Capture ps output over time?

[JAFrank]

Is there a way to capture, say, 60 seconds or so of ps output?

Our system uses a customized user interface which has a button to save accounting info to a file. What I am trying to do is figure out what program it calls, so that I can set up a cron entry which runs the process on a regular basis - rather than relying on the operator to remember to do it.

What I would like to do is identify all of the processes which are active during a certain period (after the button is pushed) and compare that list to the system's idle state. Adding to the complication is that the process only takes a second or two to run, which makes it difficult to catch using top, or running ps manually.

Thanks for any help!

Allen

 

[julianbarnett]

Can you figure out the Process ID of the user interface program? - if so you can run truss -aefp <PID> > <logfile> before the button is pressed. This will trace all the system calls made by the menu and child processes to a logfile and should enable you to find out what it is calling. Use ctrl C to terminate the truss process once you have captured the data you require.

 

[JAFrank]

Unfortunately, at this point, I don't know the process id. The whole thing runs in just a second or two, and so far, I haven't been quick enough to hit the button, switch windows, and start ps in time to catch it still running.

I tried watching top while it ran, but either top updates too slowly, or the process never used enough resources to get onto top's radar.

I suppose a brute force way to go around it would be to write a script that puts something like

ps -A >> pslog.txt

inside a do loop and have it iterate once a second 60 times....but I was hoping there was a cleaner method that I wasn't aware of.

Thanks for your help!

 

[Annihilannic]

If you can determine the process ID of the parent process (i.e. the one you are running in which you press this button) it may be quicker to use /usr/proc/bin/pstree. You could even run it once a second just before you press the button, using something like while date ; do /usr/proc/bin/pstree 123 ; sleep 1 ; done > /tmp/pstree.out. A lot less output to trawl through! Annihilannic.