[How To] find process information in Linux (PID and more).
Each process in the operating system has its own unique identifier, by which you can get information about this process, as well as send it a control signal or complete it.
In Linux, name of this identifier is PID, and it can be recognized in several ways. In this article, we will discuss how to find out the PID of process, and why you might need it.
The content of the article
- Find the Process ID (PID)
- Which process have locked the file
- Who used the file in Linux
- What process is using a port in Linux
- Conclusion
Find the Process ID (PID)
Command ps
The most common way to find out the Linux PID is to use the ps command: ps aux | grep name_of_process
$ ps aux | grep apache root 15778 0.0 0.4 204904 19008 ? Ss 23:25 0:00 /usr/sbin/apache2 -k start www-data 15780 0.0 0.2 205248 9932 ? S 23:25 0:00 /usr/sbin/apache2 -k start www-data 15781 0.0 0.2 205248 9932 ? S 23:25 0:00 /usr/sbin/apache2 -k start www-data 15782 0.0 0.2 205248 9932 ? S 23:25 0:00 /usr/sbin/apache2 -k start www-data 15783 0.0 0.2 205248 9932 ? S 23:25 0:00 /usr/sbin/apache2 -k start www-data 15784 0.0 0.2 205248 9932 ? S 23:25 0:00 /usr/sbin/apache2 -k start root 15867 0.0 0.0 17484 888 pts/1 R+ 23:26 0:00 grep --color=auto apache
In addition, the command will also display the PID for grep, because the process was started during the search. To remove it, add the following filter: ps aux | grep name_of_process | grep -v grep
For example, let’s find the PID of all processes whose name contains the word “Apache”:
$ ps aux | grep apache | grep -v grep root 15778 0.0 0.4 204904 19008 ? Ss 23:25 0:00 /usr/sbin/apache2 -k start www-data 15780 0.0 0.2 205248 9932 ? S 23:25 0:00 /usr/sbin/apache2 -k start www-data 15781 0.0 0.2 205248 9932 ? S 23:25 0:00 /usr/sbin/apache2 -k start www-data 15782 0.0 0.2 205248 9932 ? S 23:25 0:00 /usr/sbin/apache2 -k start www-data 15783 0.0 0.2 205248 9932 ? S 23:25 0:00 /usr/sbin/apache2 -k start www-data 15784 0.0 0.2 205248 9932 ? S 23:25 0:00 /usr/sbin/apache2 -k start
Command pgrep
If you do not need to see detailed information about the process, but only the PID is enough, you can use the pgrep utility:
$ pgrep apache 15778 15780 15781 15782 15783 15784
Command pidof
The pidof command searches for the PID of a particular process by its name. No occurrences, the process name should only match the desired one:
Using the -s option, you can ask the command to display only one PID:
$ pidof apache2 15784 15783 15782 15781 15780 15778 $ pidof -s apache2 15784
Command pstree
The pstree command allows you to view a list of child processes for a specific process, as well as their pid identifiers. For example, look at the Apache process tree:
$ pstree -p | grep apache2
|-apache2(15778)-+-apache2(15780)
| |-apache2(15781)
| |-apache2(15782)
| |-apache2(15783)
| `-apache2(15784)
[adinserter block=”6″]
Video
Which process have locked the file
Above, we looked at how to get the PID of a Linux process by name, and now let’s find out the PID from the file that the process uses. For example, we want to delete a file, and the system tells us that it is being used by another process.
With the help of the command lsof you can see which processes are using the directory or file at this moment. For example, open the audio file in the totem player, and then see which process uses its file:
lsof /home/user/song.mp3
At the beginning of the line we see the name of the program, and then comes its PID. There is another command that allows you to perform a similar task – it is a fuser:
fuser /home/user/song.mp3
Only the file and process PID will be displayed here. After the PID, there is one letter that indicates what this process does with the file or folder:
C – is the current directory;
r – is the root directory;
f – the file is open for reading or writing;
e – the file is executed as a program;
m – the file is included as a library.
Who used the file in Linux
To know the process that now locks the file is quite simple. But how do you know which process accesses a file for a long time, for example, executes it as a program or reads data from there? This task is more difficult, but completely solvable with the help of the auditd subsystem of kernel.In Ubuntu, it will have to be installed using the command:
sudo apt install auditd
Now create a rule for monitoring. For example, let’s track who runs the who utility:
auditctl -w /usr/bin/who -px -k who_exec
Here -w is the address of the file that we will be tracking, p is the action to be monitored, k is an arbitrary name for the rule. As an action, the following options can be used:
x – execution;
w – record;
r – reading;
a – change attributes.
Now we will perform a who once and see what happens in the log using the ausearch command :
sudo ausearch -i -k who_exec
Here in the SYSCALL section there is the PID of the process under which the program was launched, and also the PPID – the program that launched our who. We copy this PID and look at the information about it with the help of ps:
ps aux | grep 15595
It becomes clear that this is bash.
What process is using a port in Linux
Sometimes you need to know the PID of a Linux program that uses a network port, for example 80. You can use the ss command to do this:
sudo ss -lptn 'sport = :80'
We see that these are several Apache processes. Using the dport option , you can find out which process is sending data to the specified port:
sudo ss -lptn 'dport = :80'
Conclusion
In this article, we looked at how to find out the PID process in Linux by various conditions: name or file. As you can see, everything is quite simple, and in a few minutes, you can understand what is happening with your operating system, and what process is responsible for it.
Source: losst.ru
Related Posts
About The Author
