lucianolnx wrote:
Today, what are the bests ways to know if a deamon is running without knowing its PID ?
I'm not sure whether this is `the best way' but you can parse some proc file system entry. Especially /proc/$pid/cmdline and /proc/$pid/status will be useful. And you will have to search all the /proc/$pid entries since you don't know the pid..
For example, they provide following information for clamd.
[EMAIL PROTECTED] ps aux|grep clamd
clamav 424 0.0 3.1 11520 7856 ? Ss 01:35 0:03 /usr/sbin/clamd
clamav 1184 0.0 3.1 11520 7856 ? S 09:38 0:00 /usr/sbin/clamd
baris 1238 0.0 0.2 1688 712 pts/2 S+ 09:58 0:00 grep clamd
[EMAIL PROTECTED] cat /proc/1184/cmdline
/usr/sbin/clamd
[EMAIL PROTECTED] cat /proc/1184/status
Name: clamd
State: S (sleeping)
Tgid: 1184
Pid: 1184
PPid: 424
....
....
I also should add that /proc filesystem is _optional_ in configuration. Highly likely it will exist on a target system but a little possibility of being it unselected still there.
My old technique (used until now), is based on recovering the PID saved by the own process in a special and known location (like a file), almost all times persisted (PERSISTENCE IS A PROBLEM).
Luciano
-- "You have to understand, most of these people are not ready to be unplugged. And many of them are no inert, so hopelessly dependent on the system, that they will fight to protect it." Morpheus
begin:vcard fn:M.Baris Demiray n:Demiray;M.Baris org:Labris Teknoloji adr:ODTU;;Teknokent Silikon Blok No:24;Ankara;;06531;Turkiye email;internet:[EMAIL PROTECTED] title:Yazilim Gelistirme Uzmani tel;work:+903122101490 tel;fax:+903122101492 x-mozilla-html:FALSE url:http://www.labristeknoloji.com version:2.1 end:vcard
