Is it possible to grab the command line that was used to invoke a process on Mac OS X?

  • 1
    ps --pid $PID -o args= That's what I use, anyway... – yardena Jul 26 '11 at 17:52
  • 2
    The Mac equivalent of that command is: ps -p <pid> -o args= – Nate May 7 '13 at 17:00
  • 1
    if "-o args=" truncates the output, you can try ps -p <pid> -o command= – Jose Alban Aug 18 '17 at 8:44

ps ax shows you the command line of all running processes; you can grep for the pid you want.

  • @mark4o Or simply ps awux | cat, as ps -w will not limit the number of columns to display when output is not stdout, such as when piped to another command. – jtimberman Aug 22 '09 at 21:06
  • 1
    Why does this happen every week? "Warning: bad ps syntax, perhaps a bogus '-'? See procps.sf.net/faq.html" and "Note that "ps -aux" is distinct from "ps aux". The POSIX and UNIX standards require that "ps -aux" print all processes owned by a user named "x", as well as printing all processes that would be selected by the -a option. If the user named "x" does not exist, this ps may interpret the command as "ps aux" instead and print a warning. This behavior is intended to aid in transitioning old scripts and habits. It is fragile, subject to change, and thus should not be relied upon." – Hello71 Jul 27 '11 at 16:47
  • I don't know, Hello71. I corrected my two-year-old answer for you. – Bkkbrad Aug 18 '11 at 18:31


~$ ps ax | grep "ntp"
   57   ??  Ss     0:04.66 /usr/sbin/ntpd -c /private/etc/ntp.conf -n
 3104 s000  S+     0:00.00 grep ntp

do what you need it to (change ntp to the program you are interested in)? This usually gives me the command-line arguments of running processes (I use to check what Launchd used when running a system daemon for example).


cat /proc/$PROCESSNUMBER/cmdline | tr '\0' '\n'

Allthough it's Linux specific, it gets the commandline of process numbered $PROCESSNUMBER straight from the kernel (the /proc/$PROCESSNUMBER/cmdline part) and makes it readable by putting each argument on a separate line by translating (with tr -token replace) the \0's into newlines (\n).

This line only works if you put a real processnumber of a running process (you can find one by running the command ps -ef) in the $PROCESSNUMBER part!

  • 3
    The original poster asked for Mac OS X (which out of the box does not have procfs) – Andre Holzner Feb 29 '12 at 22:45
  • 2
    Or xargs -0 < /proc/PID/cmdline – Bash Sep 12 '12 at 23:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.