the process that sent this signal.
Is that possible?
BCC includes the killsnoop utility. It requires a kernel with BPF support.
Excerpt from killsnoop (8) man-page:
killsnoop traces the kill() syscall, to show signals sent via this method. This may be
useful to troubleshoot failing applications, where an unknown mechanism is sending
signals.
This works by tracing the kernel sys_kill() function using dynamic tracing, and will need
updating to match any changes to this function.
This makes use of a Linux 4.5 feature (bpf_perf_event_output()); for kernels older than
4.5, see the version under tools/old, which uses an older mechanism.
Since this uses BPF, only the root user can use this tool.