Identify who terminated the process

Question

Question

Ashok Kumar · Dec 16

#InterSystems IRIS #InterSystems IRIS for Health

Hello Community,

Is there any option or log is available to identify who killed/terminated the running process?

Thanks!

Product version: IRIS 2024.1

$ZV: IRIS for Windows (x86-64) 2024.1.1 (Build 347U)

Discussion (5)1

Log in or sign up to continue

Yaron Munz · Dec 16

Hi @Ashok Kumar,
you are correct, I was mistaken. The correct one is: "%System/%Login/Terminate"
Auditing | InterSystems IRIS Data Platform 2024.3

2 0

score 0 · Answer 1 · 2024-12-16T08:58:47-05:00

%ZSTOP routine may log the last user.

But it has no information on an external stopped process. E.g from MGMT portal

score 0 · Answer 2 · 2024-12-16T09:05:58-05:00

Hello,

If you have audit enabled, and the item "%System/%Login/JobEnd" is enabled, you may know which user killed a process

score 0 · Answer 3 · 2024-12-16T09:47:32-05:00

Hello @Yaron Munz
I've enabled the "%System/%Login/JobEnd" in Audit events. I opened a new terminal(new process) and I terminate the process via Management portal. However, I haven't seen any entry in the Audit log.

score 1 · Answer 4 · 2024-12-16T11:12:31-05:00

Ashok Kumar · Dec 16

Great. It works!

1 0