LinuxQuestions.org - [SOLVED] what/who started that process

In general, no. Once a process has completed, it is removed from the kernel's process queues.

If the kernel held on to memory about processes after they had run then it would eventually run out of memory, not to mention the fact that you would run out of PID numbers very quickly.

While a process is running you can use the ps and pstree command to give you that kind of information; for more details see

Code:

man ps; man pstree

If you are interested in recording that kind of information then you could set up a cron job like this:

Code:

crontab -e

then add this line:

Code:

* * * * * sh -c "date; ps axo user,pid,ppid,tty,command" >> ~/ps.log

This will run once a second and append to the file ~/ps.log. You can then read it to see information about a particular process, including the PID, parent PID, user it's started by and terminal it's running on. But this will grow very big very fast, so you may want to either truncate the file periodically and/or run it less often at the risk of missing your process if it completes in less than a minute.