What jobs are running in Linux PID?

I have certain PID's that are consuming memory on my VPS server and I need to  find out the jobs or applications that are part of that PID.

I have used strace -p [PID] but there are too many lines of code and they repeat  themselves.

Is there a way to  find out what applications/jobs are running and consuming the resources.  If not, what other suggestions do you have?
sharingsunshineAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

GaryCommented:
In the terminal window enter

top

and press >

That will give you the in memory processes by highest usage down
0
sharingsunshineAuthor Commented:
I know about top.  I need to know the applications in the pid that top is showing consume the most resources.  I know the pid I need an application/job breakdown.
0
Jan SpringerCommented:
Have you tried lsof?  You can pull up all files associated with a PID.

http://www.thegeekstuff.com/2012/08/lsof-command-examples/
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

GaryCommented:
Detailed breakdown

ls -l /proc/{proc id}/fd

e.g.
ls -l /proc/123/fd

Open in new window

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
sharingsunshineAuthor Commented:
Thanks for that suggestion but there are so many files listed I don't know what applications or jobs they belong to.  That's why I need a list  of jobs/applications per pid.  Then I can determine if those jobs/applications should be running or not.
0
Gerwin Jansen, EE MVETopic Advisor Commented:
Try: pstree -p <PID>

Example:

[gerwin@localhost ~]$ pstree -p 1868
lxterminal(1868)─┬─bash(1870)───bash(14897)───bash(15240)───pstree(15559)
                 ├─bash(15329)───top(15550)
                 ├─gnome-pty-helpe(1869)
                 ├─{lxterminal}(1871)
                 └─{lxterminal}(1878)
[gerwin@localhost ~]$
0
sharingsunshineAuthor Commented:
ls -l /proc/{proc id}/fd

e.g.
ls -l /proc/123/fd

When I do the above I get the following:

 ls -l /proc/19678/fd
ls: cannot access /proc/19678/fd: No such file or directory
0
GaryCommented:
That means the process is finished
0
Jan SpringerCommented:
Well if all you want is the job name:

ps -Af | grep PID

where "PID" is the process id.
0
sharingsunshineAuthor Commented:
Gerwin,

I just get the hash symbol

# pstree -p 19678
#
0
GaryCommented:
Exactly which program/process is it you are trying to debug?
0
Gerwin Jansen, EE MVETopic Advisor Commented:
Then you have a non-existing PID, you should find your PID with top (sorted on memory use), then use that PID for the pstree command.
0
sharingsunshineAuthor Commented:
I was trying to debug 19678 to find out the applications that are using that process.
0
Jan SpringerCommented:
But is it still running:

ps -Af | grep 19678

ls -l /proc/19678

If both return nothing, then the process has terminated.
0
GaryCommented:
Well from what you posted above that process doesn't exist.
Every new process will use what every process id is available - programs don't use the same process ID every time
0
sharingsunshineAuthor Commented:
running this command

ps -Af | grep 19678
root     28455 24704  0 16:08 pts/2    00:00:00 grep 19678

does that mean it is running.  I tried to use the -r trigger to show only running processes but I must not have the syntax correct.
0
Jan SpringerCommented:
it means that it is not running.

when you do a ps with a grep, unless you also add a "don't show me my grep", you'll see your request in the output.
0
GaryCommented:
There is nothing using that PID, first line should be the application using the PID
0
sharingsunshineAuthor Commented:
OK, then Is there a way to  find out what applications/jobs are running and consuming the resources.  If not, what other suggestions do you have?  Since looking at the PID won't work.
0
GaryCommented:
You do the top command, find the program's pid and then use the ls command
0
Jan SpringerCommented:
When I want know what is consuming resources, I start with top.
0
Gerwin Jansen, EE MVETopic Advisor Commented:
@sharingsunshine - To speed things up a bit: show us the output of top after you've pressed >

Paste these 2 lines:
(I'm showing a firefox process using the most memory on my system)

 PID USER      PR  NI    VIRT    RES    SHR S %CPU %MEM     TIME+ COMMAND                                                                          
 1912 gerwin    20   0  921960 306064  37596 R 13.2 29.8  38:34.48 firefox
0
sharingsunshineAuthor Commented:
PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND            
26449 apache    20   0 2106m 190m 149m S 56.3  5.1   1:51.52 /usr/sbin/httpd
0
sharingsunshineAuthor Commented:
but if the processes go away how can you debug them?
0
GaryCommented:
So are you trying to trace a php file or something?

Using the following will list all files being used by that process

ls -l /proc/26449 /fd
0
sharingsunshineAuthor Commented:
could your syntax be wrong?  Because I did a grep on the pid and it exists

]# ps -Af | grep 2068
mysql     2068  1861  2 Nov07 ?        11:51:55 /usr/libexec/mysqld --basedir=/usr --datadir=/data/mysql --plugin-dir=/usr/lib64/mysql/plugin --user=mysql --log-error=/var/log/mysqld.log --pid-file=/var/run/mysqld/mysqld.pid --socket=/var/lib/mysql/mysql.sock
root     32091 24704  0 16:39 pts/2    00:00:00 grep 2068
# ls -l /proc/2068 /fd
ls: cannot access /fd: No such file or directory
/proc/2068:
0
Gerwin Jansen, EE MVETopic Advisor Commented:
Or: pstree -p 26449
0
sharingsunshineAuthor Commented:
i did them back to back not sure why the timestamp didn't get copied.
0
Gerwin Jansen, EE MVETopic Advisor Commented:
Your PID is 26449 not 2068 - where do you get that from?
0
Jan SpringerCommented:
also, there isn't a space in the string:

ls -l /proc/2068/fd
0
GaryCommented:
Are these you're own sites on the server?
0
sharingsunshineAuthor Commented:
26449 was gone and 2068 came up on top so I grabbed it as quick as I could.

yes they are my own sites
0
sharingsunshineAuthor Commented:
Thanks for all your help.
0
madunixCommented:
You can run the following command #ps -p


http://www.cyberciti.biz/tips/top-linux-monitoring-tools.html
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Linux

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.