I'm looking for a way to get the PID of a short child process in Linux. The process is instant from a human perspective. I know the parent process which will spawn the child process.
Is there a way to log information about all the processes that are created by a specific parent process?
I'm not looking for a way to retroactively figure out the PID of the child but a way to log it once it happens.
You could use the audit system:
sudo auditctl -a exit,always -S execve -F ppid="$pid" would cause audit entries to be generated each time a child of $pid executes a command. audit.log would have things like:
type=SYSCALL msg=audit(1373986729.977:377): arch=c000003e syscall=59 success=yes exit=0 a0=7ff000e4b188 a1=7ff000e4b1b0 a2=7fff928d47e8 a3=7fff928caac0 items=2 ppid=7502 pid=691 auid=10031 uid=10031 gid=10031 euid=10031 suid=10031 fsuid=10031 egid=10031 sgid=10031 fsgid=10031 ses=1 tty=pts5 comm="echo" exe="/bin/echo" key=(null) type=EXECVE msg=audit(1373986729.977:377): argc=2 a0="/bin/echo" a1="test" type=CWD msg=audit(1373986729.977:377): cwd="/tmp" type=PATH msg=audit(1373986729.977:377): item=0 name="/bin/echo" inode=131750 dev=fe:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 Where you can find the pid amongst other things.
If you're interested in processes that don't necessarily execute something, you can add audit rules for the fork and clone system calls.
[this answer ispired by this ams aswer ]
If the child process is a distinct executable (lets call it foo ) , you can try to use a shell wrapper.
Rename original executable:
$ cd \path\to\foo\ $ mv foo foo.moved Create wrapper as foo :
#!/bin/sh \path\to\foo\foo.moved "$@" & FOO_PID=$! echo $FOO_PID >\tmp\foo.pid make it executable :
chmod +x foo The next time the program is run, you get the pid in \tmp\foo.pid .
When you run a command in a shell you can find out the PID of the last process that was run in the background using the special variable $! in a Bash shell.
For example:
$ sleep 5 & $ echo $! 8648 Also when you background a process the PID of that process is returned via the console like this:
$ sleep 5 & [1] 8648 Another method would be to use pgrep -P <PPID>. For example:
# PID of bash shell $ echo $$ 8376 # run fake job $ sleep 120 & [1] 8891 # pgrep PPID $ pgrep -P 8376 8891 There is another method if you can inject the following in front of the execution of the program you're trying to get the child PIDs to:
$ valgrind --trace-children=yes <cmd> For example:
# sample.bash #/bin/bash ls $ valgrind --trace-children=yes ./sample.bash ... ==17734== possibly lost: 0 bytes in 0 blocks ==17734== still reachable: 33,606 bytes in 95 blocks ==17734== suppressed: 0 bytes in 0 blocks ==17734== Rerun with --leak-check=full to see details of leaked memory ==17734== ==17734== For counts of detected and suppressed errors, rerun with: -v ==17734== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 6 from 6) ==17733== ==17733== HEAP SUMMARY: ==17733== in use at exit: 36,409 bytes in 879 blocks ... The 17733 is the PPID and the PID 17734 is the child PID that get's invoked (ls).
pgrep -P is one approach. The $! is useful if the task is backgrounded, since the result could be captured when the command is invoked. pgrep method only works if you manage to run pgrep during the lifetime of the process, which is very short. lastcomm). Looking through the docs, I don't see the ability to search for a processes' child processes either. If your OS (unspecified in o/p) doesn't support process tracing, consider replacing the child image with a wrapper, assuming the new process loads a new image.
