CODEWITHSUNDEEP
linuxprocessmonitoringproc
redcore
redcore

Reputation: 11

How to find the commands executed by a /bin/bash process? (Linux)

TL;DR : I want to get the command running (if running) in the /bin/bash processes.

I want a script that can identify in the /bin/bash process the command /bin/bash is running. Tried to find it in /proc/[pid]/cmdline but it only show /bin/bash.

Is there a way to do this or what I'm wondeing is impossible. :o

I'm asking because when I run a ps -ef, some processes (like ssh) show how they'r running. 

user      30410 30409  0 10:58 pts/0    00:00:00 ssh [email protected]  <-- here

There is the ssh command fully printed.

We can see the same if I do the command ps -ef | grep "/bin/bash", it return :

user     20080  4999  0 13:40 pts/9    00:00:00 grep /bin/bash  <-- here

There is the command grep /bin/bash printed.

But if I run a bash loop like while true; do echo "hello"; done And then I do ps -ef | grep "while" It return nothing !!!

Upvotes: 1

Views: 2058

Answers (1)

eniacz
eniacz

Reputation: 127

that depends on what type of command are you looking for.

for external commands running from a shell, "ps -efH" shows you a hierarchical list of running processes, which you can then find the info you need.

bash built-in commands doesn't show up on ps list, you will have to enable script debugging using "set -x" and then monitor the stderr to see what the script is doing.

To answer the edits you made: while is a built-in, so it doesn't show up. but the "echo" will show up in the "ps -efH" output i mentioned above.

Upvotes: 1

Related Questions