up vote 2 down vote favorite
1
share [g+] share [fb]

Is it possible to grab the command line that was used to invoke a process on Mac OS X?

link|improve this question
feedback

5 Answers

up vote 6 down vote accepted

ps ax shows you the command line of all running processes; you can grep for the pid you want.

link|improve this answer
@mark4o Or simply ps awux | cat, as ps -w will not limit the number of columns to display when output is not stdout, such as when piped to another command. – jtimberman Aug 22 '09 at 21:06
Why does this happen every week? "Warning: bad ps syntax, perhaps a bogus '-'? See procps.sf.net/faq.html"; and "Note that "ps -aux" is distinct from "ps aux". The POSIX and UNIX standards require that "ps -aux" print all processes owned by a user named "x", as well as printing all processes that would be selected by the -a option. If the user named "x" does not exist, this ps may interpret the command as "ps aux" instead and print a warning. This behavior is intended to aid in transitioning old scripts and habits. It is fragile, subject to change, and thus should not be relied upon." – Hello71 Jul 27 '11 at 16:47
I don't know, Hello71. I corrected my two-year-old answer for you. – Bkkbrad Aug 18 '11 at 18:31
feedback
up vote 3 down vote

Does:

~$ ps ax | grep "ntp"
   57   ??  Ss     0:04.66 /usr/sbin/ntpd -c /private/etc/ntp.conf -n
 3104 s000  S+     0:00.00 grep ntp

do what you need it to (change ntp to the program you are interested in)? This usually gives me the command-line arguments of running processes (I use to check what Launchd used when running a system daemon for example).

link|improve this answer
feedback
up vote 2 down vote

cat /proc/$PROCESSNUMBER/cmdline | tr '\0' '\n'

Allthough it's Linux specific, it gets the commandline of process numbered $PROCESSNUMBER straight from the kernel (the /proc/$PROCESSNUMBER/cmdline part) and makes it readable by putting each argument on a separate line by translating (with tr -token replace) the \0's into newlines (\n).

This line only works if you put a real processnumber of a running process (you can find one by running the command ps -ef) in the $PROCESSNUMBER part!

link|improve this answer
The original poster asked for Mac OS X (which out of the box does not have procfs) – Andre Holzner Feb 29 at 22:45
feedback
up vote 1 down vote

In Linux, the first (0'th) argument is usually the name of the invoked file. Perhaps this would work on OS X too.

link|improve this answer
1  
argc[0] is usually a pathname for the invoked file. There are ways to arrange that this is not so. – dmckee Aug 22 '09 at 16:11
I stand corrected. – Adam Matan Aug 22 '09 at 17:13
No worries. It is rarely done because there isn't much to gain from it. – dmckee Aug 22 '09 at 17:28
BTW How can it be changed? – Adam Matan Aug 22 '09 at 19:05
2  
Read the man page for execl and kin. You pass the path to the executable separately from argv, so you need not make argv[0] agree with the path. But /bin/sh always did, and it seems that everyone followed suit. – dmckee Aug 22 '09 at 19:46
show 1 more comment
feedback
up vote 0 down vote

ps --pid $PID -o args=

That's what I use, anyway...

link|improve this answer
BSD ps doesn't accept --pid. – grawity Jul 26 '11 at 18:28
1  
Could you please explain how this command works and how it applies to the question? Just pasting the command doesn't tell us anything about how to use it. – nhinkle♦ Jul 26 '11 at 19:27
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.