Get notified when a process quits

Question

I have developed an OSX daemon application, written in Qt (C++) and Objective-C. I monitor when other applications and processes are launched, with the use of a kernel extension, but need to know when they are terminated.

Is there any way to receive a notification of the termination of other processes, without having to constantly poll the target process's pid or mach task?

Answer 1

You can do that with kqueue/kevent. I hacked up a console application, then refactored it a little so it was somewhat obvious what was going on, and add made a helper function to more easily call it. Only barely tested, but hopefully it gives you a way to go forward...

Oh yeah, note that this code assumes the main run loop is running in the app... and it will call the block from within that runloop... simple enough to replace it with another run loop... or, if you are not using any CF run loop, you will have to add the kq file descriptor to whatever notification mechanism you are using.

EDIT

Fixed bug to re-enable the callback since file-descriptor callbacks must be re-enabled after each firing. Also, made args take multiple PIDs to demonstrate monitoring multiple PIDs.

Of course, you could easily use invoke a delegate method rather than using blocks, but that's not really the point...

Argh.... fix resource leak... I may not fix more... since it's a hacked example, but every time I go back and read it, I find something wrong... maybe I'll just stop reading it :-)

//  main.c

#include <CoreFoundation/CoreFoundation.h>
#include <sys/types.h>
#include <sys/event.h>
#include <sys/time.h>

static void
kqueueCallbackOnExit(CFFileDescriptorRef fileDescriptor,
                     CFOptionFlags flags,
                     void *info)
{
  int fd = CFFileDescriptorGetNativeDescriptor(fileDescriptor);
  struct kevent event;
  if (kevent(fd, NULL, 0, &event, 1, NULL) == 1 && event.udata) {
    void (^cb)(pid_t) = event.udata;
    cb((pid_t)event.ident);
    Block_release(cb);
  }
  CFFileDescriptorEnableCallBacks(
      fileDescriptor, kCFFileDescriptorReadCallBack);
}

static int
createOnProcessExitQueue()
{
  int kq = kqueue();
  if (kq < 0) return -1;

  CFFileDescriptorContext context = {
    .version = 0,
    .info = NULL,
    .retain = NULL,
    .release = NULL,
    .copyDescription = NULL
  };
  CFFileDescriptorRef kqFileDescriptor = CFFileDescriptorCreate(
      NULL, kq, true, kqueueCallbackOnExit, &context);
  if (kqFileDescriptor == NULL) {
    close(kq);
    kq = -1;
    return -1;
  }

  CFRunLoopSourceRef runLoopSource = CFFileDescriptorCreateRunLoopSource(
      NULL, kqFileDescriptor, 0);
  CFRunLoopAddSource(CFRunLoopGetMain(),
      runLoopSource, kCFRunLoopDefaultMode);
  CFRelease(runLoopSource);

  CFFileDescriptorEnableCallBacks(
      kqFileDescriptor, kCFFileDescriptorReadCallBack);
  CFRelease(kqFileDescriptor);

  return kq;
}

static int
onProcessExit(pid_t pid, void (^callback)(pid_t pid))
{
  static int kq;
  static dispatch_once_t onceToken;
  dispatch_once(&onceToken, ^{
    kq = createOnProcessExitQueue();
  });

  void (^cb)(pid_t) = Block_copy(callback);
  struct kevent event = {
    .ident = pid,
    .filter = EVFILT_PROC,
    .flags = EV_ADD | EV_ONESHOT,
    .fflags = NOTE_EXIT,
    .data = 0,
    .udata = (void*)cb
  };

  if (kevent(kq, &event, 1, NULL, 0, NULL) != 1) {
    Block_release(cb);
    return -1;
  }
  return 0;
}

int main(int argc, const char * argv[])
{
  for (int i = 0; i < argc; ++i) {
    pid_t pid = atoi(argv[i]);
    printf("watching pid: %d\n", pid);
    fflush(stdout);
    onProcessExit(pid, ^(pid_t pid) {
      printf("process %d just died\n", (int)pid);
      fflush(stdout);
    });
  }

