finding systemd unit 'owning' a running daemon process
A) Is there a way to determine the systemd unit that caused the creation of a specific process (in my example output, process 2738, the PA daemon)?
Sure. You can run systemctl status <pid>
and systemd will find you the unit that contains that PID. For example, on my system I find a dnsmasq
process:
# ps -fe | grep dnsmasq
nobody 18834 1193 0 Aug25 ? 00:00:10 /usr/sbin/dnsmasq ...
Who started it?
# systemctl status 18834
● NetworkManager.service - Network Manager
Loaded: loaded (/usr/lib/systemd/system/NetworkManager.service; enabled; vendor preset: enabled)
Active: active (running) since Tue 2015-08-25 11:07:40 EDT; 1 day 21h ago
Main PID: 1193 (NetworkManager)
Memory: 1.1M
CGroup: /system.slice/NetworkManager.service
├─ 1193 /usr/sbin/NetworkManager --no-daemon
├─ 1337 /sbin/dhclient -d -q -sf /usr/libexec/nm-dhcp-helper -pf /var/run/dhclient-wlp3s0....
├─18682 /usr/libexec/nm-openvpn-service
├─18792 /usr/sbin/openvpn --remote ovpn-phx2.redhat.com 443 tcp --nobind --dev redhat --de...
└─18834 /usr/sbin/dnsmasq --no-resolv --keep-in-foreground --no-hosts --bind-interfaces --...
I also have a pulseaudio
process:
# ps -fe | grep pulseaudio
lars 2948 1 0 Aug25 ? 00:06:20 /usr/bin/pulseaudio --start
Running systemctl status 2948
, I see:
● session-3.scope - Session 3 of user lars
Loaded: loaded (/run/systemd/system/session-3.scope; static; vendor preset: disabled)
Drop-In: /run/systemd/system/session-3.scope.d
└─50-After-systemd-logind\x2eservice.conf, 50-After-systemd-user-sessions\x2eservice.conf, 50-Description.conf, 50-SendSIGHUP.conf, 50-Slice.conf
Active: active (running) since Tue 2015-08-25 11:09:23 EDT; 1 day 21h ago
CGroup: /user.slice/user-1000.slice/session-3.scope
This tells me the pulseaudio
was started from my desktop login session, rather than explicitly via systemd.
By the way you can ask ps to show corresponding systemd unit.
[lnykryn@notas]$ ps -o'pid,ppid,args,unit' `pgrep pulse`
PID PPID COMMAND UNIT
1345 1 /usr/bin/pulseaudio --start session-1.scope
Note, a process having a parent PPID of 1 does not mean it was created by systemd. Any process that loses its parent process is automatically re-assigned the parent 1.
You can see the hierarchy of systemd processes with
systemctl status
which shows for me amongst other stuff (edited):
CGroup:
|-1 /usr/lib/systemd/systemd --system --deserialize 17
|-system.slice
`-user.slice
`-user-1000.slice
|-session-66.scope
| |-4108 /bin/dbus-launch --autolaunch ...
| |-4109 /bin/dbus-daemon --fork ...
| `-5985 /usr/bin/pulseaudio --start --log-target=syslog