Bug 77780 - "ps ax" does not list all processes
"ps ax" does not list all processes
Product: Red Hat Linux
Classification: Retired
Component: procps (Show other bugs)
i386 Linux
medium Severity medium
: ---
: ---
Assigned To: Alexander Larsson
Brian Brock
: 82757 (view as bug list)
Depends On:
  Show dependency treegraph
Reported: 2002-11-13 10:02 EST by Aaron Sherman
Modified: 2007-04-18 12:48 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2002-11-13 10:02:53 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Aaron Sherman 2002-11-13 10:02:45 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 Galeon/1.2.5 (X11; Linux i686; U;) Gecko/20020809

Description of problem:
Under Red Hat versions prior to 8.0, the output of "ps ax" and the list of
processes under /proc were roughly the same (given processes starting and
exiting during comparison) and some packages have been using this to evaluate ps
to determine if it has been compromised by a root kit. I have a tool that starts
with ps, then uses /proc then uses kill to look for hidden processes, and since
Red Hat 8.0 it's basically useless becuase it reports dozens of "hidden"
processes based on the output of ps.

I tried various other arguments (e.g. "ps agx", "ps ag", etc) and nothing seems
to work. Interestingly if I take one of the processes that are listed in /proc,
but not ps, and do a "ps ax --pid <pid>" it does not show up, but if I do a "ps
--pid <pid>" it does.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. ps ax
2. ls -d /proc/[0-9]*
3. compare the two

Actual Results:  Differences occur.

Expected Results:  No or very few differences.

Additional info:
Comment 1 Alexander Larsson 2002-11-14 03:57:35 EST
This is a feature, and is mentioned in the release notes. If you want to see
every thread of each process, use the -m flag.
Comment 2 Alexander Larsson 2003-01-27 11:12:00 EST
*** Bug 82757 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.