[SOLVED] show user invoker name of a process

marcos egatz · 02-03-2012, 11:05 PM

Hi,
This question could be somehow naive, but Is there some way to establish the user who started a given process? I know that any program already have an owner, although It may also happen, that this process could have execution permissions to other users. The doubt is when I analyze a process which is already running(e.g. java process), through issuing ps command, and I don't know who might have invoked or started it.

thanks

druuna · 02-04-2012, 03:45 AM

Hi,

Are you looking for something like pstree?

The following would show all processes in a tree. It also shows which process spawned another and who is the owner.

Code:

pstree -Acu

A smaller list can be created by giving a starting pid (i.e. pstree -Acu PIDNUMBER)

Hope this is what you are looking for.

unSpawn · 02-04-2012, 03:50 AM

...additionally if your distribution is capable of running the auditd service it would be easy to log extended information.
* Java has diagnostics utilities for the JVM side of things but that's all I know as I don't need to deal with Java.

markseger · 02-04-2012, 07:50 AM

For doing things programmatically my favorite command is this:

all process by pid and parent pid. all you need to know

ps -axopid,ppid,cmd

I think the ps -o switch might be one of the most useful as with it you can show almost anything.

-mark