Is there a way to find the command by which an application has launched an external process?

Motivation: I'm using an IDE Qt Creators which at some point calls a SFTP to transfer a file to a remote location. Presuming that the SFTP is spawned as a separate process by the IDE is there a way to find out what exact command did the IDE run?

  • While the command is running, or after the fact? Or do you want to see it as it happens? Dec 18 '15 at 17:37
  • @Gilles The time isn't important, just getting the actually run command and its parameters. Dec 19 '15 at 0:04

You can use strace -p <PID> -f to trace child process that are created as a result of the fork(2), vfork(2) and clone(2) system calls.

Hint: Using -p PID -f will attach all threads of the given PID if it is multi-threaded.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.