Is it possible to find which process is using OPENSSL in linux? - linux

Suppose, one process is running and accessing OPENSSL shared library to perform some operation. Is there any way to find the pid of this process ?
Is there any way to find on which core this process is running ?
If possible, does it require any special privilege like sudo etc?
OS- Debian/Ubuntu

Depending on what exactly you want, something like this might do:
lsof | grep /usr/lib64/libcrypto.so | awk '{print $1, $2}' | sort -u
This essentially:
uses lsof to list all open files on the system
searches for the OpenSSL library path (which also catches versioned names like libcrypto.so.1.0)
selects the process name and PID
removes any duplicate entries
Note that this will also output processes using previous instances of the shared library file that were e.g. updated to a new version and then deleted. It also has the minor issue of outputting duplicates when a process has multiple threads with different names.
And yes, this may indeed require elevated privileges, depending on the permissions on your /proc directory.
If you really do need the processor core(s), you could try something like this (credit to dkaz):
lsof | grep /usr/lib64/libcrypto.so | awk '{print $2}' |
xargs -r ps -L --no-headers -o pid,psr,comm -p | sort -u
Adding the lwp variable to the ps command would also show the thread IDs:
lsof | grep /usr/lib64/libcrypto.so | awk '{print $2}' |
xargs -r ps -L --no-headers -o pid,lwp,psr,comm -p
PS: The what-core-are-the-users-of-this-library-on requirement still sounds a bit unusual. It might be more useful if you mentioned the problem that you are trying to solve in broader terms.

thkala is almost right. The problem is that the answer is half, since it doesn't give the core.
I would run that:
$ lsof | grep /usr/lib64/libcrypto.so |awk '{print $2}' | xargs ps -o pid,psr,comm -p

Related

Getting User from processid when multiple user processes exist

I'm trying to tweak a bash script to pull back PID's of the individual application accounts when there are multiple applications running as a masterId. This used to run under individual user accounts, but recent changes have forced the applications to all run under a combined "masterId", but still maintain a unique application Id that I can grep against.
Normally
pgrep -u "appId"
would give me a single PID. Now I have to run:
pgrep -u "masterId"
it returns all of the PID's (each one is it's own application).
1234
2345
3456
I'm trying to come up with a command to bring me back just the PID of the appAccount(n) so I can pipe it into other useful commands. I can do a double grep (which is closer to what I want):
ps aux | grep -i "masterId" | grep -i "appAccount(n)"
and that will get me the entire single process information, but I just want the PID to do something like:
ps aux | grep -i "masterId" | grep -i "appAccount(n)" | xargs sudo -u appAccount(n) kill -9
How do I modify the initial above command to get just the PID? Is there a better way to do this?
pgrep --euid "masterId" --list-full | awk '/appAccount(n)/ {print $1}'
Output the full process command line, then select the one with the desired account and print the first field (pid).

Can I pipe lshw warnings to /dev/null when I run it as a standard user?

I'm trying to create an alias for getting memory on my machine, currently I have alias mem="lshw | grep size | awk -F: '{print $2}'", and when I run it as a non-super user, I get the following warning message:
WARNING: you should run this program as super-user.
WARNING: output may be incomplete or inaccurate, you should run this program as super-user.
size: 23GiB
I'm not worried about the results being potentially incomplete, in fact when I diff the output when running as root vs a standard user, it's exactly the same. Does anybody know how to get rid of these warnings? I tried piping stderr to /dev/null, but that didn't work. Does anyone else know how to get rid of these warnings?
Can I interest you in
alias mem='free -g | grep Mem | awk '\''{print $2 " GiB"}'\'
free -m will give MiB; you can change the " GiB" part to whatever you want (or remove it).
I don't have lshw installed on my machine, so I can't help you debug your version, unfortunately.
alias mem="lshw 2> /dev/null| grep size | awk -F: '{print $2}'"
Alternatively you can use free or read from /proc/meminfo
cat /proc/meminfo |grep MemTotal
I'm not sure how you piped to dev/null, but this works for me:
lshw 2> /dev/null | grep size | awk -F: '{print $2}'
Ignoring that there are other tools more suited to getting the memory, if there is something you need and lshw is your only option, you would be better suited to use -json or -xml output and use a tool to parse it like jq or xmllint. The version of lshw on my distro outputs invalid json that can't be parsed, but does have valid xml output.
This would accomplish your goal, although the path may very well be different for you:
lshw -xml 2> /dev/null | xmllint --xpath '/list/node/node/node[#id="memory"]/size/text()' -
Or add a one grep:
... | grep "size:"

