How to get this list? Don't miss any [PID] (running, ended)

feiyuwang2012 · 2020-07-08 06:09:33

How to get this list (table)?
From turn on the computer until now. Don't miss any [PID] (still running [PID], already ended [PID]).

List field: PPID, PID, Threads, USER, Start-time, Change-time, End-time, full-Command

Among:
[Start-time]: Start time of the process
[Change-time]: Process change time. When [PPID] or [full-command] changes
[End-time]: The end time of the process.

Last edited by feiyuwang2012 (2020-07-08 09:56:10)

Trilby · 2020-07-08 12:33:57

You can't.

You can very easily get all this information for running processes, see `man ps`. But ended processes are gone - it's even possible their PIDs can be reused by new processes.

You could run a background processes that periodically checked so you'd catch some more processes that could be included in your list later, but it'd be a loosing battle trying to get every short lived process.

The real question is what do you want this information for? What do you intend to do with it?

loqs · 2020-07-08 18:54:17

The kernel audit framework might be able to monitor for every syscall use of clone clone3 or fork which I think covers all syscalls that can create a PID.

feiyuwang2012 · 2020-07-08 19:27:24

I tried this.
$ watch -n 1 'ps -auxf >> ps-auxf.txt'

As you said, not all. Still miss some short-lived process.

But I need this list, it can get all processes, include every short-lived process.
There must be some way. like 'audit' or something, but I don't know-how.

Trilby · 2020-07-08 19:40:06

What do you need this list for?

feiyuwang2012 · 2020-07-08 20:20:18

I want to know:
Are there some commands that use my [UID], but not me.
Or something strange.

Last edited by feiyuwang2012 (2020-07-08 20:22:32)

seth · 2020-07-08 21:01:07

Are there some commands that use my [UID], but not me.

What??

Anyway, as loqs pointed out: https://wiki.archlinux.org/index.php/Audit_framework

Trilby · 2020-07-08 21:15:22

And have you seen symptoms that some commands use your UID, but not you (whatever that could mean) or are "someting strange' (which is quite vague, but at least transparently so).

You do realize that most processes that do *not* run under your UID would me run as root, and those would pose a much larger risk. I can't imagine what worry you could have about some unknown process specifically running with your UID.

I'm asking these questions because I thought (and am growing more confident) that there is an X-Y question here.

Why do you want to know if some process runs with your UID. That itself is also not an end, but rather a means to an end. What end are you trying to acheive, what problem are you trying to solve, or what symptom are you trying to understand?

Last edited by Trilby (2020-07-08 21:16:15)

feiyuwang2012 · 2020-07-08 23:03:44

This computer only one USER is just me. and no use remote like ssh or other.

$ cat /etc/passwd
root:x:0:0::/root:/usr/bin/fish
bin:x:1:1::/:/sbin/nologin
daemon:x:2:2::/:/sbin/nologin
uuidd:x:68:68::/:/sbin/nologin
dbus:x:81:81:System Message Bus:/:/sbin/nologin
ntp:x:87:87:Network Time Protocol:/var/lib/ntp:/bin/false
polkitd:x:102:102:PolicyKit daemon:/:/sbin/nologin
rtkit:x:133:133:RealtimeKit:/proc:/sbin/nologin
netdata:x:134:134::/var/cache/netdata:/sbin/nologin
usbmux:x:140:140:usbmux user:/:/sbin/nologin
lightdm:x:620:620:Light Display Manager:/var/lib/lightdm:/sbin/nologin
colord:x:976:976:Color management daemon:/var/lib/colord:/sbin/nologin
avahi:x:977:977:Avahi mDNS/DNS-SD daemon:/:/sbin/nologin
systemd-coredump:x:978:978:systemd Core Dumper:/:/sbin/nologin
systemd-timesync:x:979:979:systemd Time Synchronization:/:/sbin/nologin
systemd-resolve:x:980:980:systemd Resolver:/:/sbin/nologin
systemd-network:x:981:981:systemd Network Management:/:/sbin/nologin
systemd-journal-remote:x:982:982:systemd Journal Remote:/:/sbin/nologin
toma:x:1001:985::/home/toma:/usr/bin/fish
nobody:x:65534:65534:Nobody:/:/sbin/nologin
privoxy:x:42:42:Privoxy:/:/sbin/nologin
mldonkey:x:971:971:Mldonkey daemon user:/var/lib/mldonkey:/usr/bin/nologin
couchdb:x:970:970:CouchDB daemon:/var/lib/couchdb:/usr/bin/nologin
dhcpcd:x:969:969:dhcpcd privilege separation:/var/lib/dhcpcd:/usr/bin/nologin
mail:x:8:12::/var/spool/mail:/usr/bin/nologin
ftp:x:14:11::/srv/ftp:/usr/bin/nologin
http:x:33:33::/srv/http:/usr/bin/nologin
cups:x:209:209:cups helper user:/:/usr/bin/nologin
amule:x:975:975:aMule Client:/var/lib/amule:/usr/bin/nologin
pcp:x:974:974:Performance Co-Pilot:/var/lib/pcp:/usr/bin/nologin
darkstat:x:973:973:darkstat user:/var/darkstat:/usr/bin/nologin
clamav:x:64:64:Clam AntiVirus:/:/usr/bin/nologin
incron:x:972:972:Incron system:/var/spool/incron:/usr/bin/nologin

I use Arch Linux from 2019-03 to now and everything is fine.
But there have been anomalies in the last months.

Sometimes LibreOffice is abnormal.
Like the configuration was changed. but not in the file (maybe in the RAM), because if reboot, then everything is fine.
I use LibreOffice for several years.

Sometimes Computer Crash.

$ sudo journalctl -p 4 -r)
...
- Reboot --
May 03 10:34:10 tompc systemd-coredump[44189]: Process 23477 (chromium) of user 1001 dumped core.
Stack trace of thread 23499:
#0 0x0000556ef2d95a01 n/a (chromium + 0x5d6da01)
#1 0x0000556ef19113c9 n/a (chromium + 0x48e93c9)
...

I tried to reinstall the related software, but soon, it will be abnormal.
Use command:

$ sudo pacman -Rsun xxx
$ sudo pacman -Sc
$ sudo pacman -S xxx

I use ClamAV and rkhunter scan computer. Nothing found.

So I want to know:
Are there some commands that use my [UID] or [root], but not me.
Or something strange.

Last edited by feiyuwang2012 (2020-07-09 02:37:42)

Trilby · 2020-07-08 23:29:05

Ok, I don't think getting a list of all processes would help address that question - and it will certainly not be practical. For a frame of reference, there have been *at least* 1.5 million processes run on my laptop since I rebooted about a week ago. In fact the number could be a whole lot more than that if PIDs have been recycled as that's just the highest PID number currently under /proc. It's worth noting, too, that I run a *very* minimal system so perhaps a big DE could have quite a few more processes.

Do you want to go through a list of millions of processes to hunt for something? And if so, what exactly will you be looking for? What are your criteria for finding a suspicious process?

And to top this off, giiven your symtpoms, some rougue/mallicious process is a very unlikely explanation, and even expecting your two problems to be related seems to be a leap. If you want help with either of those problems, you should start a thread for each with detailed symptoms.

twelveeighty · 2020-07-09 00:06:29

All of a sudden I'm envious of Trilby's 7-digit PIDs in the span of a week. Somehow it makes me feel I should be working harder since I only have 96k in two days...

feiyuwang2012 · 2020-07-09 00:14:00

$ sudo pacman -Qe |wc -l
244
$ sudo pacman -Q |wc -l
784
$ sudo pacman -Qd |wc -l
540
$ sudo pacman -Qdt |wc -l
0

I am just a normal user.
I use DE:xfce, but there are very few software installed. I always use less.
Like: chromium, pluma, libreoffice, vlc, qbittorrent,
fish, htop, iftop, nethogs...
Almost that.
So, in theory, my PID will not too much.

If I have this list, it should be easier to find the anomaly.

If you need to know, Additional packages and unowned-files are that these:

$ sudo pacreport --unowned-files
Unowned Files:
  /boot/grub/
  /boot20-6.tar.gz
  /etc/.pwd.lock
  /etc/.updated
  /etc/NetworkManager/system-connections/CMCC-mcRQ 1.nmconnection
  /etc/NetworkManager/system-connections/CMCC-mcRQ.nmconnection
  /etc/NetworkManager/system-connections/China-cHen.nmconnection
  /etc/NetworkManager/system-connections/China-cHen_5G.nmconnection
  /etc/NetworkManager/system-connections/China-fenG.nmconnection
  /etc/UPower/UPower.conf.bk
  /etc/ca-certificates/extracted/ca-bundle.trust.crt
  /etc/ca-certificates/extracted/cadir/
  /etc/ca-certificates/extracted/edk2-cacerts.bin
  /etc/ca-certificates/extracted/email-ca-bundle.pem
  /etc/ca-certificates/extracted/objsign-ca-bundle.pem
  /etc/ca-certificates/extracted/tls-ca-bundle.pem
  /etc/conf.d/lm_sensors
  /etc/conf.d/lm_sensors_bk1
  /etc/cups/lpoptions
  /etc/cups/ppd/Xprint58.ppd
  /etc/cups/printers.conf.O
  /etc/dconf/db/ibus
  /etc/default/grub_bk
  /etc/group-
  /etc/grub.d/.script_sources.txt
  /etc/grub.d/06_grub-customizer_menu_color_helper
  /etc/grub.d/backup/
  /etc/gshadow-
  /etc/hostname
  /etc/hosts19.05
  /etc/ld.so.cache
  /etc/locale.conf
  /etc/localtime
  /etc/machine-id
  /etc/mkinitcpio.conf.bk
  /etc/mkinitcpio.d/linux.preset
  /etc/netctl/wlp16s0-China-cHen
  /etc/netctl/wlp16s0-China-cHen_5G
  /etc/nf21/
  /etc/nftables.conf.0bk
  /etc/nftables.conf.1bk
  /etc/os-release
  /etc/pacman.d/gnupg/
  /etc/pacman.d/mirrorlist_bk
  /etc/pacman_bk.conf
  /etc/pacreport.conf
  /etc/passwd-
  /etc/passwd.OLD
  /etc/printcap
  /etc/privoxy/config.0
  /etc/pulse/daemon.conf.0bk
  /etc/resolv.conf.bak
  /etc/shadow-
  /etc/systemd/logind.conf.bk
  /etc/systemd/system/dbus-org.freedesktop.timesync1.service
  /etc/systemd/system/display-manager.service
  /etc/systemd/system/getty.target.wants/
  /etc/systemd/system/multi-user.target.wants/
  /etc/systemd/system/network-online.target.wants/
  /etc/systemd/system/sockets.target.wants/
  /etc/systemd/system/sysinit.target.wants/
  /etc/systemd/system/vnstatd.service
  /etc/systemd/user/sockets.target.wants/
  /etc/xml/
  /etc20-6.tar.gz
  /lost+found/
  /repo/
  /usr/lib/cups/filter/rastertozj
  /usr/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache
  /usr/lib/gio/modules/giomodule.cache
  /usr/lib/graphviz/config6
  /usr/lib/gtk-2.0/2.10.0/immodules.cache
  /usr/lib/gtk-3.0/3.0.0/immodules.cache
  /usr/lib/locale/locale-archive
  /usr/lib/munin/
  /usr/lib/pybullet.so.2.88
  /usr/lib/python3.7/
  /usr/lib/udev/hwdb.bin
  /usr/share/.mono/
  /usr/share/applications/mimeinfo.cache
  /usr/share/backgrounds/Desktop-Batman-Black-Superhero.jpg
  /usr/share/backgrounds/Desktop-Wallpaper-043.jpg
  /usr/share/backgrounds/Desktop-Wallpaper_dark_night-1440x900.jpg
  /usr/share/backgrounds/Desktop-batman-phone.jpeg
  /usr/share/backgrounds/Desktop-ironman.jpg
  /usr/share/backgrounds/Desktop-m.png
  /usr/share/backgrounds/Desktop-time_zone_map-1440x900.jpg
  /usr/share/backgrounds/tom/
  /usr/share/cups/model/zjiang/
  /usr/share/fonts/TTF/
  /usr/share/fonts/adobe-source-code-pro/fonts.dir
  /usr/share/fonts/adobe-source-code-pro/fonts.scale
  /usr/share/fonts/adobe-source-han-sans/fonts.dir
  /usr/share/fonts/adobe-source-han-sans/fonts.scale
  /usr/share/fonts/cantarell/fonts.dir
  /usr/share/fonts/cantarell/fonts.scale
  /usr/share/fonts/gsfonts/fonts.dir
  /usr/share/fonts/gsfonts/fonts.scale
  /usr/share/fonts/liberation/fonts.dir
  /usr/share/fonts/liberation/fonts.scale
  /usr/share/fonts/mathjax/
  /usr/share/fonts/mathjax2/
  /usr/share/fonts/misc/fonts.dir
  /usr/share/fonts/noto-cjk/fonts.dir
  /usr/share/fonts/noto-cjk/fonts.scale
  /usr/share/fonts/noto/
  /usr/share/gdb/python/gdb/__pycache__/
  /usr/share/gdb/python/gdb/command/__pycache__/
  /usr/share/gdb/python/gdb/function/__pycache__/
  /usr/share/gdb/python/gdb/printer/__pycache__/
  /usr/share/glib-2.0/schemas/gschemas.compiled
  /usr/share/hwdata/pci.ids.old
  /usr/share/icons/Adwaita/icon-theme.cache
  /usr/share/icons/HighContrast/icon-theme.cache
  /usr/share/icons/hicolor/icon-theme.cache
  /usr/share/info/dir
  /usr/share/perl5/vendor_perl/XML/SAX/
  /usr/share/webapps/
  /var/.updated
  /var/darkstat/
  /var/db/sudo/lectured/toma
  /var/lib/NetworkManager/NetworkManager-intern.conf
  /var/lib/NetworkManager/NetworkManager.state
  /var/lib/NetworkManager/internal-0e33db6d-f8c8-458d-8113-3a81a74eb955-wlp0s29f7u2.lease
  /var/lib/NetworkManager/internal-1160aa9b-cd60-4874-9eb4-497899a28d8a-wlp16s0.lease
  /var/lib/NetworkManager/internal-4561d7c4-2428-4c4d-8094-24a466e88344-wlp16s0.lease
  /var/lib/NetworkManager/internal-5ba8099e-a0e2-43d6-973c-87e548bc2c87-wlp0s29f0u2.lease
  /var/lib/NetworkManager/internal-5ba8099e-a0e2-43d6-973c-87e548bc2c87-wlp0s29f7u1.lease
  /var/lib/NetworkManager/internal-5ba8099e-a0e2-43d6-973c-87e548bc2c87-wlp0s29f7u2.lease
  /var/lib/NetworkManager/internal-5ba8099e-a0e2-43d6-973c-87e548bc2c87-wlp0s29f7u3.lease
  /var/lib/NetworkManager/internal-5ba8099e-a0e2-43d6-973c-87e548bc2c87-wlp16s0.lease
  /var/lib/NetworkManager/internal-6d44d1b8-bc9a-4eb1-a0b1-6fdc3560570e-wlp16s0.lease
  /var/lib/NetworkManager/secret_key
  /var/lib/NetworkManager/seen-bssids
  /var/lib/NetworkManager/timestamps
  /var/lib/NetworkManager/timestamps.YMXZ9Z
  /var/lib/amule/
  /var/lib/clamav/
  /var/lib/collectd/
  /var/lib/colord/
  /var/lib/couchdb/
  /var/lib/dbus/
  /var/lib/dhcpcd/
  /var/lib/iptraf-ng/
  /var/lib/lightdm-data/
  /var/lib/lightdm/
  /var/lib/logrotate.status
  /var/lib/machines/
  /var/lib/mldonkey/
  /var/lib/mlocate/mlocate.db
  /var/lib/netctl/
  /var/lib/netdata/
  /var/lib/os-prober/labels
  /var/lib/pacman/local20-6.tar.gz
  /var/lib/portables/
  /var/lib/private/
  /var/lib/rkhunter/db/rkhunter.dat
  /var/lib/rkhunter/db/rkhunter.dat.old
  /var/lib/rkhunter/db/rkhunter_prop_list.dat
  /var/lib/rkhunter/tmp/group
  /var/lib/rkhunter/tmp/group.old
  /var/lib/rkhunter/tmp/passwd
  /var/lib/rkhunter/tmp/passwd.old
  /var/lib/rkhunter/tmp/rkhunter.upd.MP7pgAp1m3
  /var/lib/rkhunter/tmp/rkhunter.vc.NMAu8voMPp
  /var/lib/systemd/backlight/
  /var/lib/systemd/catalog/
  /var/lib/systemd/coredump/
  /var/lib/systemd/home/
  /var/lib/systemd/linger/
  /var/lib/systemd/random-seed
  /var/lib/systemd/rfkill/
