8

Suppose I ran the process with the following command:

myapp -e -c -f myapp.config > /var/log/myapp/myapp.log 2>&1

After a while I only have pid of myapp process, e.g. 1234. Is there a way to get the command with all flags and redirecting output to myapp.log somehow just by pid?

Improve this question

3 Answers 3

Reset to default
10 
ps -o args= -p "$pid"

Will tell you the argument list given to the last command that process executed (or if it didn't execute any, the one its parent executed...) provided the process didn't override its argument list afterwards.

ps will show that arg list concatenated with spaces and up to a limit which you may be able to raise with some ps implementations by adding a couple of -w options). On Linux, you can see the arglist separated by NUL bytes in /proc/$pid/cmdline.

lsof +fg -ap "$pid" -d 0-2

Will tell you what the process' stdin, stdout and stderr file descriptors point to and the mode they were opened as (like W,AP for write-only with append as if a >> redirection was used in a POSIX shell).

Improve this answer
3
  • +1 for using lsof to detect that the process is redirecting into myapp.log
    – joeytwiddle
    Sep 28, 2016 at 12:07
  • 1
    Another way to find the output file is: readlink /proc/$pid/fd/1
    – joeytwiddle
    Sep 28, 2016 at 12:12
  • Aaah, I had thought the OP meant process flags, not a print out of the command and its options! Nice answer.
    – Arronical
    Sep 28, 2016 at 16:29
4

You can use the ps command, and specify the pid to examine with the -p switch, using the -f switch to give a full listing, or -l for a more detailed long listing.

As an example for output:

$ sleep 60 &
[1] 31441
$ ps -lp 31441
F S   UID   PID  PPID  C PRI  NI ADDR SZ WCHAN  TTY          TIME CMD
0 S     0 31441 31319  0  80   0 -  1423 hrtime pts/3    00:00:00 sleep
$ ps -fp 31441
UID        PID  PPID  C STIME TTY          TIME CMD
root     31441 31319  0 10:44 pts/3    00:00:00 sleep 60

This does however output a header line, which you may not want in your log file. You can trim this by using the -h option, if your pid was 1234:

ps -lhp 1234 >> /var/log/myapp/myapp.log 2>&1

Note that I've redirected the output using >> to append to your logfile.

Improve this answer
4
  • To eliminate the header line tail -n+1 (requires GNU, but Q was Linux/Ubuntu). Or avoid the issue with ps -h{f,l}p 1234 (also GNU).
    – dave_thompson_085
    Sep 28, 2016 at 10:05
  • @dave_thompson_085 thanks, I knew there was an option to remove the header, but didn't scroll far enough down the manpage. tail -n1 definitely works on Ubuntu, why is the + necessary?
    – Arronical
    Sep 28, 2016 at 10:22
  • I think dave meant to suggest tail -n+2 which shows all lines except the first. tail -n1 shows only the last line. Compare: seq 1 10 | tail -n+2 and so on.
    – joeytwiddle
    Sep 28, 2016 at 12:05
  • 1
    @joeytwiddle ah now I see, I edited to include his advice to use -h as it avoids an unnecessary pipe and extra process.
    – Arronical
    Sep 28, 2016 at 13:06
1

Using ps -f you can check the arguments list and also can redirect it to any file.

So, in this case just use ps -ef | grep 1234 > myapp.log

Please check this ps man page.

Improve this answer
4
  • 1
    Won't this also output the details of the grep command?
    – Arronical
    Sep 28, 2016 at 9:33
  • 2
    @Arronical Yes, you are right. You can avoid that by excluding the grep command: ps -ef | grep 'foo' | grep -v grep
    – maulinglawns
    Sep 28, 2016 at 9:37
  • @maulinglawns that's what I'd have done if I went down the grep route, has the benefit of removing the header too.
    – Arronical
    Sep 28, 2016 at 9:53
  • To avoid the grep -v I use this trick: grep '123[4]'
    – joeytwiddle
    Sep 28, 2016 at 11:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .