Consider i am running just some basic command..
Now would the above command have a pid, when it was getting executed? If yes, then how can i determine that pid?
when i try
right after the ls command, it returns empty output.
whereas if i execute
now it gives me the pid of ls command.
Actually i got this question when i was looking at the below auditd logs..
type=USER_CMD msg=audit(12/16/2014 17:15:36.201:68342) : user pid=19247 uid=enginst auid=enginst ses=4229 msg='cwd=/apps/oradump/ora_temp_rdbms/OH3 cmd=chmod -R 777 11203 terminal=pts/2 res=success' type=USER_CMD msg=audit(12/16/2014 17:36:33.968:68753) : user pid=1801 uid=enginst auid=enginst ses=4229 msg='cwd=/apps/oracle/RDBMS cmd=chmod -R 777 11203 terminal=pts/2 res=success'
Here, the above log says that "chmod -R 777" has been ran by the user enginst, and there is a pid as well.
Now, can i conclude that the chmod command has been explicitly ran by the user, since the auditd logs doesn't show ppid (parent process id), which would be the case, if some script/program initiated it?
However i have turned on process accounting now to check the above. But either ways, my question stands..
would commands like chmod, ls gets a pid when it gets executed? or no? or it gets a pid when it runs in background, whereas not in foreground?