Sample Header Ad - 728x90

Process id of a command ran by an user

2 votes
1 answer
751 views
Consider i am running just some basic command.. ls Now would the above command have a pid, when it was getting executed? If yes, then how can i determine that pid? when i try echo $! right after the ls command, it returns empty output. whereas if i execute ls & and then echo $! now it gives me the pid of ls command. Actually i got this question when i was looking at the below auditd logs.. type=USER_CMD msg=audit(12/16/2014 17:15:36.201:68342) : user pid=19247 uid=enginst auid=enginst ses=4229 msg='cwd=/apps/oradump/ora_temp_rdbms/OH3 cmd=chmod -R 777 11203 terminal=pts/2 res=success' type=USER_CMD msg=audit(12/16/2014 17:36:33.968:68753) : user pid=1801 uid=enginst auid=enginst ses=4229 msg='cwd=/apps/oracle/RDBMS cmd=chmod -R 777 11203 terminal=pts/2 res=success' Here, the above log says that "chmod -R 777" has been ran by the user enginst, and there is a pid as well. Now, can i conclude that the chmod command has been explicitly ran by the user, since the auditd logs doesn't show ppid (parent process id), which would be the case, if some script/program initiated it? However i have turned on process accounting now to check the above. But either ways, my question stands.. would commands like chmod, ls gets a pid when it gets executed? or no? or it gets a pid when it runs in background, whereas not in foreground?
Asked by Gokul (1071 rep)
Dec 18, 2014, 11:59 AM
Last activity: Dec 18, 2014, 12:28 PM