  CFRunLoopRun();
  return 0;
}

Answer 2

Thanks to @JodyHagins, the research I did on kqueue and kevent led me to this blog which shows how GCD can be used to monitor a file and an example by Apple here . With that as a template, I came up with this: -

struct ProcessInfo
{
    int pid;
    dispatch_source_t source;
};

// function called back on event
void pid_event(struct ProcessInfo* procinfo)
{
    printf("****** Application exited: %d ******\n", procinfo->pid);
    dispatch_source_cancel(procinfo->source);
}

// function called back when the dispatch source is cancelled
void pid_finalize(struct ProcessInfo* procinfo)
{
    dispatch_release(procinfo->source);
    printf(">>>> Finished with %d <<<<\n", procinfo->pid);
    delete procinfo;
}

// Monitor a process by pid, for termination
void DispatchMonitorProcess(int pid, ProcessInfo* procinfo)
{
    procinfo->pid = pid;

    dispatch_queue_t queue = dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0);
    dispatch_source_t dsp = dispatch_source_create(DISPATCH_SOURCE_TYPE_PROC, pid, DISPATCH_PROC_EXIT, queue);

    dispatch_source_set_event_handler_f(dsp, (dispatch_function_t)pid_event);
    dispatch_source_set_cancel_handler_f(dsp,  (dispatch_function_t)pid_finalize);

    procinfo->source = dsp;
    dispatch_set_context(dsp, procinfo);

    dispatch_resume(dsp);
}

// Monitors the termination of a process with the given pid
void MonitorTermination(int pid)
{           
   DispatchMonitorProcess(pid, new ProcessInfo);
}

Answer 3

The following example takes a UNIX process ID as argument, and watches up to 20 seconds, and reports if the process terminates in that time

// cc test.c -framework CoreFoundation -O
#include <CoreFoundation/CoreFoundation.h>
#include <unistd.h>
#include <sys/event.h>
static void noteProcDeath(CFFileDescriptorRef fdref, CFOptionFlags callBackTypes, void *info) {
    struct kevent kev;
    int fd = CFFileDescriptorGetNativeDescriptor(fdref);
    kevent(fd, NULL, 0, &kev, 1, NULL);
    // take action on death of process here
    printf("process with pid '%u' died\n", (unsigned int)kev.ident);
    CFFileDescriptorInvalidate(fdref);
    CFRelease(fdref); // the CFFileDescriptorRef is no longer of any use in this example
}
// one argument, an integer pid to watch, required
int main(int argc, char *argv[]) {
    if (argc < 2) exit(1);
    int fd = kqueue();
    struct kevent kev;
    EV_SET(&kev, atoi(argv[1]), EVFILT_PROC, EV_ADD|EV_ENABLE, NOTE_EXIT, 0, NULL);
    kevent(fd, &kev, 1, NULL, 0, NULL);
    CFFileDescriptorRef fdref = CFFileDescriptorCreate(kCFAllocatorDefault, fd, true, noteProcDeath, NULL);
    CFFileDescriptorEnableCallBacks(fdref, kCFFileDescriptorReadCallBack);
    CFRunLoopSourceRef source = CFFileDescriptorCreateRunLoopSource(kCFAllocatorDefault, fdref, 0);
    CFRunLoopAddSource(CFRunLoopGetMain(), source, kCFRunLoopDefaultMode);
    CFRelease(source);
    // run the run loop for 20 seconds
    CFRunLoopRunInMode(kCFRunLoopDefaultMode, 20.0, false);
    return 0;
}

For those who barely know C:
build: cc test.c -framework CoreFoundation -O
run: ./a.out 57168
57168 is the pid of the process being monitored. Kill it to test!

Surely you can increase the 20 seconds to make it last as long as you want.