Finding an exact match in QNX without using grep -w

I'm writing a script that needs to find an exact match in a file that is compatible with QNX and POSIX compliant Linux
more detail:
Im trying to find the user of a process so the original command I wrote was
user=$(ps -aux | awk '{print $1 " " $2}' | grep -w ${process} | awk '{}print $1')
which works perfectly in POSIX compliant Linux
however, QNX isn't totally POSIX compliant and grep -w isn't usable for my target...so I need to find an exact match without grep -w
I think you want to print field 1 if field 2 exactly matches something:
ps -aux | awk -v p=$process '$2==p{print $1}'
-w is not a valid POSIX option for grep, shouldn't be using that for an application that is supposed to be portable between POSIX systems. Could always just ps -p $1 -o user= ? What are you going to do with grep and awk in cases where the user may be the same as the process id?

List of Java processes

How can I list all Java processes in bash?
I need an command line. I know there is command ps but I don't know what parameters I need to use.
try:
ps aux | grep java
and see how you get on
Recent Java comes with Java Virtual Machine Process Status Tool "jps"
http://download.oracle.com/javase/1.5.0/docs/tooldocs/share/jps.html
For example,
[nsushkin#fulton support]$ jps -m
2120 Main --userdir /home/nsushkin/.netbeans/7.0 --branding nb
26546 charles.jar
17600 Jps -m
jps -lV
is most useful. Prints just pid and qualified main class name:
2472 com.intellij.idea.Main
11111 sun.tools.jps.Jps
9030 play.server.Server
2752 org.jetbrains.idea.maven.server.RemoteMavenServer
Starting from Java 7, the simplest way and less error prone is to simply use the command jcmd that is part of the JDK such that it will work the same way on all OS.
Example:
> jcmd
5485 sun.tools.jcmd.JCmd
2125 MyProgram
jcmd allows to send diagnostic command requests to a running Java
Virtual Machine (JVM).
More details about how to use jcmd.
See also the jcmd Utility
You can use single command pgrep as well (doesn't require you to use pipes and multiple commands):
pgrep -fl java
For better output format check this command:
ps -fC java
This will return all the running java processes in linux environment. Then you can kill the process using the process ID.
ps -e|grep java
ps aux | grep java
or
$ ps -fea|grep -i java
pgrep -l java
ps -ef | grep java
If I want simply list java processes, use:
ps -A | grep java
ps axuwww | grep java | grep -v grep
The above will
show you all processes with long lines (arg: www)
filter (grep) only lines what contain the word java, and
filter out the line "grep java" :)
(btw, this example is not the effective one, but simple to remember) ;)
you can pipe the above to another commands, for example:
ps axuwww | grep java | grep -v grep | sed '.....' | while read something
do
something_another $something
done
etc...
When I want to know if a certain Java class is getting executed, I use the following command line:
ps ww -f -C java | grep "fully.qualified.name.of.class"
From the OS side view, the process's command name is "java". The "ww" option widens the colum's maximum characters, so it's possible to grep the FQN of the related class.
jps & jcmd wasn't showing me any results when I tried it using using openjdk-1.8 on redhat linux. But even if it did it only shows processes under the current user which doesn't work in my case. Using the ps|grep is what I ended up doing but the class path for some java apps can be extremely long which makes results illegible so I used sed to remove it. This is a bit rough still but removes everything except: PID, User, java-class/jar, args.
ps -o pid,user,cmd -C java | sed -e 's/\([0-9]\+ *[^ ]*\) *[^ ]* *\([^$]*\)/\1 \2/' -e 's/-c[^ ]* [^ ]* \|-[^ ]* //g'
Results look something like:
PID USER CMD
