[How To] Find out the PID of process in Linux

Each process in the operating system has its own unique identifier, by which you can get information about this process, as well as send it a control signal or complete it.
In Linux, name of this identifier is PID, and it can be recognized in several ways. In this article, we will discuss how to find out the PID of process, and why you might need it.

The content of the article

How to know the PID of the Linux process

Command ps

The most common way to find out the Linux PID is to use the ps command: ps aux | grep name_of_process

$ ps aux | grep apache
root      15778  0.0  0.4 204904 19008 ?        Ss   23:25   0:00 /usr/sbin/apache2 -k start
www-data  15780  0.0  0.2 205248  9932 ?        S    23:25   0:00 /usr/sbin/apache2 -k start
www-data  15781  0.0  0.2 205248  9932 ?        S    23:25   0:00 /usr/sbin/apache2 -k start
www-data  15782  0.0  0.2 205248  9932 ?        S    23:25   0:00 /usr/sbin/apache2 -k start
www-data  15783  0.0  0.2 205248  9932 ?        S    23:25   0:00 /usr/sbin/apache2 -k start
www-data  15784  0.0  0.2 205248  9932 ?        S    23:25   0:00 /usr/sbin/apache2 -k start
root      15867  0.0  0.0  17484   888 pts/1    R+   23:26   0:00 grep --color=auto apache

In addition, the command will also display the PID for grep, because the process was started during the search. To remove it, add the following filter: ps aux | grep name_of_process | grep -v grep
For example, let’s find the PID of all processes whose name contains the word “Apache”:

$ ps aux | grep apache | grep -v grep
root      15778  0.0  0.4 204904 19008 ?        Ss   23:25   0:00 /usr/sbin/apache2 -k start
www-data  15780  0.0  0.2 205248  9932 ?        S    23:25   0:00 /usr/sbin/apache2 -k start
www-data  15781  0.0  0.2 205248  9932 ?        S    23:25   0:00 /usr/sbin/apache2 -k start
www-data  15782  0.0  0.2 205248  9932 ?        S    23:25   0:00 /usr/sbin/apache2 -k start
www-data  15783  0.0  0.2 205248  9932 ?        S    23:25   0:00 /usr/sbin/apache2 -k start
www-data  15784  0.0  0.2 205248  9932 ?        S    23:25   0:00 /usr/sbin/apache2 -k start

Command pgrep

If you do not need to see detailed information about the process, but only the PID is enough, you can use the pgrep utility:

$ pgrep apache
15778
15780
15781
15782
15783
15784

Command pidof

The pidof command searches for the PID of a particular process by its name. No occurrences, the process name should only match the desired one:
Using the -s option, you can ask the command to display only one PID:

$ pidof apache2
15784 15783 15782 15781 15780 15778
$ pidof -s apache2
15784

Command pstree

The pstree command allows you to view a list of child processes for a specific process, as well as their pid identifiers. For example, look at the Apache process tree:

$ pstree -p | grep apache2
           |-apache2(15778)-+-apache2(15780)
           |                |-apache2(15781)
           |                |-apache2(15782)
           |                |-apache2(15783)
           |                `-apache2(15784)

Which process have locked the file

Above, we looked at how to get the PID of a Linux process by name, and now let’s find out the PID from the file that the process uses. For example, we want to delete a file, and the system tells us that it is being used by another process.
With the help of the command lsof you can see which processes are using the directory or file at this moment. For example, open the audio file in the totem player, and then see which process uses its file:

lsof /home/user/song.mp3

At the beginning of the line we see the name of the program, and then comes its PID. There is another command that allows you to perform a similar task – it is a fuser:

fuser /home/user/song.mp3

Only the file and process PID will be displayed here. After the PID, there is one letter that indicates what this process does with the file or folder:
C – is the current directory;
r – is the root directory;
f – the file is open for reading or writing;
e – the file is executed as a program;
m – the file is included as a library.

Who used the file in Linux

To know the process that now locks the file is quite simple. But how do you know which process accesses a file for a long time, for example, executes it as a program or reads data from there? This task is more difficult, but completely solvable with the help of the auditd subsystem of kernel.In Ubuntu, it will have to be installed using the command:

sudo apt install auditd

Now create a rule for monitoring. For example, let’s track who runs the who utility:

auditctl -w /usr/bin/who -px -k who_exec

Here -w is the address of the file that we will be tracking, p is the action to be monitored, k is an arbitrary name for the rule. As an action, the following options can be used:
x – execution;
w – record;
r – reading;
a – change attributes.

Now we will perform a who once and see what happens in the log using the ausearch command :

sudo ausearch -i -k who_exec

Here in the SYSCALL section there is the PID of the process under which the program was launched, and also the PPID – the program that launched our who. We copy this PID and look at the information about it with the help of ps:

ps aux | grep 15595

It becomes clear that this is bash.

What process is using a port in Linux

Sometimes you need to know the PID of a Linux program that uses a network port, for example 80. You can use the ss command to do this:

sudo ss -lptn 'sport = :80'

We see that these are several Apache processes. Using the dport option , you can find out which process is sending data to the specified port:

sudo ss -lptn 'dport = :80'

Conclusion

In this article, we looked at how to find out the PID process in Linux by various conditions: name or file. As you can see, everything is quite simple, and in a few minutes, you can understand what is happening with your operating system, and what process is responsible for it.

Source: losst.ru

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.