Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Let's say we have a PID of a process and we know that it was started by init during startup. How do we find the script name that started it?

One way is to run grep $PROCESS_NAME /etc/init.d/*, but that solution is neither bulletproof nor very elegant.

Another one would be to run service --status-all and there is a good chance that the PID will be returned by one of the services, but that's even less elegant than the previous solution

EDIT:

The OS is RedHat/Ubuntu.

Let's suppose we have sshd running with PID 2083 like so:

UID        PID  PPID  C STIME TTY          TIME CMD
root      2083     1  0  2012 ?        00:00:00 /usr/sbin/sshd -D

The parent of it is init and I guess that it was started with the command service sshd start during bootup, but if we have something that cannot be easily guessed, for example a convoluted startup command or because of an obfuscated /etc/init.d/somedeamon script - how do we find the somedeamon script, knowing only the PID?

share|improve this question
1  
This is OS dependent. What OS are you running? –  jordanm Feb 6 '13 at 15:24
1  
You seem to be mixing terms somewhere. If init runs the script that starts the process then the process (daemon) that started it would be init. If you're looking for a process that had started this one. You could look at PPID. If this is not what you're asking then please clarify what you mean. –  Karlson Feb 6 '13 at 16:58
    
Sorry about the confussion. I've rewritten the question and I hope now it's clear. –  user28403 Feb 6 '13 at 18:10
add comment

2 Answers 2

An easy way to follow the PPID chain backwards is with the pstree tool:

pstree -p PID

This will show all the parent processes of the specified PID, for example:

$ pstree 42284
-+= 00001 root /sbin/launchd
 \-+= 00199 jack /sbin/launchd
   \-+= 00254 jack /Applications/iTerm.app/Contents/MacOS/iTerm -psn_0_90134
     \-+= 00309 root login -fp jack
       \-+= 00310 jack -bash
         \--= 42284 jack vim site.txt
share|improve this answer
    
Except when that doesn't work, which is not all that uncommon. Many daemons are started with a double fork (the script forks a launcher which forks the daemon thread then exits), so the PPID of the daemon is 1. –  Gilles Feb 6 '13 at 22:55
add comment

You should be able to follow the PPID chain backwards from the process you are interested in. But if, say, A launched B, B launched C, and B finished, now C's parent is init (PID 1). To access information about process PID, you do ps -l -pPID.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.