Why is this Python process running on my Mac OS X Server?

Question

Any way to see what started this process and why?

$ ps -e

  PID TTY           TIME CMD
  ...
   41 ??         0:00.55 /System/Library/Frameworks/Python.framework/Versions/2.5/Resources/Python.

Answer 1

Use ps -efww. The -f option adds a PPID that will tell you the parent process ID ("what started this process"). The -ww options remove all line length restrictions so that you can see the entire command which might tell you "why". I suspect that "Python.app" was truncated and that it's a python script of some sort running.

Another technique would be to use sudo lsof -p 41 to see what files that process has open. This might tell you enough to determine the purpose.

A final technique to consider would be sudo dtruss -p 41 to trace the activity of the program (see what it's doing).

Answer 2

With a PID of only 41, this is probably a daemon started during boot by launchd. If so, you can find the name of the launchd item that started it with sudo launchctl list | grep 41 -- the item's name may tell you what it is, and if it doesn't try looking for the corresponding .plist file in /System/Library/LaunchDaemons or /Library/LaunchDaemons, and see what info you can get from that (note: the path to the Python script should be under either the Program or ProgramArguments key).