finding systemd unit 'owning' a running daemon process

A) Is there a way to determine the systemd unit that caused the creation of a specific process (in my example output, process 2738, the PA daemon)?

Sure. You can run systemctl status <pid> and systemd will find you the unit that contains that PID. For example, on my system I find a dnsmasq process:

# ps -fe | grep dnsmasq
nobody   18834  1193  0 Aug25 ?        00:00:10 /usr/sbin/dnsmasq ...

Who started it?

# systemctl status 18834
● NetworkManager.service - Network Manager
   Loaded: loaded (/usr/lib/systemd/system/NetworkManager.service; enabled; vendor preset: enabled)
   Active: active (running) since Tue 2015-08-25 11:07:40 EDT; 1 day 21h ago
 Main PID: 1193 (NetworkManager)
   Memory: 1.1M
   CGroup: /system.slice/NetworkManager.service
           ├─ 1193 /usr/sbin/NetworkManager --no-daemon
           ├─ 1337 /sbin/dhclient -d -q -sf /usr/libexec/nm-dhcp-helper -pf /var/run/dhclient-wlp3s0....
           ├─18682 /usr/libexec/nm-openvpn-service
           ├─18792 /usr/sbin/openvpn --remote ovpn-phx2.redhat.com 443 tcp --nobind --dev redhat --de...
           └─18834 /usr/sbin/dnsmasq --no-resolv --keep-in-foreground --no-hosts --bind-interfaces --...

I also have a pulseaudio process:

# ps -fe | grep pulseaudio
lars      2948     1  0 Aug25 ?        00:06:20 /usr/bin/pulseaudio --start

Running systemctl status 2948, I see:

● session-3.scope - Session 3 of user lars
   Loaded: loaded (/run/systemd/system/session-3.scope; static; vendor preset: disabled)
  Drop-In: /run/systemd/system/session-3.scope.d
           └─50-After-systemd-logind\x2eservice.conf, 50-After-systemd-user-sessions\x2eservice.conf, 50-Description.conf, 50-SendSIGHUP.conf, 50-Slice.conf
   Active: active (running) since Tue 2015-08-25 11:09:23 EDT; 1 day 21h ago
   CGroup: /user.slice/user-1000.slice/session-3.scope

This tells me the pulseaudio was started from my desktop login session, rather than explicitly via systemd.


By the way you can ask ps to show corresponding systemd unit.

[lnykryn@notas]$ ps -o'pid,ppid,args,unit' `pgrep pulse`
  PID  PPID COMMAND                     UNIT
 1345     1 /usr/bin/pulseaudio --start session-1.scope

Note, a process having a parent PPID of 1 does not mean it was created by systemd. Any process that loses its parent process is automatically re-assigned the parent 1.

You can see the hierarchy of systemd processes with

systemctl status

which shows for me amongst other stuff (edited):

CGroup: 
|-1 /usr/lib/systemd/systemd --system --deserialize 17
|-system.slice
`-user.slice
  `-user-1000.slice
    |-session-66.scope
    | |-4108 /bin/dbus-launch --autolaunch ...
    | |-4109 /bin/dbus-daemon --fork ...
    | `-5985 /usr/bin/pulseaudio --start --log-target=syslog