On Linux, if you know the name of the process (the executable path), then you can loop through /proc/
dir for each PID and check the exe
file in each of those PID directories. This file will be the same as the executable path of the process you're looking for.
See pseudo code:
proc_exe="" # The full path of the executable you're interested in checking.
for d in /proc/<pid> do;
if [ ${d}/exe -eq ${proc_exe} ]; then
# Found the PID of the process you're interested in.
fi
done
This technique is better than systemd and friends and works on other Linux distros too.
On NetBSD, there's a file cmdline
which gives you the whole argv
as it went to the process. Slightly different semantics but almost same outcome.
For Linux, see proc and for NetBSD, see mount_procfs.
man time
. Just don't call this thing a "process starts", that's really an "application start, some initialization and backgrounding / exit", a much more complex thing. – Nikita Kipriyanov Jan 14 at 19:12auditd
. See here: serverfault.com/questions/736753/… – Nikita Kipriyanov Jan 14 at 19:27