1

When I execute ps -auxwe on my Debian Jessie I have the following command listed:

...
myuser 21906  0.1  0.3 106324 63640 ?        Ss   03:17   0:00 proc
...

I can't find any other information (command path) about this "proc" process. Its PID seems to changed every few minutes.

When I execute ls -l /proc/21906 I have the following information:

dr-xr-x---  7 myuser myuser 4.0K Jan  5 03:21 .
drwxrwxrwt 14 root   root    24K Jan  5 03:23 ..
-r--------  1 myuser myuser  304 Jan  5 03:21 auxv
-r--r--r--  1 myuser myuser  138 Jan  5 03:21 cgroup
-r--r--r--  1 myuser myuser    4 Jan  5 03:21 cmdline
-rw-r--r--  1 myuser myuser    5 Jan  5 03:21 comm
-rw-r--r--  1 myuser myuser    9 Jan  5 03:21 coredump_filter
-r--r--r--  1 myuser myuser    2 Jan  5 03:21 cpuset
lrwxrwxrwx  1 myuser myuser    1 Jan  5 03:21 cwd -> /
-r--------  1 myuser myuser  243 Jan  5 03:21 environ
lrwxrwxrwx  1 myuser myuser   13 Jan  5 03:21 exe -> /usr/bin/perl
dr-x------  2 myuser myuser 4.0K Jan  5 03:21 fd
dr-x------  2 myuser myuser 4.0K Jan  5 03:21 fdinfo
-rw-r--r--  1 myuser myuser   33 Jan  5 03:21 gid_map
-r--------  1 myuser myuser   90 Jan  5 03:21 io
-r--------  1 myuser myuser    8 Jan  5 03:21 ipaddr
-r--r--r--  1 myuser myuser 1.3K Jan  5 03:21 limits
-r--r--r--  1 myuser myuser  49K Jan  5 03:21 maps
-r--r--r--  1 myuser myuser 2.3K Jan  5 03:21 mountinfo
-r--r--r--  1 myuser myuser 1.8K Jan  5 03:21 mounts
-r--------  1 myuser myuser 1.6K Jan  5 03:21 mountstats
dr-xr-xr-x 13 myuser myuser 4.0K Jan  5 03:21 net
dr-x--x--x  2 myuser myuser 4.0K Jan  5 03:21 ns
-r--r--r--  1 myuser myuser  33K Jan  5 03:21 numa_maps
-rw-r--r--  1 myuser myuser    2 Jan  5 03:21 oom_adj
-r--r--r--  1 myuser myuser    2 Jan  5 03:21 oom_score
-rw-r--r--  1 myuser myuser    2 Jan  5 03:21 oom_score_adj
-r--r--r--  1 myuser myuser    9 Jan  5 03:21 personality
-rw-r--r--  1 myuser myuser   33 Jan  5 03:21 projid_map
lrwxrwxrwx  1 myuser myuser    1 Jan  5 03:21 root -> /
-rw-r--r--  1 myuser myuser    6 Jan  5 03:21 setgroups
-r--r--r--  1 myuser myuser  284 Jan  5 03:21 stat
-r--r--r--  1 myuser myuser   28 Jan  5 03:21 statm
-r--r--r--  1 myuser myuser  823 Jan  5 03:21 status
-r--r--r--  1 myuser myuser   69 Jan  5 03:21 syscall
dr-xr-xr-x  3 myuser myuser 4.0K Jan  5 03:21 task
-rw-r--r--  1 myuser myuser   33 Jan  5 03:21 uid_map

How can I know what this process do?

Update:

Executing the following command cat /proc/21906/status return this:

Name:   proc
State:  S (sleeping)
Tgid:   21906
Ngid:   0
Pid:    21906
PPid:   1
TracerPid:      0
Uid:    1001    1001    1001    1001
Gid:    1002    1002    1002    1002
FDSize: 512
Groups: 1001 1002
VmPeak:   106456 kB
VmSize:   106456 kB
VmLck:         0 kB
VmPin:         0 kB
VmHWM:     68500 kB
VmRSS:     68500 kB
VmData:    78776 kB
VmStk:       132 kB
VmExe:         8 kB
VmLib:      4880 kB
VmPTE:       220 kB
VmSwap:    10756 kB
Threads:        1
SigQ:   0/63078
SigPnd: 0000000000000000
ShdPnd: 0000000000000000
SigBlk: 0000000000000000
SigIgn: 0000000001007eaf
SigCgt: 0000000180010000
CapInh: 0000000000000000
CapPrm: 0000000000000000
CapEff: 0000000000000000
CapBnd: 0000001fffffffff
Seccomp:        0
Cpus_allowed:   ff
Cpus_allowed_list:      0-7
Mems_allowed:   00000000,00000001
Mems_allowed_list:      0
voluntary_ctxt_switches:        5854
nonvoluntary_ctxt_switches:     8
PaX:    pemRs

Executing the following command sudo ls -l /proc/21906/fd return this:

lr-x------ 1 myuser myuser 64 Jan  5 04:03 0 -> /dev/null
l-wx------ 1 myuser myuser 64 Jan  5 04:03 1 -> /dev/null
l-wx------ 1 myuser myuser 64 Jan  5 04:03 2 -> /dev/null
lr-x------ 1 myuser myuser 64 Jan  5 04:03 258 -> pipe:[22064822]
lrwx------ 1 myuser myuser 64 Jan  5 04:03 260 -> socket:[15935884]
l-wx------ 1 myuser myuser 64 Jan  5 04:03 263 -> pipe:[22064823]
lrwx------ 1 myuser myuser 64 Jan  5 04:03 3 -> socket:[94609374]
lrwx------ 1 myuser myuser 64 Jan  5 04:03 5 -> socket:[22343274]

Thanks a lot to @icarus which take his time to resolve this problem.

  • Can you find the parent process ID of the same. – Mongrel Jan 5 '17 at 2:49
  • Ther parent id is 1. I've updated the question. – Tsounabe Jan 5 '17 at 2:55
  • 1
    As the PPID is one almost certainly this is doing a "double fork" to demonize itself. – icarus Jan 5 '17 at 2:57
  • Parent Process is starting all the other processes, that is the reason you are getting a different ID every time. – Mongrel Jan 5 '17 at 2:58
  • can you try ls -l /proc/<pid>/exe and share us the output. – Mongrel Jan 5 '17 at 3:00
1

@icarus give me the solution:

Replace temporary the /usr/bin/perl by this script:

#!/bin/bash 
exec 7>>/tmp/procstuff 
date >&7 
printf ">%s<\n" "$@" >&7 
ls -lR /proc/$$ >&7 
cat >&7 
sleep 400

Then looking into /tmp/procstuff we learned that it was a process of my hosting provider.

|improve this answer|||||
0

Can you try this below

pgrep '^$' | while read pid; do
    ps -f $pid
    ls -l /proc/$pid/cmdline
    netstat -tlp | grep '\<'$pid'\>'
    echo kill $pid  # remove the echo after testing
done

If pgrep '^$' lists nothing, then maybe a normal ps -o comm= -U myuser | od -c to understand what the process name is, so you can use pgrep to find only processes with that name

Hope this works.

|improve this answer|||||
  • thanks @mongrel. but icarus find the solution. see my answer. – Tsounabe Jan 5 '17 at 4:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for?Browse other questions tagged or ask your own question.