audit可以监听kill事件，找到进程被杀掉的罪魁祸首

Linux 审计系统：audit

Audit does not provide additional security to your system; rather, it can be used to discover violations of security policies used on your system. These violations can further be prevented by additional security measures such as SELinux.

The Linux Audit system provides a way to track security-relevant information on your system. Based on pre-configured rules, Audit generates log entries to record as much information about the events that are happening on your system as possible. This information is crucial for mission-critical environments to determine the violator of the security policy and the actions they performed.

关于系统的更多内容，可参考 redhat 管理员手册。

安装很简单：sudo apt install auditd

启动服务并查看状态： systemctl enable auditd.service; systemctl restart auditd.service

然后通过auditctrl添加规则： auditctl -a exit,always -F arch=b64 -S kill -F a1=9

启动然后kill掉Python程序; 查看日志，即可发现kill发起的程序和用户；

sudo ausearch -sc kill

日志如下：

time->Thu Feb 24 04:00:08 2022

type=PROCTITLE msg=audit(1645675208.403:201): proctitle="htop"

type=OBJ_PID msg=audit(1645675208.403:201): opid=40099 oauid=1016 ouid=1016 oses=12951 obj==unconfined ocomm="nvtop"

type=SYSCALL msg=audit(1645675208.403:201): arch=c000003e syscall=62 success=yes exit=0 a0=9ca3 a1=9 a2=c1 a3=8 items=0 ppid=45939 pid=40129 auid=1016 uid=1016 gid=1016 euid=1016 suid=1016 fsuid=1016 egid=1016 sgid=1016 fsgid=1016 tty=pts4 ses=18035 comm="htop" exe="/usr/bin/htop" subj==unconfined key=(null)

type=OBJ_PID 那一列是杀进程的命令（ocomm="nvtop" ）

type=SYSCALL 那一列是kill的调用者详情和系统命名码（syscall=62 ）