Long listings for the ps command
Ever jump onto a Unix system to help resolve a critical problem and find that the information you most want to see in your ps output has run off the right edge of your terminal window? Who hasn't? Fortunately, the various flavors of Unix have command options to allow you to view the text that is normally truncated.
On Linux systems, for example, there is an "l" (long) option that will turn output such as this:
# ps -ef | egrep "apache|CMD"
UID PID PPID C STIME TTY TIME CMD
root 13379 1 0 Jul31 ? 00:00:00 /var/local/ap
ache/bin/httpd -k s
daemon 21193 13379 0 Aug01 ? 00:00:00 /var/local/ap
ache/bin/httpd -k s
daemon 7674 13379 0 Aug04 ? 00:00:00 /var/local/ap
ache/bin/httpd -k s
daemon 7767 13379 0 Aug04 ? 00:00:00 /var/local/ap
ache/bin/httpd -k s
daemon 7768 13379 0 Aug04 ? 00:00:00 /var/local/ap
ache/bin/httpd -k s
daemon 7772 13379 0 Aug04 ? 00:00:00 /var/local/ap
ache/bin/httpd -k s
daemon 7773 13379 0 Aug04 ? 00:00:00 /var/local/ap
ache/bin/httpd -k s
daemon 12341 13379 0 Aug06 ? 00:00:00 /var/local/ap
ache/bin/httpd -k s
daemon 13810 13379 0 Aug06 ? 00:00:00 /var/local/ap
ache/bin/httpd -k s
daemon 13811 13379 0 Aug06 ? 00:00:00 /var/local/ap
ache/bin/httpd -k s
daemon 13812 13379 0 Aug06 ? 00:00:00 /var/local/ap
ache/bin/httpd -k s
into output that looks like this:
# ps -elf | egrep "apache|CMD"
F S UID PID PPID C PRI NI ADDR SZ WCHAN STIME
TTY TIME CMD
140 S root 13379 1 0 75 0 - 1234 schedu Jul31
? 00:00:00 /var/local/apache/bin/httpd -k start
140 S daemon 21193 13379 0 75 0 - 1289 schedu Aug01
? 00:00:00 /var/local/apache/bin/httpd -k start
140 S daemon 7674 13379 0 75 0 - 1289 schedu Aug04
? 00:00:00 /var/local/apache/bin/httpd -k start
140 S daemon 7767 13379 0 75 0 - 1289 schedu Aug04
? 00:00:00 /var/local/apache/bin/httpd -k start
140 S daemon 7768 13379 0 75 0 - 1289 schedu Aug04
? 00:00:00 /var/local/apache/bin/httpd -k start
140 S daemon 7772 13379 0 75 0 - 1289 schedu Aug04
? 00:00:00 /var/local/apache/bin/httpd -k start
140 S daemon 7773 13379 0 75 0 - 1289 schedu Aug04
? 00:00:00 /var/local/apache/bin/httpd -k start
140 S daemon 12341 13379 0 75 0 - 1289 schedu Aug06
? 00:00:00 /var/local/apache/bin/httpd -k start
140 S daemon 13810 13379 0 75 0 - 1286 schedu Aug06
? 00:00:00 /var/local/apache/bin/httpd -k start
140 S daemon 13811 13379 0 75 0 - 1286 schedu Aug06
? 00:00:00 /var/local/apache/bin/httpd -k start
140 S daemon 13812 13379 0 75 0 - 1286 schedu Aug06
? 00:00:00 /var/local/apache/bin/httpd -k start
You not only get the complete command line, but several extra fields are included. For example, WCHAN, which indicates the event on which the process is waiting, is shown in the 11th column in this output.
Solaris systems, on which I spend most of the e-time, also provide the "l" (long) option, though they generally wrap the ps output onto the following line rather than truncate ps output.
Mac OS X systems, which still use the "aux" version of the ps command, offer a "w" (wide) option which provides 132 columns in ps output instead of the default 80.
The order in which the arguments to ps arguments are presented is arbitrary, though I have always seen "ef" and "aux" as the standards, maybe because the letters in the argument list are in alphabetical order. I prefer "elf" to "efl" since its an easy-to-remember and friendly word and "uwax" to "auwx" for a similar reason, but you can adopt whatever argument order appeals to you.
Build your tech library with our book giveaways.
Hacking Exposed, Sixth Edition
By Stuart McClure, Joel Scambray, George Kurtz; Published by McGraw-Hill/Osborne
The original Hacking Exposed authors rejoin forces on this tenth anniversary edition to offer completely up-to-date coverage of today's most devastating hacks and how to prevent them. Using their proven methodology, the authors reveal how to locate and patch system vulnerabilities. The book includes new coverage of ISO images, wireless and RFID attacks, Web 2.0 vulnerabilities, anonymous hacking tools, Ubuntu, Windows Server 2008, mobile devices, and more. Enter now!









I've always wondered how to
I've always wondered how to view a long cmd line argument for a process using ps, and the article states that in Solaris, the output is wrapped using the "l" cmd. I use Solaris 9, and the output is not wrapped. To overcome this shortcoming, I use the BSD version:/usr/ucb/ps -auxww
Works great.