  /var/lib/systemd/timers/
  /var/lib/systemd/timesync/
  /var/lib/upower/history-charge-Primary-0-00367_2010_08_17.dat
  /var/lib/upower/history-rate-Primary-0-00367_2010_08_17.dat
  /var/lib/upower/history-time-empty-Primary-0-00367_2010_08_17.dat
  /var/lib/upower/history-time-empty-Primary-0-00367_2010_08_17.dat.D8IP8Z
  /var/lib/upower/history-time-full-Primary-0-00367_2010_08_17.dat
  /var/lib/vnstat/
  /var/spool/cups/c00026
  /var/spool/cups/c00027
  /var/spool/cups/tmp/.cache/
  /var/spool/incron/
Unneeded Packages Installed Explicitly:
  adobe-source-han-sans-cn-fonts     57.98 M - Adobe Source Han Sans Subset OTF - Simplified Chinese OpenType/CFF fonts
  alsa-utils                          2.07 M - Advanced Linux Sound Architecture - Utilities
  aria2                               5.74 M - Download utility that supports HTTP(S), FTP, BitTorrent, and Metalink
  at                                 96.00 K - AT and batch delayed command scheduling utility and daemon
  autoconf                            2.00 M - A GNU tool for automatically configuring source code (base-devel)
  automake                            1.55 M - A GNU tool for automatically creating Makefiles (base-devel)
  baobab                              1.30 M - A graphical directory tree analyzer (gnome)
  bison                               2.20 M - The GNU general-purpose parser generator (base-devel)
  bleachbit                           2.80 M - Deletes unneeded files to free disk space and maintain privacy
  bookworm                           25.55 M - A simple user centric eBook reader which displays multiple eBooks formats uniformly
  chromium                          202.46 M - A web browser built for speed, simplicity, and security
  clamav                              4.73 M - Anti-virus toolkit for Unix
  cmake                              44.06 M - A cross-platform open-source make system
  cmatrix                            94.56 K - A curses-based scrolling 'Matrix'-like screen
  convmv                             46.22 K - Tool for converting encodings on filesystems
  couchdb                            46.47 M - A document-oriented database that can be queried and indexed in a MapReduce fashion using JSON
  cups                               38.12 M - The CUPS Printing System - daemon package
  darkstat                          136.00 K - Network statistics gatherer (packet sniffer)
 *dhcpcd                            469.33 K - RFC2131 compliant DHCP client daemon
 *dialog                            452.82 K - A tool to display dialog boxes from shell scripts
  dkms                              174.96 K - Dynamic Kernel Modules System
  dmidecode                         190.82 K - Desktop Management Interface table related utilities
  dos2unix                            1.74 M - Text file format converter
  dstat                             380.00 K - A versatile resource statistics tool
 *efibootmgr                        442.94 K - Linux user-space application to modify the EFI Boot Manager
  elinks                              4.07 M - An advanced and well-established feature-rich text mode web browser.
  etherape                            5.78 M - Graphical network monitor for various OSI layers and protocols
  ethtool                           479.84 K - Utility for controlling network drivers and hardware
 *exfat-utils                       275.00 K - Utilities for exFAT file system
  fd                                  2.79 M - Simple, fast and user-friendly alternative to find
  fdupes                             84.68 K - a program for identifying or deleting duplicate files residing within specified directories
  firefox                           201.06 M - Standalone web browser from mozilla.org
 *fish                               13.75 M - Smart and user friendly shell intended mostly for interactive use
  flameshot                         962.56 K - Powerful yet simple to use screenshot software
  fzf                                 3.30 M - Command-line fuzzy finder
  gdb                                24.32 M - The GNU Debugger
  geany                              13.14 M - Fast and lightweight IDE
  gimp                              207.98 M - GNU Image Manipulation Program
  gkrellm                             2.58 M - System monitor package for GTK2
  glances                            12.53 M - CLI curses-based monitoring tool
  gnu-netcat                         66.15 K - GNU rewrite of netcat, the network piping application
  gparted                             7.04 M - A Partition Magic clone, frontend to GNU Parted
  gramps                             57.09 M - Genealogy program, which helps you track your family tree
 *graphviz                           74.69 M - Graph visualization software
  grub                               32.82 M - GNU GRand Unified Bootloader (2)
 *gvfs                                6.83 M - Virtual filesystem implementation for GIO (gnome)
  hardinfo                          847.00 K - A system information and benchmark tool.
  hexchat                             5.50 M - A popular and easy to use graphical IRC (chat) client
  htop                              199.27 K - Interactive process viewer
  hwinfo                              5.18 M - Hardware detection tool from openSUSE
  i2c-tools                         334.13 K - Heterogeneous set of I2C tools for Linux that used to be part of lm-sensors
  ibus-libpinyin                     61.55 M - Intelligent Pinyin engine based on libpinyin for IBus
  iftop                              64.00 K - Display bandwidth usage on an interface
  incron                            244.46 K - Like the regular cron but is driven by filesystem events instead of time periods
  intel-gpu-tools                    11.30 M - Tools for development and testing of the Intel DRM driver
  intel-ucode                         3.02 M - Microcode update files for Intel CPUs
  iotop                             156.55 K - View I/O usage of processes
  iptraf-ng                         194.31 K - Console-based network monitoring utility
  iputils                           284.06 K - Network monitoring tools, including ping
 *iw                                259.02 K - nl80211 based CLI configuration utility for wireless devices
