Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

If I run top -u username I will see all the processes by a particular user. Is there a way to also see all the processes that the user called via sudo?

share|improve this question

2 Answers 2

up vote 6 down vote accepted

It doesn't seem to be possible in an easy way.

From top's perspective, any command a user runs using sudo would appear to be running as root because it really is running as root.

One way you could try, is to track it down to the terminal where the user is logged in, then see processes running as root on that terminal.

For example,

$ w user
USER     TTY      FROM        LOGIN@   IDLE   JCPU   PCPU WHAT
user     pts/0    w.x.y.z     07:01    0.00s  1.07s  0.03s w user

Note the user is on pts/0.

Now run top.

Now press f (field select), then g (toggle controlling tty field), then Enter.

Now watch for processes with pts/0 in the TTY column.

You can also sort by TTY by pressing g a second time.


Or you could use procfs to get a list of pids, e.g.

$ sudo grep -l SUDO_USER="\<user\>" /proc/*/environ

Then do anything with that list. Even use it to run top -p <pid1>,<pid2>....

sudo top -p $(sudo grep -l SUDO_USER='\<user\>' /proc/[0-9]*/environ |
    cut -f 3 -d / |
    tr '\n' ',' |
    sed -e 's/,$//')

Of course, in that case, top won't show you if that user starts a new command using sudo.


Also don't forget that a user running a command is probably being logged, e.g. to /var/log/secure or /var/log/auth.log, or /var/log/sudo.log, or whatever your system uses.

share|improve this answer
    
remember that sudo -u starts the subprocess with a uid of the given user, not as root; you would want to limit based on that user. –  Arcege Feb 13 '11 at 14:14
    
Actually, at least in Linux even sudo command is shown under target user (so, for example under root). So ps is not going to help. –  Olli Feb 13 '11 at 15:26
    
It is possible under ps using the same method I just described for top: filter based on TTY (i.e. ps -t <tty>). –  Mikel Feb 13 '11 at 20:19

You could install htop and see if it gives you a better overview. htop supports filtering by user as well.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.