Suppose I ran the process with the following command:

myapp -e -c -f myapp.config > /var/log/myapp/myapp.log 2>&1

After a while I only have pid of myapp process, e.g. 1234. Is there a way to get the command with all flags and redirecting output to myapp.log somehow just by pid?

ps -o args= -p "$pid"

Will tell you the argument list given to the last command that process executed (or if it didn't execute any, the one its parent executed...) provided the process didn't override its argument list afterwards.

ps will show that arg list concatenated with spaces and up to a limit which you may be able to raise with some ps implementations by adding a couple of -w options). On Linux, you can see the arglist separated by NUL bytes in /proc/$pid/cmdline.

lsof +fg -ap "$pid" -d 0-2

Will tell you what the process' stdin, stdout and stderr file descriptors point to and the mode they were opened as (like W,AP for write-only with append as if a >> redirection was used in a POSIX shell).

| improve this answer | |
  • +1 for using lsof to detect that the process is redirecting into myapp.log – joeytwiddle Sep 28 '16 at 12:07
  • 1
    Another way to find the output file is: readlink /proc/$pid/fd/1 – joeytwiddle Sep 28 '16 at 12:12
  • Aaah, I had thought the OP meant process flags, not a print out of the command and its options! Nice answer. – Arronical Sep 28 '16 at 16:29

You can use the ps command, and specify the pid to examine with the -p switch, using the -f switch to give a full listing, or -l for a more detailed long listing.

As an example for output:

$ sleep 60 &
[1] 31441
$ ps -lp 31441
0 S     0 31441 31319  0  80   0 -  1423 hrtime pts/3    00:00:00 sleep
$ ps -fp 31441
root     31441 31319  0 10:44 pts/3    00:00:00 sleep 60

This does however output a header line, which you may not want in your log file. You can trim this by using the -h option, if your pid was 1234:

ps -lhp 1234 >> /var/log/myapp/myapp.log 2>&1

Note that I've redirected the output using >> to append to your logfile.

| improve this answer | |
  • To eliminate the header line tail -n+1 (requires GNU, but Q was Linux/Ubuntu). Or avoid the issue with ps -h{f,l}p 1234 (also GNU). – dave_thompson_085 Sep 28 '16 at 10:05
  • @dave_thompson_085 thanks, I knew there was an option to remove the header, but didn't scroll far enough down the manpage. tail -n1 definitely works on Ubuntu, why is the + necessary? – Arronical Sep 28 '16 at 10:22
  • I think dave meant to suggest tail -n+2 which shows all lines except the first. tail -n1 shows only the last line. Compare: seq 1 10 | tail -n+2 and so on. – joeytwiddle Sep 28 '16 at 12:05
  • 1
    @joeytwiddle ah now I see, I edited to include his advice to use -h as it avoids an unnecessary pipe and extra process. – Arronical Sep 28 '16 at 13:06

Using ps -f you can check the arguments list and also can redirect it to any file.

So, in this case just use ps -ef | grep 1234 > myapp.log

Please check this ps man page.

| improve this answer | |
  • 1
    Won't this also output the details of the grep command? – Arronical Sep 28 '16 at 9:33
  • 2
    @Arronical Yes, you are right. You can avoid that by excluding the grep command: ps -ef | grep 'foo' | grep -v grep – maulinglawns Sep 28 '16 at 9:37
  • @maulinglawns that's what I'd have done if I went down the grep route, has the benefit of removing the header too. – Arronical Sep 28 '16 at 9:53
  • To avoid the grep -v I use this trick: grep '123[4]' – joeytwiddle Sep 28 '16 at 11:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.