I'm struggling to find out which process exactly created a Unix socket.
I've read couple posts about it like using lsof -nl
(which generally gets the pid of a process which listens to Unix socket), using netstat -tulpen
which doesn't show the socket I'm searching for and etc.
Basically what I want is that gnome-keyring
process listens to some unix socket (/run/user/1000/keyring-.../ssh
) but which process exactly created that socket? Is there any command that would help me to find which process exactly (I could use Unix socket name if that would be helpful) created a socket? thanks.
P.S
Should not that information be held somewhere in /proc/pid/...
?
auditd
orSystemTap
orsysdig
but these would have to be in advance up and logging what you're interested in, and will not help if the creation has already happened