  jnettop                            79.00 K - A top-like console network traffic visualizer
  libreoffice-fresh-zh-cn            21.32 M - Chinese (simplified) language pack for LibreOffice Fresh
 *lightdm-gtk-greeter               324.14 K - GTK+ greeter for LightDM
  links                               7.26 M - A text WWW browser, similar to Lynx
  linux-docs                        146.59 M - Documentation for the Linux kernel
 *linux-firmware                    541.56 M - Firmware files for Linux
 *linux-headers                     119.67 M - Headers and scripts for building modules for the Linux kernel
 *logrotate                         103.25 K - Rotates system logs automatically
  logwatch                            2.01 M - Logwatch is a customizable log analysis system.
  lostfiles                           6.14 K - Find orphaned files not owned by any Arch packages
  lshw                                7.92 M - A small tool to provide detailed information on the hardware configuration of the machine.
 *lsof                              204.64 K - Lists open files for running Unix processes
  ltrace                            333.03 K - Tracks runtime library calls in dynamically linked programs
  man-pages                           5.61 M - Linux man pages
  man-pages-zh_cn                     2.34 M - Simplified Chinese Linux man pages
  mate-system-monitor                10.86 M - A system monitor for MATE (mate-extra)
  meld                                3.67 M - Compare files, directories and working copies
  mesa-demos                         11.37 M - Mesa demos and tools incl. glxinfo + glxgears
 *mlocate                           351.74 K - Merging locate/updatedb implementation
  monit                             859.00 K - Utility for managing and monitoring, processes, files, directories and devices on a *NIX system
  namcap                              1.80 M - A Pacman package analyzer
  nano                                2.19 M - Pico editor clone with enhancements
  ncdu                               86.41 K - Disk usage analyzer with an ncurses interface
  neofetch                          318.90 K - A CLI system information tool written in BASH that supports displaying images.
  netctl                            150.38 K - Profile based systemd network management
  netdata                             8.71 M - Real-time performance monitoring, in the greatest possible detail, over the web
  nethogs                           161.71 K - A net top tool which displays traffic used per process instead of per IP or interface
  netwatch                          365.00 K - monitor network connections
  network-manager-applet              7.67 M - Applet for managing network connections
  nftables                          837.61 K - Netfilter tables userspace tools
  nmap                               24.65 M - Utility for network discovery and security auditing
  nmon                              180.00 K - AIX & Linux Performance Monitoring tool
  noto-fonts-cjk                    294.43 M - Google Noto CJK fonts
 *ntfs-3g                             1.73 M - NTFS filesystem driver and utilities
  ntp                                 4.46 M - Network Time Protocol reference implementation
 *os-prober                         121.00 K - Utility to detect other OSes on a set of drives
 *p7zip                               6.09 M - Command-line file archiver with high compression ratio
 *pacman-contrib                     95.07 K - Contributed scripts and tools for pacman systems
  pacmatic                           45.09 K - A pacman wrapper to avoid bricking your system and such other surprises.
  pacutils                          463.32 K - Helper tools for libalpm
 *pavucontrol                       966.06 K - PulseAudio Volume Control
  pcp                                20.93 M - System performance analysis toolkit
  pkgconf                           156.33 K - Package compiler and linker metadata toolkit (base-devel)
 *pkgfile                            53.63 K - a pacman .files metadata explorer
  pluma                              38.44 M - A powerful text editor for MATE (mate-extra)
  privoxy                             1.91 M - A web proxy with advanced filtering capabilities.
  psensor                             1.90 M - A graphical hardware temperature monitor for Linux
 *pulseaudio                          7.12 M - A featureful, general-purpose sound server
  putty                               4.97 M - A terminal integrated SSH/Telnet client
  qbittorrent                        18.34 M - An advanced BitTorrent client programmed in C++, based on Qt toolkit and libtorrent-rasterbar.
 *reiserfsprogs                     595.44 K - Reiserfs utilities
  ristretto                           0.99 M - Fast and lightweight picture-viewer for Xfce4 (xfce4-goodies)
  rkhunter                            1.09 M - Checks machines for the presence of rootkits and other unwanted tools.
  rmlint                            421.21 K - Tool to remove duplicates and other lint, being much faster than fdupes
 *s-nail                            991.00 K - Environment for sending and receiving mail
  screen                            855.42 K - Full-screen window manager that multiplexes a physical terminal
  screenfetch                       274.05 K - CLI Bash script to show system/theme info in screenshots
  shadowsocks                       512.76 K - A lightweight tunnel proxy
  smartmontools                       2.01 M - Control and monitor S.M.A.R.T. enabled ATA and SCSI Hard Drives
  smem                               38.04 K - Generate reports on memory usage.
  speedtest-cli                     184.49 K - Command line interface for testing internet bandwidth using speedtest.net
  stardict                            8.49 M - International dictionary software
 *strace                              1.60 M - A diagnostic, debugging and instructional userspace tracer
 *sudo                                4.16 M - Give certain users the ability to run some commands as root (base-devel)
  sysstat                             1.50 M - a collection of performance monitoring tools (iostat,isag,mpstat,pidstat,sadf,sar)
 *systemd-sysvcompat                  4.64 K - sysvinit compat for systemd
  tcpdump                             1.02 M - Powerful command-line packet analyzer
  tcpflow                           775.00 K - Captures data transmitted as part of TCP connections then stores the data conveniently
 *thunar-archive-plugin             149.58 K - Create and extract archives in Thunar (xfce4-goodies)
 *thunar-media-tags-plugin          264.07 K - Adds special features for media files to the Thunar File Manager (xfce4-goodies)
 *thunar-volman                     673.00 K - Automatic management of removeable devices in Thunar (xfce4)
 *tmux                              773.80 K - A terminal multiplexer
  traceroute                         78.11 K - Tracks the route taken by packets over an IP network
  tree                               92.44 K - A directory listing program displaying a depth indented list of files
 *unrar                             312.91 K - The RAR uncompression program
  usbutils                          289.40 K - USB Device Utilities
  v2ray                              48.70 M - A platform for building proxies to bypass network restrictions
  vi                                307.26 K - The original ex/vi text editor
  virtualbox                        162.30 M - Powerful x86 virtualization for enterprise as well as home use
  vlc                                82.82 M - Multi-platform MPEG, VCD/DVD, and DivX player
  vnstat                            361.29 K - A console-based network traffic monitor
  whois                             160.48 K - Intelligent WHOIS client
 *xarchiver                           1.42 M - GTK+ frontend to various command line archivers
  xf86-video-intel                    2.29 M - X.org Intel i810/i830/i915/945G/G965+ video drivers (xorg-drivers)
  xfburn                              3.42 M - A simple CD/DVD burning tool based on libburnia libraries (xfce4-goodies)
  xfce4-appfinder                   553.13 K - An application finder for Xfce (xfce4)
  xfce4-artwork                       9.82 M - Backdrops for the Xfce4 desktop (xfce4-goodies)
  xfce4-battery-plugin              459.05 K - A battery monitor plugin for the Xfce panel (xfce4-goodies)
  xfce4-clipman-plugin              903.06 K - A clipboard plugin for the Xfce4 panel (xfce4-goodies)
  xfce4-cpufreq-plugin              204.61 K - CPU frequency plugin for the Xfce4 panel (xfce4-goodies)
  xfce4-cpugraph-plugin             171.22 K - CPU graph plugin for the Xfce4 panel (xfce4-goodies)
  xfce4-datetime-plugin             122.89 K - A date and time display plugin for the Xfce panel (xfce4-goodies)
  xfce4-dict                        777.01 K - A dictionary plugin for the Xfce panel (xfce4-goodies)
  xfce4-diskperf-plugin             222.69 K - Plugin for the Xfce4 panel displaying instant disk/partition performance (xfce4-goodies)
  xfce4-eyes-plugin                  94.36 K - A rolling eyes (following mouse pointer) plugin for the Xfce panel (xfce4-goodies)
  xfce4-fsguard-plugin              239.04 K - File system usage monitor plugin for the Xfce4 panel (xfce4-goodies)
  xfce4-genmon-plugin               110.86 K - plugin that monitors customizable programs stdout for the Xfce4 panel (xfce4-goodies)
  xfce4-mailwatch-plugin            637.21 K - Multi-protocol, multi-mailbox mail watcher for the Xfce4 panel (xfce4-goodies)
  xfce4-mount-plugin                306.38 K - Mount/umount utility for the Xfce4 panel (xfce4-goodies)
  xfce4-mpc-plugin                  335.22 K - Control the Music Player Daemon from the Xfce4 panel (xfce4-goodies)
  xfce4-netload-plugin              198.73 K - A netload plugin for the Xfce panel (xfce4-goodies)
  xfce4-notes-plugin                684.10 K - A notes plugin for the Xfce4 panel (xfce4-goodies)
  xfce4-notifyd                     582.32 K - Notification daemon for the Xfce desktop (xfce4-goodies)
  xfce4-power-manager                 4.67 M - Power manager for Xfce desktop (xfce4)
  xfce4-pulseaudio-plugin           450.38 K - Pulseaudio plugin for Xfce4 panel (xfce4-goodies)
  xfce4-screenshooter               670.81 K - Plugin that makes screenshots for the Xfce panel (xfce4-goodies)
  xfce4-sensors-plugin              525.88 K - A lm_sensors plugin for the Xfce panel (xfce4-goodies)
  xfce4-session                       1.72 M - A session manager for Xfce (xfce4)
  xfce4-settings                      7.66 M - Settings manager of the Xfce desktop (xfce4)
  xfce4-smartbookmark-plugin         67.78 K - Plugin for the Xfce4 panel that lets you quicksearch from selected websites (xfce4-goodies)
  xfce4-systemload-plugin           146.40 K - A system load plugin for the Xfce4 panel (xfce4-goodies)
  xfce4-taskmanager                 460.75 K - Easy to use task manager (xfce4-goodies)
  xfce4-terminal                      3.62 M - A modern terminal emulator primarily for the Xfce desktop environment (xfce4)
  xfce4-time-out-plugin             212.18 K - Take a break from your computer with this plugin for Xfce4 (xfce4-goodies)
  xfce4-timer-plugin                191.99 K - Plugin to track time for the Xfce4 panel (xfce4-goodies)
  xfce4-verve-plugin                156.50 K - Command line plugin Xfce4 panel (xfce4-goodies)
  xfce4-weather-plugin                4.37 M - A weather plugin for the Xfce4 panel (xfce4-goodies)
  xfce4-whiskermenu-plugin          672.56 K - Menu for Xfce4 (xfce4-goodies)
  xfce4-xkb-plugin                    1.83 M - Plugin to switch keyboard layouts for the Xfce4 panel (xfce4-goodies)
  xfdesktop                           2.43 M - A desktop manager for Xfce (xfce4)
  xfwm4-themes                        3.43 M - A set of additional themes for the Xfce window manager (xfce4)
  xorg-server                         4.84 M - Xorg X server (xorg)
  youtube-dl                         12.62 M - A small command-line program to download videos from YouTube.com and a few more sites
 *zip                               558.12 K - Compressor/archiver for creating and modifying zipfiles
Unneeded Packages Installed As Dependencies:
Unneeded Packages In A Dependency Cycle:
Installed Packages Not In A Repository:
Package Cache Size:
  /var/cache/pacman/pkg/ 1.47 G (0.00 B not installed)

Last edited by feiyuwang2012 (2020-07-09 02:36:24)

loqs · 2020-07-09 00:35:41

Trilby wrote:

If you want help with either of those problems, you should start a thread for each with detailed symptoms.

Also use code tags as was requested here and please read http://www.catb.org/~esr/faqs/smart-questions.html, General_troubleshooting and Debug_-_Getting_Traces.

Last edited by loqs (2020-07-09 00:38:09)

feiyuwang2012 · 2020-07-09 01:14:21

feiyuwang2012 wrote:

How to get this list (table)?
From turn on the computer until now. Don't miss any [PID] (still running [PID], already ended [PID]).
List field: PPID, PID, Threads, USER, Start-time, Change-time, End-time, full-Command
Among:
[Start-time]: Start time of the process
[Change-time]: Process change time. When [PPID] or [full-command] changes
[End-time]: The end time of the process.

The question is clear.
I just want this list, that's all.

loqs · 2020-07-09 02:23:35

New and running processes have already been covered. If you want a suggestion for terminated processes fix your posts in this thread in regard to Pasting_pictures_and_code.
Edit:
For terminated processes try https://aur.archlinux.org/packages/acct/. Enable acct.service then check the output of lastcomm.

Last edited by loqs (2020-07-09 02:42:33)

feiyuwang2012 · 2020-07-09 07:26:20

Thank you for your patient guidance. I try it.

seth · 2020-07-09 07:29:16

This is going to be a bit blunt, but we need to get this out of your head.
Might sound mean, but means you well.

---

Like the configuration was changed. but not in the file (maybe in the RAM), because if reboot, then everything is fine.

Certainly virus. Many viruses change the colors or button order of your GUI - just to annoy you…
=> What's the *actual* (unexpected) behavior?

May 03 10:34:10 tompc systemd-coredump[44189]: Process 23477 (chromium) of user 1001 dumped core.

So a process crashed. Must be malware. The only reason why a process could crash. Best drown the computer in bleach and hydroxychloroquine - I heard it will kill viruses…
…
Or … how about: you look at the actual stacktrace and check whether maybe this is a known bug? Or at least where it happens. And if it happens often: whether there's a pattern?
Because at the heart of every pattern is … errr … a bug.

toma:x:1001:985::/home/toma:/usr/bin/fish

Sanity check:

stat /bin/sh

·

bleachbit                           2.80 M - Deletes unneeded files to free disk space and maintain privacy

seth wrote:

Best drown the computer in bleach and hydroxychloroquine - I heard it will kill viruses…

There's the source of probably most of your troubles.
BleachShit™ has the capacity and intention and on a regular base *does* delete files that other programs blindly rely on (what's still stupid, but only average stupid - not BleachShit™ grade stupid) and, what's far worse, in "secure erasure" mode semi-blindly but effectively writes into mmap'd files, iow: directly into the memory of another process. Because hey, why not …

·

The question is clear.

What's less clear, in light of your further explanations, is whether you know what you're asking for.
"Your" processes are not the couple of windows you might explicitly open over a day. Eg. chromium creates a process every new tab. And rendering processes. And script execution processes…
Then there're cyclic shell/python/perl scripts and subscripts to feed infotainment widgets (weather etc.) of your desktop or perform other background tasks.
Trilby aleady somewhat suggested it: that's going to be searching a needle in a haystack.

Next:
Less then idiotic malware will generate a binary, load it into RAM and then delete the binary or attempt other ways of obfuscation.
An actual virus, by definition, infects other processes. It's not a process by itself to begin with.
And they all try hard to not be witnessed.

… … …

So let's take a deep breath and a step back: you encounter unexpected (buggy) hehavior.
If it still exists after removed that BleachShit™ nonsense (which indeed counts as malware in my book), you want to trace the symptom to the cause - what starts with defining the symptom.
In case of a segfault that's easy if you've a backtrace.
In case of behavioral oddity, you want to describe it as detailed as possible (not "is abnormal" but "the order of the save and open button changed" or whatever) and try to spot a pattern or commonality - chances are, it's an already reported bug.

If you cannot an explanation using google, you can always present the problem here. That's kinda what the forum is there for.

·

Finally - if you didn't take anything else out of the above:

sudo pacman -Rs bleachbit

feiyuwang2012 · 2020-07-11 12:57:45

loqs wrote:

New and running processes have already been covered. If you want a suggestion for terminated processes fix your posts in this thread in regard to Pasting_pictures_and_code.
Edit:
For terminated processes try https://aur.archlinux.org/packages/acct/. Enable acct.service then check the output of lastcomm.

