In Linux, there are many files we can modify to add a program run at start up (/etc/rc.local, bashrc, bash_profile, $HOME/.config/autostart, ...) ? Now I have a reverse question: I have a program, can I check if this program was run during start up?

**Note: The program can run once at start up and exit

  • With systemd, if it was started as a service you can read the journal. – jasonwryan Nov 4 '16 at 7:05
  • Thanks @jasonwryan. That's not cover my case. The program can run just by you execute it, – tuantm Nov 4 '16 at 7:56
  • Then, unless it includes a logging facility, how would you expect to be able to determine if it ran or not? – jasonwryan Nov 4 '16 at 8:06
  • 1
    I suggest expanding your question. This looks like X-Y question. Why would you want to check that? Is this check looking for some speciifc program? – MatthewRock Nov 4 '16 at 10:17

You can look at the access time for the script. This isn't 100% reliable (since some filesystems can have noatime set). But it's usually useful for init-scripts, e.g.,

find /etc -type f -atime -1

I've found it useful for quite a while.


pstree will give you a detailed output of process running in a tree format.

Sample output here

init─┬─auditd───{auditd} ├─crond ├─docker─┬─10*[bash] │ ├─docker───5*[{docker}] │ ├─docker───4*[{docker}] │ ├─2*[docker───3*[{docker}]] │ ├─start-app.sh─┬─java───40*[{java}] │ │ └─tail │ ├─start-app.sh─┬─java───81*[{java}] │ │ └─tail

  • This assumes the process is still running... – jasonwryan Nov 4 '16 at 7:41
  • Thanks @Kailas. Same as jasonwwryan said, this must assume that the process is still running. – tuantm Nov 4 '16 at 7:54
  • The same informatoin can be output with stock ps: ps auf, or on modern systems with systemctl status - if the process is still running. – Ned64 Nov 4 '16 at 7:54

You can execute the next command:

ps aux | grep PROCESS_NAME

For example for a ping process, the result will be:

user  9639  0.0  0.0   6508   732 pts/16   S+   08:44   0:00 ping
user  9641  0.0  0.1  12972  2420 pts/15   R+   08:44   0:00 grep --colour=auto ping

If you only get the second line, it means that the process is not running.

If you suspect that the process is crashing, you could use atop, you can find another question about atop here.

  • Thanks @Murillo. But that is not my case, because a program can run and exit immediately so if you can't check it in process management information information – tuantm Nov 4 '16 at 7:53

I would look at the init locations and see if the program is set there to run.

Honestly, if the program somehow could run, but you don't know whether it run or not, the only chance of seeing if it did run is to either check if it had a way to run(e.g. was registered in some local.rc or such), or by checking the results(e.g. the program always touches file /home/someuser/a, and nothing else should have touched it).

The above assumes you don't have any logs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.