skip to navigation
skip to content

findProcessesUsing 2.3.2

Application which scans running processes on the system for given mappings (shared libraries, executables) or open file descriptors

Scans all running applications on a host to identify those using a shared library, or an executable, some other mapping, or an open file descriptor.

This application works on UNIX-derived systems (Linux, BSD, cygwin, etc). You can use it, for example, to scan for processes using a certain version of a shared library, or running under a certain interpreter. It can print a summarized view, or optionally print all matching mappings as well.

This application can also scan for open files, either fully qualified or partially qualified.

This could be paired with https://pypi.python.org/pypi/remote_copy_and_execute to do audits of running software/library usage across many machines on a network.

You must be root to scan all running processes, otherwise this will only scan that which is running under your current user.

Usage

Usage: findProcessesUsing (options) [search portion]

Searches all running processes for those containing a given mapping, or an open file (with -f).

Mappings include running executables (like python), or a shared library, or a device.

Options:

Modes:

-m or –mappings Scan for mappings (default)

-c or –cwd Scan for cwd

-f or –files Scan for open files instead of mappings. This should not be a symbolic link.

Modifiers:

-v or –verbose Also print mapping lines containing the given pattern, or matched filenames when given -f.

-e or –exact Require exact match. Default is to allow partial matches

-p or –pids-only Only print pids, one per line

-i or –ignore-case Search case-insensitively. By default, case must be an exact match.

—version Print the version

-h or –help Display this message and quit

NOTE: Multiple modes can be specified

Examples:

findProcessesUsing libpython2.7 # Scan for any processes linking against anything containing “libpython2.7”

findProcessesUsing -f /var/lib/data.db # Scan for any processes with an open handle to “/var/lib/data.db”

findProcessesUsing -f -c /mnt/otherdrive # Scan for any process with a CWD or open file in “/mnt/otherdrive”

It is recommended to run this process as root, otherwise you are only able to scan your own processes.

Example Usage

Scan for mappings of libc

]$ sudo findProcessesUsing libc | head -n 20 | tail -n5

Found libc in 803 (john) [ -bash ]

Found libc in 1060 (john) [ /usr/lib/tracker/tracker-extract ]

Found libc in 1062 (www) [ /usr/bin/httpd ]

Found libc in 808 (frankl) [ /bin/sh /usr/bin/startx ]

Found libc in 1065 (frankl) [ /usr/lib/tracker/tracker-miner-user-guides ]

Scan for any cwd or open file in “/mnt/otherdrive”

]$ sudo findProcessesUsing -f -c /mnt/otherdrive

Found /mnt/otherdrive {cwd=/mnt/otherdrive} in 2927 (tim) [ -/bin/bash ]

Found /mnt/otherdrive {cwd=/mnt/otherdrive} in 3943 (root) [ bash ]

Found /mnt/otherdrive {fd=3} in 19636 (root) [ vim z ]

Found /mnt/otherdrive {cwd=/mnt/otherdrive} in 19636 (root) [ vim z ]

Scan for open file descriptor of pty

]$ ./findProcessesUsing -f -v pty

Found pty {fd=0,1,2,31} in 2384 (user1) [ /bin/bash ]

0 = “/dev/pty1”

1 = “/dev/pty1”

2 = “/dev/pty1”

31 = “/dev/pty1”

Found pty {fd=3} in 5732 (user1) [ SCREEN ]

3 = “/dev/pty0”

Found pty {fd=0,1,2} in 6184 (user1) [ screen ]

0 = “/dev/pty0”

1 = “/dev/pty0”

2 = “/dev/pty0”

Found pty {fd=0,1,2} in 5772 (user1) [ python ]

0 = “/dev/pty2”

1 = “/dev/pty2”

2 = “/dev/pty2”

Found pty {fd=0,1,2,31} in 6672 (user1) [ -bash ]

0 = “/dev/pty0”

1 = “/dev/pty0”

2 = “/dev/pty0”

31 = “/dev/pty0”

Found pty {fd=0,1,2,31} in 6072 (user1) [ /bin/bash ]

0 = “/dev/pty3”

1 = “/dev/pty3”

2 = “/dev/pty3”

31 = “/dev/pty3”

Found pty {fd=0,1,2,31} in 4796 (user1) [ /bin/bash ]

0 = “/dev/pty2”

1 = “/dev/pty2”

2 = “/dev/pty2”

31 = “/dev/pty2”

Library

findProcessesUsing is the frontend for the python library ProcessMappingScanner. If you want to use the findProcessesMapping functionality within your application, you may consider using that library directly in lieu of parsing findProcessesMapping’s output.

 
File Type Py Version Uploaded on Size
findProcessesUsing-2.3.2.tar.gz (md5) Source 2017-06-11 12KB