Bug 77780 - "ps ax" does not list all processes
Summary: "ps ax" does not list all processes
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Red Hat Linux
Classification: Retired
Component: procps
Version: 8.0
Hardware: i386
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Alexander Larsson
QA Contact: Brian Brock
URL:
Whiteboard:
: 82757 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2002-11-13 15:02 UTC by Aaron Sherman
Modified: 2007-04-18 16:48 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2002-11-13 15:02:53 UTC
Embargoed:


Attachments (Terms of Use)

Description Aaron Sherman 2002-11-13 15:02:45 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 Galeon/1.2.5 (X11; Linux i686; U;) Gecko/20020809

Description of problem:
Under Red Hat versions prior to 8.0, the output of "ps ax" and the list of
processes under /proc were roughly the same (given processes starting and
exiting during comparison) and some packages have been using this to evaluate ps
to determine if it has been compromised by a root kit. I have a tool that starts
with ps, then uses /proc then uses kill to look for hidden processes, and since
Red Hat 8.0 it's basically useless becuase it reports dozens of "hidden"
processes based on the output of ps.

I tried various other arguments (e.g. "ps agx", "ps ag", etc) and nothing seems
to work. Interestingly if I take one of the processes that are listed in /proc,
but not ps, and do a "ps ax --pid <pid>" it does not show up, but if I do a "ps
--pid <pid>" it does.


Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
1. ps ax
2. ls -d /proc/[0-9]*
3. compare the two
	

Actual Results:  Differences occur.


Expected Results:  No or very few differences.


Additional info:

Comment 1 Alexander Larsson 2002-11-14 08:57:35 UTC
This is a feature, and is mentioned in the release notes. If you want to see
every thread of each process, use the -m flag.


Comment 2 Alexander Larsson 2003-01-27 16:12:00 UTC
*** Bug 82757 has been marked as a duplicate of this bug. ***


Note You need to log in before you can comment on or make changes to this bug.