7

I have written a small daemon that starts at the boot time and does all the things perfectly like writing in the log file. But I want to know, how can we check whether that process is daemon or not? My professor told me about a command ps -xj | grep daemon (my file name is daemon), but I am not convinced about that as it shows unwanted information. Is there any shell command for that?

edit: I am using Ubuntu 14.04 LTS

10

Anything with the PPID of 1 is, for the most part, likely a daemon. But there are situations that can arise where processes can become children of 1 that are not technically daemons. So the methods I discuss below are to demonstrate how you'd go about determining if a PID is owned by 1, not necessarily that its a actual daemon.

For example

$ ps -xj
 PPID   PID  PGID   SID TTY      TPGID STAT   UID   TIME COMMAND
 8420  1211  1211  8420 pts/4     1211 S+    1000   0:01 ssh dufresne
    1  2276  2275  2275 ?           -1 Sl    1000   0:48 /usr/bin/gnome-keyring-daemon --daemonize --login
 2196  2278  2278  2278 ?           -1 Ssl   1000   0:39 gnome-session
    1  2288  2278  2278 ?           -1 S     1000   0:00 dbus-launch --sh-syntax --exit-with-session
    1  2289  2289  2289 ?           -1 Ssl   1000   6:00 /bin/dbus-daemon --fork --print-pid 4 --print-address 6 --session
    1  2358  2289  2289 ?           -1 Sl    1000   0:01 /usr/libexec/gvfsd

The excerpt from Wikipedia can shed some light on things as well, but it too leaves things a little vague on how to actually determine if a process is a daemon or not.

excerpt from Wikipedia

In a Unix environment, the parent process of a daemon is often, but not always, the init process. A daemon is usually either created by a process forking a child process and then immediately exiting, thus causing init to adopt the child process, or by the init process directly launching the daemon. In addition, a daemon launched by forking and exiting typically must perform other operations, such as dissociating the process from any controlling terminal (tty). Such procedures are often implemented in various convenience routines such as daemon(3) in Unix.

NOTE: on systems that make use of SystemD (Red Hat distros such as Fedora) there's typically no init process but instead this:

$ ps -j -1
  PID  PGID   SID TTY      STAT   TIME COMMAND
    1     1     1 ?        Ss     0:42 /usr/lib/systemd/systemd --switched-root --system --deserialize 20

That's the process with the PID 1.

On Debian/Ubuntu system's they'll have a process still named init:

$ ps -j -1
  PID  PGID   SID TTY      STAT   TIME COMMAND
    1     1     1 ?        Ss     0:02 /sbin/init

So what's a daemon?

And here's the reason it can be tricky to determine if something is a daemon or not when its PPID is 1:

A process can become a child of the init process, (NOTE: that init process is PID 1), when their parent is killed or disowns them, these processes are not necessarily daemons, but will still show up as having their PPID equal to 1.

So to make the determination whether something is a daemon or not will likely require a battery of tests, and not simply looking to see if it's PPID is 1.

So where does that leave us?

To determine if something is a daemon you'll likely have to resort to a variety of tests such as:

  • PPID 1?
  • Has TTY attached?
  • Is it a service? sudo service ...?
  • Is it managed by Systemd, Upstart or SysV?
  • Is it listening on a port?
  • Is it writing to a log file? Syslog?

So we're having to resort to "duck typing" if it quacks, and swims, it's likely a duck, but even the above characteristics can fool you.

References

  • As you quoted: "In addition, a daemon launched by forking and exiting typically must perform other operations, such as dissociating the process from any controlling terminal (tty)." I'd include lack of a controlling TTY in my search criteria, as e.g. an ssh session is reparented to init when the sshd is restarted. – Simon Richter Oct 8 '14 at 13:30
  • @SimonRichter - Good point. Added a paragraph about this too. – slm Oct 8 '14 at 13:58
  • 4
    Having ppid=1 is not a reliable indicator of being a daemon. Plenty of processes that aren't daemons have survived their paren. Conversely, some daemon processes have a monitoring program or another process of the same daemon as their parent. – Gilles 'SO- stop being evil' Oct 8 '14 at 22:16
  • @Gilles - I've moved this A away from sounding so singular that PPID=1 is a good indicator of being a daemon. LMK what you think. – slm Oct 9 '14 at 13:14
  • “Anything with the PPID of 1 is, for the most part, likely a daemon” is fundamentally wrong. For example, my window manager configuration tends to double fork when launching programs, so I have plenty of X applications whose PPID is 1. The converse actually works better on my machine, but that's because it's a desktop machine which doesn't tend to run supervised daemon processes — on a server machine you're likely to find many daemons whose PPID is a supervisor process. – Gilles 'SO- stop being evil' Mar 22 '15 at 17:09
6

There is no way to discern a regular process from a daemon process. A daemon can be started from anywhere, not just init. It is not necessary to double fork and detach from the terminal to be considered a daemon.

On GNOME systems, gnome-settings-daemon keeps its parent, logs to the parent's terminal, and does not have PID1 as its parent PID, yet it is still considered a daemon.

A daemon is simply a continuously running process. They are, therefore, impossible to identify with one command.

Now, if what you want is to know if your particular daemon is running, then take a gander at the pgrep command.

Also, change the name of your daemon, there is already a command called daemon that you may eventually conflict with.

  • Yes. I thought that pid of daemon is not always one because when I wrote my first daemon it was not attached to pid 1 process. Thank you. – Pranjal Oct 8 '14 at 12:43
  • 3
    no TTY attached should be considered as having a strong correlation (probably much greater than PPID 1) with being a daemon. – vaab Oct 9 '14 at 0:09
  • Yes, but no any process can have no terminal attached (e.g. cron jobs). – CameronNemo Oct 9 '14 at 0:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.