Does Syslog in Linux include PID information like SecurityEvent log in Windows?

CJ Jung 0 Reputation points
2023-11-28T01:58:00.88+00:00

Hi

I wonder why syslog collected in Linux does not have PID information.

Is there any way to collect PID and PPID information from Linux?

For example, in Windows, SecurityEvent log include information about PID (i.e., which command is executed), so that users can trace back which process is called by which process.

Maybe it can be possible by configuring something, but I don't see this in Linux.

Anyone can give me a help?

Is creating custom log only way to do this?

Azure Virtual Machines
Azure Virtual Machines
An Azure service that is used to provision Windows and Linux virtual machines.
7,177 questions
Microsoft Intune Linux
Microsoft Intune Linux
Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.Linux: A family of open-source Unix-like operating systems.
43 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. vipullag-MSFT 24,216 Reputation points Microsoft Employee
    2023-11-28T05:31:23.0133333+00:00

    Hello CJ Jung

    Welcome to Microsoft Q&A Platform, thanks for posting your query here.

    In Linux, syslog does not include PID information by default.

    You have to use a custom log to collect PID and PPID information.

    Hope that helps.

  2. Crystal-MSFT 43,391 Reputation points Microsoft Vendor
    2023-11-29T01:58:32.4633333+00:00

    @CJ Jung, Thanks for posting in Q&A. From your description, I know the issue is with Linux which we are not familiar. Then I go to do some research, But I don't find the method to include PID and PPID into syslog. In fact, a process will likely have a different PID every time you launch it. As a workaround, you can run commands to get the PID and PPID when we see the log generated. Here is a link with the commands to get PID and PPID:

    https://www.fosslinux.com/121769/how-to-find-pid-and-ppid-in-linux.htm#:~:text=Finding%20the%20PID,currently%20running%20on%20your%20system.

    Note: Non-Microsoft link, just for the reference.

    You can also contact your Linux OS supporting to see if they can help on this.

    Thanks for your understanding.

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments