Mine the Harvest

While I am no strace zen master, I did discover that in addition to
system calls, strace will also show any signals a process gets. Nifty eh?

Further, you can attach strace to a running process - you don't have to
start a process with it initially.

This can be super handy to tell if a process is even receiving signals
you are sending to it - thus you can tell if it is being mean and
ignoring them or never getting them in the first place. For example.

In shell one:

root@Anduril:~# vim blah
{ctrl z}
[1]+  Stopped                 vim blah
root@Anduril:~# jobs
[1]+  Stopped                 vim blah
root@Anduril:~# pgrep vim
22264
root@Anduril:~# strace -p 22264

In shell two, now kill the process:

root@Anduril:~# kill -9 22264
root@Anduril:~# pgrep vim

Now return to shell one and you will see strace caught and displayed the
signal received:

Process 22264 attached - interrupt to quit
+++ killed by SIGKILL +++
Process 22264 detached
[1]+  Killed                  vim blah

(As a note, you can also use lsof -p 22264 to view the files vim has
open as well.)

Why can't you kill some processes?

If a process is in an uninterpretable sleep state (listed as D for
example in ps ) it will not receive signals until it is active again.
Kill it all you want, but its out to lunch and wont care.

If a process has a defunct parent process, you might need to kill it -
and not the child. Parent processes are easily identified with pstree:

root@Anduril:~# pstree  -p | grep vim
        |                       |-bash(22180)---bash(22197)---vim(22663)

Good hunting!

Pete