11251 userb org.apache.zookeeper.server.quorum.QuorumPeerMain ../config/zookeeper.properties
19574 userb com.intellij.idea.Main
28807 root org.apache.nifi.bootstrap.RunNiFi run
28829 root org.apache.nifi.NiFi
An alternative on windows to list all processes is:
WMIC path win32_process where "Caption='java.exe'" get ProcessId,Commandline
But that is going to need some parsing to make it more legible.
There's a lot of ways of doing this. You can use java.lang.ProcessBuilder and "pgrep" to get the process id (PID) with something like: pgrep -fl java | awk {'print $1'}. Or, if you are running under Linux, you can query the /proc directory.
I know, this seems horrible, and non portable, and even poorly implemented, I agree. But because Java actually runs in a VM, for some absurd reason that I can't really figure out after more then 15 years working the JDK, is why it isn't possible to see things outside the JVM space, it's really ridiculous with you think about it. You can do everything else, even fork and join child processes (those were an horrible way of multitasking when the world didn't know about threads or pthreads, what a hell! what's going in on with Java?! :).
This will give an immense discussion I know, but anyways, there's a very good API that I already used in my projects and it's stable enough (it's OSS so you still need to stress test every version you use before really trusting the API): https://github.com/jezhumble/javasysmon
JavaDoc: http://jezhumble.github.io/javasysmon/, search for the class com.jezhumble.javasysmon.OsProcess, she will do the trick. Hope it helped, best of luck.
ps -eaf | grep [j]ava
It's better since it will only show you the active processes not including this command that also got java string the [] does the trick
I use this (good on Debian 8):
alias psj='ps --no-headers -ww -C java -o pid,user,start_time,command'
The following commands will return only Java ProcessIDs. These commands are very useful especially whenever you want to feed another process by these return values (java PIDs).
sudo netstat -nlpt | awk '/java/ {print $7}' | tr '/java' ' '
sudo netstat -nlpt | awk '/java/ {print $7}' | sed 's/\/java/ /g'
But if you remove the latest pipe, you will be noticed these are java process
sudo netstat -nlpt | awk '/java/ {print $7}'
sudo netstat -nlpt | awk '/java/ {print $7}'
To know the list of java running on the linux machine.
ps -e | grep java

Identify the files opened a particular process on linux

I need a script to identify the files opened a particular process on linux
To identify fd :
>cd /proc/<PID>/fd; ls |wc –l
I expect to see a list of numbers which is the list of files descriptors' number using in the process. Please show me how to see all the files using in that process.
Thanks.
The command you probably want to use is lsof. This is a better idea than digging in /proc, since the command is a more clear and a more stable way to get system information.
lsof -p pid
However, if you're interested in /proc stuff, you may notice that files /proc/<pid>/fd/x is a symlink to the file it's associated with. You can read the symlink value with readlink command. For example, this shows the terminal stdin is bound to:
$ readlink /proc/self/fd/0
/dev/pts/43
or, to get all files for some process,
ls /proc/<pid>/fd/* | xargs -L 1 readlink
While lsof is nice you can just do:
ls -l /proc/pidoftheproces/fd
lsof -p <pid number here> | wc -l
if you don't have lsof, you can do roughly the same using just /proc
eg
$ pid=1825
$ ls -1 /proc/$pid/fd/*
$ awk '!/\[/&&$6{_[$6]++}END{for(i in _)print i}' /proc/$pid/maps
You need lsof. To get the PID of the application which opened foo.txt:
lsof | grep foo.txt | awk -F\ '{print $2}'
or what Macmede said to do the opposite (list files opened by a process).
lsof | grep processName

Resources