kill.d - snoop process signals as they occur. Uses DTrace. kill.d kill.d is a simple DTrace program to print details of process signals as they are sent, such as the PID source and destination, signal number and result. This program can be used to determine which process is sending signals to which other process. Since this uses DTrace, only the root user or users with the dtrace_kernel privilege can run this command. Solaris stable - needs the syscall provider.

Default output, print process signals as they are sent. # kill.d

FROM source PID

COMMAND source command name

TO destination PID

SIG destination signal ("9" for a kill -9)

RESULT result of signal (-1 is for failure)

See the DTraceToolkit for further documentation under the Docs directory. The DTraceToolkit docs may include full worked examples with verbose descriptions explaining the output. kill.d will run forever until Ctrl-C is hit. Brendan Gregg [Sydney, Australia] dtrace(1M), truss(1)