7

On Linux: Normally pseudo terminals are allocated one after the other.

Today I realized that even after a reboot of my laptop the first opened terminal window (which was always pts/0 earlier) suddenly became pts/5.

This was weird and made me curious. I wanted to find out which process is occupying the device /dev/pts/0 and had no luck using common tools like who and lsof or even ps as suggested in the comment:

pf@pfmaster-P170EM:pts/6 /var/log 1115> ps auxww | grep pts/0 
pf        7042  0.0  0.0  17208   964 pts/6    S+   12:32   0:00 grep --color=auto pts/0

What I'm missing here? Possibly infected by a rookit?

  • 1
    What's the output of ps auxww|grep pts/0? (Edit it into your question, please!) – MadHatter Jan 29 '14 at 11:28
  • My session is also on a pts other than pts/0. In my case, the other pts entries are from dead processes; see the output of who -a. – Jonas Malaco Jan 28 '16 at 11:27
  • 1
    @jonasmalacofilho: Many thanks for having a look into this. In my case (running Kubuntu 14.04.3 LTS based on Debian jessie/sid) it remains mysterious to me, which process occupies pts/0. It is not listed in the output oft the command who -a. – pefu Jan 29 '16 at 9:24
4

If you have fuser installed and have the permission to use sudo:

for i in $(sudo fuser /dev/pts/0); do
    ps -o pid= -o command= -p $i
done

eg:

24622 /usr/bin/python /usr/bin/terminator
24633 ksh93 -o vi
1

I finally found an although very ugly way to figure out which process occupies the pseudo terminal pts/0.

As Superuser I did cd /proc and entered the following bash command:

for pid in [0-9]* ; do  \
    RES=`ls -l $pid/fd/* 2>/dev/null| grep pts/0`; \
    if [ -n "$RES" ]; then echo "Process $pid owns: $RES"; fi; \
done

This way I figured out that in my case the pts/0 was occupied by the process /usr/sbin/bumblebeed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.