Latest response

Why if i kill -9 a thread the multithread process is killed?

# ps -T -p 1082
   PID   SPID TTY          TIME CMD
  1082   1082 ?        00:00:00 rsyslogd
  1082   1092 ?        00:00:00 in:imjournal
  1082   1093 ?        00:00:00 rs:main Q:Reg
 kill -9 1093

# ps -T -p 1082
   PID   SPID TTY          TIME CMD

# ps -ef|grep rsyslogd
root       1919      1  0 07:48 ?        00:00:00 /usr/sbin/rsyslogd -n
root       1934   1776  0 07:49 pts/0    00:00:00 grep --color=auto rsyslogd


Because a thread is a part of a process. A thead is not a separate process.

At a quick glance, these pages explain the concepts:

I remember this being a confusing thing. I could read the words on pages like that, but I didn't really understand this until I actually wrote my own simple programs which fork to create a new process and which use threads. You might find it useful to look into doing that?

i seen that i can attach with strace to any thread strace -fvttTyy -s 4096 -o /tmp/strace.txt -p 1481 in order to see /tmp/strace.txt i need to kill the process 1481. root 1481 1420 99 05:29 tty1 00:00:10 y

how can i see this content without to kill that process? only strace -fvttTyy -s 4096 -o /tmp/strace.txt ./y?

strace will write out to the file as soon as there is activity.

What are the contents of the strace.txt file after you kill the parent process?

If all it contains is cleanup stuff, then you can infer the PID you've attached strace to isn't making any system calls. Maybe it's idle, maybe it's blocking on a read, maybe it's waiting on the results of a poll or select.

If you want to know what particular threads are doing in their userspace logic - not just system calls - then you'll need to install the debuginfo for the relevant package and attach the gdb debugger to the process.

To prevent this sort of "troubleshooting the troubleshooting tools", what is the overall thing you're investigating here? Is there some actual problem with rsyslog you're trying to fix, or are you just curious and tinkering?