• From: Dubai, UAE
  • Last visit: 11-Aug-2010 19:36:58
  • Registered: 19-May-2009
  • Posts: 64

Topic: Find out process for each daemon

Hi guys,

I just needed a oneliner which reminded me in last meetup.

If I remember correct Zak wanted to know how you can find which process is underlying to a service which is open on your system.

Simple example for port 80.

xaitax@w00t:~# ps auxf | grep $(fuser -n tcp 80)
80/tcp:
www-data 12274  0.0  0.1   5868  1832 ?        S    04:39   0:00 /usr/sbin/lighttpd -f /etc/lighttpd/lighttpd.conf

Explanation:
`ps auxf` gives you all running processes.
`fuser -n tcp 80` will show you the process id of the process bound to port 80.
Both combined will give you the above. smile

/xai

http://primepage.de

xaitax's Website

  • From: Dubai, UAE
  • Last visit: 4 days ago
  • Registered: 19-May-2009
  • Posts: 62

Re: Find out process for each daemon

If you have more than one process using the port, grep needs a bit of finessing: 

# ps auxf | grep -E $(fuser -n tcp 80 | sed 's/. ./\|/g')
80/tcp:
root     24195  0.0 10.5  31444 13816 ?        Ss   Jul01   0:01 /usr/sbin/httpd
apache   23594  0.0 14.6  40844 19196 ?        S    Jul05   0:02  \_ /usr/sbin/httpd
apache   30603  0.0 14.5  40640 19008 ?        S    Jul05   0:01  \_ /usr/sbin/httpd
apache   20351  0.0 11.8  37800 15572 ?        S    03:38   0:00  \_ /usr/sbin/httpd
apache   24509  0.0 14.5  40708 19072 ?        S    03:56   0:00  \_ /usr/sbin/httpd
apache   26161  0.0 12.1  38088 15916 ?        S    03:57   0:00  \_ /usr/sbin/httpd

That's what you get when you run a real man's webserver lol

Last edited by dan_r (06-Jul-2009 13:28:25)

dan_r's Website

  • From: Dubai, UAE
  • Last visit: 11-Aug-2010 19:36:58
  • Registered: 19-May-2009
  • Posts: 64

Re: Find out process for each daemon

It is not possible that more than one process is running on the same port - the childs are quite uninteresting. big_smile

If your apache is running as root I hope it is chrooted? tongue

/xai

http://primepage.de

xaitax's Website

  • From: Dubai, UAE
  • Last visit: 4 days ago
  • Registered: 19-May-2009
  • Posts: 62

Re: Find out process for each daemon

Is that a threat?  tongue

OK, let's agree that only one "parent" process can bind to a given socket. 
But each child process can use the parent's socket.

Ya ya I know you don't care about children.  Wait until you have one, it will change your mind smile

About Apache - you're the expert of course.  If I remember correctly, it usually starts out as root to have permission to open port 80, but then it's supposed to continue on as some other user.  Looks like my configuration needs a bit of tweaking roll

Last edited by dan_r (06-Jul-2009 14:44:07)

dan_r's Website