1

I'm struggling to find out which process exactly created a Unix socket.

I've read couple posts about it like using lsof -nl (which generally gets the pid of a process which listens to Unix socket), using netstat -tulpen which doesn't show the socket I'm searching for and etc.

Basically what I want is that gnome-keyring process listens to some unix socket (/run/user/1000/keyring-.../ssh) but which process exactly created that socket? Is there any command that would help me to find which process exactly (I could use Unix socket name if that would be helpful) created a socket? thanks.

P.S Should not that information be held somewhere in /proc/pid/...?

1
  • you could use auditd or SystemTap or sysdig but these would have to be in advance up and logging what you're interested in, and will not help if the creation has already happened
    – thrig
    Feb 6, 2018 at 17:13

1 Answer 1

Reset to default
0

AFAIK, you cannot know it.

A simple lsof /run/user/1000/keyring-.../ssh will print the list of the processes that have the file (or the pipe) open in that moment.

If a process created a file and, therefore, ended, any information on it is lost.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .