Each process in the operating system has its own unique identifier, by which you can get information about this process, as well as send it a control signal or complete it.
In Linux, name of this identifier is PID, and it can be recognized in several ways. In this article, we will discuss how to find out the PID of process, and why you might need it.
In addition, the command will also display the PID for grep, because the process was started during the search. To remove it, add the following filter: ps aux | grep name_of_process | grep -v grep
For example, let’s find the PID of all processes whose name contains the word “Apache”:
The pidof command searches for the PID of a particular process by its name. No occurrences, the process name should only match the desired one:
Using the -s option, you can ask the command to display only one PID:
Above, we looked at how to get the PID of a Linux process by name, and now let’s find out the PID from the file that the process uses. For example, we want to delete a file, and the system tells us that it is being used by another process.
With the help of the command lsof you can see which processes are using the directory or file at this moment. For example, open the audio file in the totem player, and then see which process uses its file:
At the beginning of the line we see the name of the program, and then comes its PID. There is another command that allows you to perform a similar task – it is a fuser:
Only the file and process PID will be displayed here. After the PID, there is one letter that indicates what this process does with the file or folder:
C – is the current directory;
r – is the root directory;
f – the file is open for reading or writing;
e – the file is executed as a program;
m – the file is included as a library.
Who used the file in Linux
To know the process that now locks the file is quite simple. But how do you know which process accesses a file for a long time, for example, executes it as a program or reads data from there? This task is more difficult, but completely solvable with the help of the auditd subsystem of kernel.In Ubuntu, it will have to be installed using the command:
sudo apt install auditd
Now create a rule for monitoring. For example, let’s track who runs the who utility:
auditctl -w /usr/bin/who -px -k who_exec
Here -w is the address of the file that we will be tracking, p is the action to be monitored, k is an arbitrary name for the rule. As an action, the following options can be used:
x – execution;
w – record;
r – reading;
a – change attributes.
Now we will perform a who once and see what happens in the log using the ausearch command :
sudo ausearch -i -k who_exec
Here in the SYSCALL section there is the PID of the process under which the program was launched, and also the PPID – the program that launched our who. We copy this PID and look at the information about it with the help of ps:
ps aux | grep 15595
It becomes clear that this is bash.
What process is using a port in Linux
Sometimes you need to know the PID of a Linux program that uses a network port, for example 80. You can use the ss command to do this:
sudo ss -lptn 'sport = :80'
We see that these are several Apache processes. Using the dport option , you can find out which process is sending data to the specified port:
sudo ss -lptn 'dport = :80'
In this article, we looked at how to find out the PID process in Linux by various conditions: name or file. As you can see, everything is quite simple, and in a few minutes, you can understand what is happening with your operating system, and what process is responsible for it.