9

Is it possible to grab the command line that was used to invoke a process on Mac OS X?

Improve this question
3
  • 2
    ps --pid $PID -o args= That's what I use, anyway...
    – yar
    Jul 26, 2011 at 17:52
  • 2
    The Mac equivalent of that command is: ps -p <pid> -o args=
    – Nate
    May 7, 2013 at 17:00
  • 1
    if "-o args=" truncates the output, you can try ps -p <pid> -o command=
    – Jose Alban
    Aug 18, 2017 at 8:44

3 Answers 3

Reset to default
15

ps ax shows you the command line of all running processes; you can grep for the pid you want.

Improve this answer
3
  • @mark4o Or simply ps awux | cat, as ps -w will not limit the number of columns to display when output is not stdout, such as when piped to another command.
    – jtimberman
    Aug 22, 2009 at 21:06
  • 1
    Why does this happen every week? "Warning: bad ps syntax, perhaps a bogus '-'? See procps.sf.net/faq.html" and "Note that "ps -aux" is distinct from "ps aux". The POSIX and UNIX standards require that "ps -aux" print all processes owned by a user named "x", as well as printing all processes that would be selected by the -a option. If the user named "x" does not exist, this ps may interpret the command as "ps aux" instead and print a warning. This behavior is intended to aid in transitioning old scripts and habits. It is fragile, subject to change, and thus should not be relied upon."
    – Hello71
    Jul 27, 2011 at 16:47
  • I don't know, Hello71. I corrected my two-year-old answer for you.
    – Bkkbrad
    Aug 18, 2011 at 18:31
4

Does:

~$ ps ax | grep "ntp"
   57   ??  Ss     0:04.66 /usr/sbin/ntpd -c /private/etc/ntp.conf -n
 3104 s000  S+     0:00.00 grep ntp

do what you need it to (change ntp to the program you are interested in)? This usually gives me the command-line arguments of running processes (I use to check what Launchd used when running a system daemon for example).

Improve this answer
3

cat /proc/$PROCESSNUMBER/cmdline | tr '\0' '\n'

Allthough it's Linux specific, it gets the commandline of process numbered $PROCESSNUMBER straight from the kernel (the /proc/$PROCESSNUMBER/cmdline part) and makes it readable by putting each argument on a separate line by translating (with tr -token replace) the \0's into newlines (\n).

This line only works if you put a real processnumber of a running process (you can find one by running the command ps -ef) in the $PROCESSNUMBER part!

Improve this answer
2
  • 4
    The original poster asked for Mac OS X (which out of the box does not have procfs)
    – Andre Holzner
    Feb 29, 2012 at 22:45
  • 3
    Or xargs -0 < /proc/PID/cmdline
    – Bash
    Sep 12, 2012 at 23:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .