Menu
I'm trying to identify when a particular process is running, based on its arguments, on Mac OS X. There may be several processes running with the same name, but only one will have the arguments I'm looking for. The processes are not owned by the same user who will be running my code. They will not have modified their argv in any way.
The 'ps' command shows exactly the information that I need. But I would greatly prefer not to have to spawn 'ps' and parse its output.
I originally tried the solution from this question, using sysctl, but it turns out that only works for processes you own; see my other question for more info.
So how does ps obtain argv information for processes owned by other users?
435
In the Activity Monitor app on your Mac, in the View menu, choose one of the following: All Processes: Shows all the processes running on your Mac. All Processes, Hierarchically: Shows processes that belong to other processes, so you can see the parent/child relationship between them.
One very useful command to help find a process by name or PID is grep which can filter out the desired information. It can be used in conjunction with the ps -ax command to list only the process that you are interested in. For example: At the command prompt type ps -ax | grep <application name>.
The -e option instructs ps to display all processes. The -f stands full-format listing, which provides detailed information about the processes.
For system administrators, ps on macOS is a frequently-used tool. The command stands for “process status,” and that's largely what it does. It reports currently-running processes with a variety of filters and views.
On Mac OS X ps is setuid 0, which is how it gets the information for all the processes. You have to run as root to get that information, so either you need to be setuid 0 or run your utility with sudo.
The best way is probably just to spawn ps and parse the output, even if you don't really want to ;)
77
BSD ps (used in Mac OS X) uses kvm_getargv() to get the commandline arguments for a process.
Here is the actual call: ps source code. Search for kvm_getproc2.
See OpenBSD man page for this family of functions.
42
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
