After a process has been terminated, is it possible to retrieve any information about it, such as when it started and finished, &c.Is it possible to enable logging of this information?
What information about a process is retrievable after it is terminated?
linux;process;logs;process management
In general, only if you log it at the time. Probably the most straightforward way would be to use the kernel's auditing features using auditd, and configure the system calls that you care about logging.