4

Let's say we have a PID of a process and we know that it was started by init during startup. How do we find the script name that started it?

One way is to run grep $PROCESS_NAME /etc/init.d/*, but that solution is neither bulletproof nor very elegant.

Another one would be to run service --status-all and there is a good chance that the PID will be returned by one of the services, but that's even less elegant than the previous solution

EDIT:

The OS is RedHat/Ubuntu.

Let's suppose we have sshd running with PID 2083 like so:

UID        PID  PPID  C STIME TTY          TIME CMD
root      2083     1  0  2012 ?        00:00:00 /usr/sbin/sshd -D

The parent of it is init and I guess that it was started with the command service sshd start during bootup, but if we have something that cannot be easily guessed, for example a convoluted startup command or because of an obfuscated /etc/init.d/somedeamon script - how do we find the somedeamon script, knowing only the PID?

3
  • 1
    This is OS dependent. What OS are you running?
    – jordanm
    Feb 6, 2013 at 15:24
  • 1
    You seem to be mixing terms somewhere. If init runs the script that starts the process then the process (daemon) that started it would be init. If you're looking for a process that had started this one. You could look at PPID. If this is not what you're asking then please clarify what you mean.
    – Karlson
    Feb 6, 2013 at 16:58
  • Sorry about the confussion. I've rewritten the question and I hope now it's clear.
    – user28403
    Feb 6, 2013 at 18:10

2 Answers 2

3

An easy way to follow the PPID chain backwards is with the pstree tool:

pstree -p PID

This will show all the parent processes of the specified PID, for example:

$ pstree 42284
-+= 00001 root /sbin/launchd
 \-+= 00199 jack /sbin/launchd
   \-+= 00254 jack /Applications/iTerm.app/Contents/MacOS/iTerm -psn_0_90134
     \-+= 00309 root login -fp jack
       \-+= 00310 jack -bash
         \--= 42284 jack vim site.txt
1
  • 2
    Except when that doesn't work, which is not all that uncommon. Many daemons are started with a double fork (the script forks a launcher which forks the daemon thread then exits), so the PPID of the daemon is 1. Feb 6, 2013 at 22:55
0

You should be able to follow the PPID chain backwards from the process you are interested in. But if, say, A launched B, B launched C, and B finished, now C's parent is init (PID 1). To access information about process PID, you do ps -l -pPID.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .