If a user runs a process from a terminal, is it possible to tell? Compared to if the process was launch from a program, where that program was launched from a terminal.

The use case is if it's run by the terminal, it will look like this:


but if it's run by another program x, it could look like this, if x prepends something to stdout/stderr:

x: suman:
x: suman:

but I want to detect that, so it just looks like:

  • What's the use case for this? – Kusalananda Jul 16 '18 at 7:42
  • 1
    Running a process that way is running it from a program. There isn't some magic distinction, and "run from a terminal" is an erroneous concept that is a fundamental flaw in this question. All programs are run by other programs. Terminals are not programs. They are devices that a program that runs programs can potentially be talking to. (They are devices with a program at the other end, be it one running in ROM on a piece of physical hardware or a software emulator running locally. But that does not make the terminal device the thing that runs stuff.) Shells are programs. – JdeBP Jul 16 '18 at 7:51
  • I will add the use case to the OP – Alexander Mills Jul 16 '18 at 7:59
  • @JdeBP I understand that :) Let's ditch the semantics - does the question make sense to you or not? The question is - did the user launch the program by typing it into a terminal and hitting enter, or did a program launch it? It doesn't have to be exact, a best guess will do, in terms of whether it knows how it was launched (by a human or machine). – Alexander Mills Jul 16 '18 at 8:01
  • Then why base a question on such a faulty premise? And what on earth is the antecedent for "it". What will look like that? Why do you think that it will in fact look like that in the first place? And "typing it into a terminal and hitting enter" causes a program to launch it. You apparently do not understand this well enough. – JdeBP Jul 16 '18 at 8:03

You can see what the parent process ID (PPID) is of the process in question, then use the PPID to determine if it was ran from a shell or different program.

For example, if I wanted to see what was running this sleep process, I can look for it's PPID.

$ ps -ef | grep "sleep"
user       2470  1996  0 06:30 pts/1    00:00:00 sleep 60

PID 1996 is the PPID of the sleep process. Let's grep for that now.

$ ps -ef | grep 1996
user       1996  1995  0 05:57 pts/1    00:00:00 bash

PID 1996 is a bash shell, which is a good indication that the sleep process could be running from a terminal. To take it even one step further, you can grep for the PPID of the bash process.

$ ps -ef | grep 1995
user       1995   448  0 05:57 tty1     00:00:00 /usr/bin/urxvt

The PPID of the bash process is urxvt, a virtual terminal. So the sleep command is being ran from a terminal.

  • interesting something like this might work – Alexander Mills Jul 16 '18 at 6:40
  • 3
    How can you tell from that that the bash shell is interactive or a script? – Kusalananda Jul 16 '18 at 7:38
  • 1
    @Kusalananda: I think it's a guessing game. The arguments for the process shown in ps could be a hint. For example, urxvt vs urxvt -e. Another hint could be if the processes originate from a tty vs pts. However, someone could be executing commands via an expect script over ssh for all we know. – Peschke Jul 16 '18 at 7:50
  • 1
    It's worse than a guessing game. It's conceptually faulty. Run a subordinate interactive shell in the login session, and suddenly every (non-built-in) command run is in the second category given by the question. – JdeBP Jul 16 '18 at 8:04
  • @JdeBP it's NOT a faulty question. Did a human hit enter to launch the program or not? Last time I checked, Linux doesn't give you a way to know that. Doesn't meant it's a faulty question, it's only that Linux never offered a way to know if a program was "launched by a human". – Alexander Mills Jul 16 '18 at 8:06

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.