How to find out the source of a POSIX signal
The man page for sigaction(2)
suggests that the PID of the signal sender is available in the siginfo_t structure passed to your signal handler. This obviously requires that you use sigaction().
From the man page:
The sigaction structure is defined as something like:
struct sigaction {
void (*sa_handler)(int);
void (*sa_sigaction)(int, siginfo_t *, void *);
sigset_t sa_mask;
int sa_flags;
void (*sa_restorer)(void);
};
And the siginfo_t
structure looks like this:
siginfo_t {
int si_signo; /* Signal number */
int si_errno; /* An errno value */
int si_code; /* Signal code */
int si_trapno; /* Trap number that caused
hardware-generated signal
(unused on most architectures) */
pid_t si_pid; /* Sending process ID */
uid_t si_uid; /* Real user ID of sending process */
int si_status; /* Exit value or signal */
clock_t si_utime; /* User time consumed */
clock_t si_stime; /* System time consumed */
sigval_t si_value; /* Signal value */
int si_int; /* POSIX.1b signal */
void *si_ptr; /* POSIX.1b signal */
int si_overrun; /* Timer overrun count; POSIX.1b timers */
int si_timerid; /* Timer ID; POSIX.1b timers */
void *si_addr; /* Memory location which caused fault */
int si_band; /* Band event */
int si_fd; /* File descriptor */
}
On platforms with DTrace (OS X, Solaris, …others?) you can use it with a probe like this to log the information you're after:
sudo dtrace -n 'proc:::signal-send { printf("Process %d (%s by UID %d) sending signal %d to pid=%d\n",pid,execname,uid,args[2],args[1]->pr_pid); }'
I based this on a script found at the bottom of http://www.brendangregg.com/DTrace/dtrace_oneliners.txt plus some additional "relevant variable names" tips at https://stackoverflow.com/a/10465606/179583, and seems to work under some basic testing. Now, if only my process would unexpectedly die again! ;-)
You can trace signals using systemtap. Here is a simple example
https://sourceware.org/systemtap/examples/lwtools/killsnoop-nd.stp