I tried 'acct'.
Their problems are:
1. 'lastcomm' output short command (no options), the maximum length is only 15. Since there are no options, you don't know what it does exactly.
2. 'lastcomm --pid': can output (pid, ppid). But not all, using pid sorting, you will find that many pids are missing. Some processes are not recorded.
(If anybody has been using 'acct', you can help me confirm the two questions above.)

I don't know if the acct program still has problems, Or "My Local Environment" may have been maliciously tampered with, So the correct data cannot be obtained.

feiyuwang2012 · 2020-07-11 13:18:00

seth wrote:

This is going to be a bit blunt, but we need to get this out of your head.
Might sound mean, but means you well.
---
Like the configuration was changed. but not in the file (maybe in the RAM), because if reboot, then everything is fine.
Certainly virus. Many viruses change the colors or button order of your GUI - just to annoy you…
=> What's the *actual* (unexpected) behavior?
May 03 10:34:10 tompc systemd-coredump[44189]: Process 23477 (chromium) of user 1001 dumped core.
So a process crashed. Must be malware. The only reason why a process could crash. Best drown the computer in bleach and hydroxychloroquine - I heard it will kill viruses…
…
Or … how about: you look at the actual stacktrace and check whether maybe this is a known bug? Or at least where it happens. And if it happens often: whether there's a pattern?
Because at the heart of every pattern is … errr … a bug.
toma:x:1001:985::/home/toma:/usr/bin/fish
Sanity check:
stat /bin/sh
·
bleachbit                           2.80 M - Deletes unneeded files to free disk space and maintain privacy
seth wrote:
Best drown the computer in bleach and hydroxychloroquine - I heard it will kill viruses…
There's the source of probably most of your troubles.
BleachShit™ has the capacity and intention and on a regular base *does* delete files that other programs blindly rely on (what's still stupid, but only average stupid - not BleachShit™ grade stupid) and, what's far worse, in "secure erasure" mode semi-blindly but effectively writes into mmap'd files, iow: directly into the memory of another process. Because hey, why not …
·
The question is clear.
What's less clear, in light of your further explanations, is whether you know what you're asking for.
"Your" processes are not the couple of windows you might explicitly open over a day. Eg. chromium creates a process every new tab. And rendering processes. And script execution processes…
Then there're cyclic shell/python/perl scripts and subscripts to feed infotainment widgets (weather etc.) of your desktop or perform other background tasks.
Trilby aleady somewhat suggested it: that's going to be searching a needle in a haystack.
Next:
Less then idiotic malware will generate a binary, load it into RAM and then delete the binary or attempt other ways of obfuscation.
An actual virus, by definition, infects other processes. It's not a process by itself to begin with.
And they all try hard to not be witnessed.
… … …
So let's take a deep breath and a step back: you encounter unexpected (buggy) hehavior.
If it still exists after removed that BleachShit™ nonsense (which indeed counts as malware in my book), you want to trace the symptom to the cause - what starts with defining the symptom.
In case of a segfault that's easy if you've a backtrace.
In case of behavioral oddity, you want to describe it as detailed as possible (not "is abnormal" but "the order of the save and open button changed" or whatever) and try to spot a pattern or commonality - chances are, it's an already reported bug.
If you cannot an explanation using google, you can always present the problem here. That's kinda what the forum is there for.
·
Finally - if you didn't take anything else out of the above:
sudo pacman -Rs bleachbit

Thanks for your concerns, I have uninstalled'bleachbit'.
In fact, after these anomalies, I just installed (bleachbit, ClamAV, and rkhunter).
So, let's go back to the topic, is there any way to get this list?

From turn on the computer until now. Don't miss any PID (still running PID, already ended PID).
List field:
PPID, PID, Threads, USER, Start-time, Change-time, End-time, full-Command

Among:
Start-time: Start time of the process
Change-time: Process change time. When PPID or full-command changes
End-time: The end time of the process.

seth · 2020-07-11 14:41:12

Yes, using the audit framework - as loqs pointed out in comment #3 (you'll have to do some formatting)
It's still not a sane way to debug behavior - if that's indeed what you what want…

Anything polling-based is not an option (because of "don't miss any PID")

loqs · 2020-07-11 16:51:46

seth do you think acct which is enabled by accton should be storing all ended processes, so perhaps there is an issue with lastcomm?

feiyuwang2012 you could use https://www.kernel.org/doc/Documentatio … kstats.txt but you would need to write the application.

seth · 2020-07-11 21:03:01

lastcomm loops "while ((rec = pacct_get_entry ()) != NULL)" so there doesn't seem to be any numeral limitation to the output (maybe a pager is used? didn't try)
However, I believe he's rather referring to the representation of the command name and the acct structure limits that to 15 chars+\0: https://man7.org/linux/man-pages/man5/acct.5.html

I also assume "you will find that many pids are missing" is a misconception that the list of terminated processes would somehow be numerically complete (1,2,3,4,5 rather than eg. 1,3,5,1,3) what is not true (PIDs might still be running or have segfaulted and I'm not sure whether kernel jobs are recorded here at all)

But, to re-iterate: if this is really about analyzing misbehavior, this is a DOA approach. You end up looking for a needle in a haystack w/ knowing what a needle looks like or there actually is one.
If this is is about surveillance, hiding that fact would suggest malintent.

Arch Linux

#1 2020-07-08 06:09:33