4

Is there a way to get a list of running processes on a Linux system, minus the default ones running on every system (i.e. only the ones that were installed/executed after the fact). Can this be accomplished with ps, or any similar tool?

Thanks

1
  • 1
    I think the key problem you're going to have here is that the "default" set of processes varies greatly depending on not just the operating system, but what roles were selected during installation, etc. Linux distributions are very flexible in this regard.
    – Mattie
    Apr 4, 2013 at 13:01

2 Answers 2

1

By default system processes you probably mean "daemons" like httpd,nfsd,etc. TTY column in ps output is ? for daemons. So to exclude those, you probably would need to write a script for this in shell/perl depending what you know

Here I am assuming tty as column 2, so depending on your output you might want to change that.

Perl:

#!/usr/bin/perl
use strict;
use warnings;

open (PS,'ps aux |') or die "command can't execute $!";  # Runs command using pipe

while(<PS>){                             # Run through pipe line by line
    my $ttycol=(split) [2];              # get tty column from ps output 

    if($ttycol ne '?'){                  # If col is ? then it's a daemon
        print $_;            # if not print
    }
}
close(PS);

then just run it like "perl script.pl".

Shell:

With input from lain, same an be achieved in shell script as

ps -ef | awk '$6 != "?" {print}'

1
  • 1
    ps -ef | awk '$6 != "?" {print}'
    – user9517
    Apr 4, 2013 at 13:21
0

I am going to also assume, like the previous answer, that you're referring to daemons as "default", and thus they will be running on tty ?. In this case, the following should work, though unfortunately I'm not in a position to test it here at work.

ps aux | grep "[:space;]+?[:space:]+"

ps aux gives you all the every process on system in standard BSD format, piped to grep -v which will match all lines NOT including the regex string ([:space;]+?[:space:]+). Regex looks for any number of spaces followed by a single '?' followed by any number of spaces. (in theory, there should be nothing matching that description OTHER than entries in a column such as tty.)

Quick, dirty, and from a relative newcomer, but there you have it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .