8

On Linux: Normally pseudo terminals are allocated one after the other.

Today I realized that even after a reboot of my laptop the first opened terminal window (which was always pts/0 earlier) suddenly became pts/5.

This was weird and made me curious. I wanted to find out which process is occupying the device /dev/pts/0 and had no luck using common tools like who and lsof or even ps as suggested in the comment:

pf@pfmaster-P170EM:pts/6 /var/log 1115> ps auxww | grep pts/0 
pf        7042  0.0  0.0  17208   964 pts/6    S+   12:32   0:00 grep --color=auto pts/0

What I'm missing here? Possibly infected by a rookit?

3
  • 1
    What's the output of ps auxww|grep pts/0? (Edit it into your question, please!)
    – MadHatter
    Jan 29, 2014 at 11:28
  • My session is also on a pts other than pts/0. In my case, the other pts entries are from dead processes; see the output of who -a. Jan 28, 2016 at 11:27
  • 1
    @jonasmalacofilho: Many thanks for having a look into this. In my case (running Kubuntu 14.04.3 LTS based on Debian jessie/sid) it remains mysterious to me, which process occupies pts/0. It is not listed in the output oft the command who -a.
    – pefu
    Jan 29, 2016 at 9:24

2 Answers 2

4

If you have fuser installed and have the permission to use sudo:

for i in $(sudo fuser /dev/pts/0); do
    ps -o pid= -o command= -p $i
done

eg:

24622 /usr/bin/python /usr/bin/terminator
24633 ksh93 -o vi
1

I finally found an although very ugly way to figure out which process occupies the pseudo terminal pts/0.

As Superuser I did cd /proc and entered the following bash command:

for pid in [0-9]* ; do  \
    RES=`ls -l $pid/fd/* 2>/dev/null| grep pts/0`; \
    if [ -n "$RES" ]; then echo "Process $pid owns: $RES"; fi; \
done

This way I figured out that in my case the pts/0 was occupied by the process /usr/sbin/bumblebeed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .