Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Any way to see what started this process and why?

$ ps -e

  PID TTY           TIME CMD
  ...
   41 ??         0:00.55 /System/Library/Frameworks/Python.framework/Versions/2.5/Resources/Python.
share|improve this question
1  
Maybe with ps fax. –  mailq Sep 10 '11 at 22:08

2 Answers 2

up vote 2 down vote accepted

Use ps -efww. The -f option adds a PPID that will tell you the parent process ID ("what started this process"). The -ww options remove all line length restrictions so that you can see the entire command which might tell you "why". I suspect that "Python.app" was truncated and that it's a python script of some sort running.

Another technique would be to use sudo lsof -p 41 to see what files that process has open. This might tell you enough to determine the purpose.

A final technique to consider would be sudo dtruss -p 41 to trace the activity of the program (see what it's doing).

share|improve this answer
    
-ww helped a lot. showed me the parent was mailmanctl –  Meltemi Sep 11 '11 at 1:44

With a PID of only 41, this is probably a daemon started during boot by launchd. If so, you can find the name of the launchd item that started it with sudo launchctl list | grep 41 -- the item's name may tell you what it is, and if it doesn't try looking for the corresponding .plist file in /System/Library/LaunchDaemons or /Library/LaunchDaemons, and see what info you can get from that (note: the path to the Python script should be under either the Program or ProgramArguments key).

share|improve this answer
    
helpful thanks! –  Meltemi Sep 11 '11 at 1:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.