launchd initiated process receiving signal 15 (TERM)

Question

I've installed TotalFinder (a plugin, of sorts, for Finder) and it's randomly being killed off several times a day. I contacted the developer and he didn't have any ideas, but did say a quick google search revealed others experiencing the same launchd issue with other software.

Log shows: com.apple.launchd.peruser.502: (com.blah.blah) Exited: Terminated: 15

Source code: https://github.com/binaryage/crashwatcher/blob/master/main.m

Anyone have any idea how to debug this further? I'm on 10.8.2 on a MBPro Retina.

Answer 1

In the past when I need to diagnose something like this I've used the kill.d script from Brendan Gregg:

dtrace:::BEGIN
{
    /* Print header */
    printf("%5s %12s %5s %-6s %s\n","FROM","COMMAND","SIG","TO","RESULT");
}

syscall::kill:entry
{
    /* Record target PID and signal */
    self->target = arg0;
    self->signal = arg1;
}

syscall::kill:return
{
    /* Print source, target, and result */
    printf("%5d %12s %5d %-6d %d\n",
     pid,execname,self->signal,self->target,(int)arg0);

    /* Cleanup memory */
    self->target = 0;
    self->signal = 0;
}

Running it and then running killall Finder in another shell results in:

[user@fozzy Scripts]$ sudo kill.d.sh
 FROM      COMMAND   SIG TO         RESULT
  155      launchd    15 4294900609 -1
66872      killall    15 66687      0

Which tells you what (killall at PID 66872 with Signal 15) killed which process (in this case, 66687 my then-running instance of the Finder) and the result. It does slow down the system somewhat while running, but should provide you with the results you need - just make a note of your Finder PID before hand, and then let it run (either while you are working, or overnight to avoid disrupting your work) and look to see what killed that PID.