How get better way path from name of process?

[1000]

How get better way path from name of process than "which" command?
Do you know better tool than this script?

Code: Select all

#!/bin/bash


# License: GNU GPL v3  https://www.gnu.org/licenses/gpl-3.0.en.html
# Destiny: To get name, path and package name of running process. 


#  https://askubuntu.com/questions/33640/kworker-what-is-it-and-why-is-it-hogging-so-much-cpu
#  https://unix.stackexchange.com/questions/213334/why-add-parentheses-around-a-process-name

LIST_PROCESS=$(ps -eo user,pid,cmd  | grep -v '\[.*\]\|grep --color=auto' | awk 'NR!=1' | awk '{ print $1 , $2 ,  $3 }')
PROCESS_WITH_PATH=$(echo "$LIST_PROCESS" | grep "/")
PROCESS_WITHOUT_PATH=$(echo "$LIST_PROCESS" | grep -v "/")


FUNC_1() {
while read; do
    PATH_OF_REPLY=$(echo "$REPLY"  | awk '{ print $3 }')
    PACKAGE_OF_PATH=$(/usr/bin/dpkg -S "$PATH_OF_REPLY" | awk '{ print $1 }' |  sed 's/://')
    echo "$REPLY = $PACKAGE_OF_PATH"
done <<< "$PROCESS_WITH_PATH"
}


#while read; do
        #echo "$REPLY"
#    NAME_1=$(echo "$REPLY" | awk '{ print $3 }')
#        echo "$NAME_1"
    #FIND_PATH=$(find /proc/$(pgrep -x -U $(id -ur) ${NAME_1})/exe -printf "%l\n")
    #echo "$REPLY = $FIND_PATH"

    #PROCESS_NUMBER_1=$(echo "$REPLY" 2>&1 | awk '{ print $2 }')
    #FIND_PATH=$(readlink -f /proc/${PROCESS_NUMBER_1}/exe)
    #echo "$FIND_PATH"
    #echo "$REPLY "
#done <<< "$PROCESS_WITHOUT_PATH"

FUNC_2() {
NAME_1=$(echo "$PROCESS_WITHOUT_PATH" | awk '{ print $3 }' | sort | uniq | grep -v "\(sd-pam\)")
while read; do
#FIND_PATH=$(find /proc/$(pgrep -x -U $(id -ur) ${REPLY})/exe -printf "%l\n")
FIND_PATH=$(which "$REPLY")
FIND_PACKAGE=$(/usr/bin/dpkg -S "$FIND_PATH" | awk '{ print $1 }' |  sed 's/://')
echo "$REPLY = $FIND_PACKAGE"
done <<< "$NAME_1"
}


FUNC_1
FUNC_2

Edited

Maybe it's better?

Code: Select all

#!/bin/bash


# License: GNU GPL v3  https://www.gnu.org/licenses/gpl-3.0.en.html
# Destiny: To get name, path and package name of running process. 


#  https://askubuntu.com/questions/33640/kworker-what-is-it-and-why-is-it-hogging-so-much-cpu
#  https://unix.stackexchange.com/questions/213334/why-add-parentheses-around-a-process-name


# List process without [abc123] without first line and without options and without (sd-pam)
LIST_PROCESS=$(ps -eo user,pid,cmd  | grep -v '\[.*\]\|grep --color=auto' | awk 'NR!=1' | awk '{ print $1 , $2 ,  $3 }' | grep -v "\(sd-pam\)")

while read; do
    # If $REPLY contains a path 
    PATH_OR_NAME=$(echo "$REPLY"  | awk '{ print $3 }')
    USER_PID=$(echo "$REPLY"  | awk '{ print $1 , $2 }')
        #echo "$PATH_OR_NAME"
    if grep -q "/" <<< "$PATH_OR_NAME" ; then
        PROCESS_PATH="$PATH_OR_NAME"
        GUESS=""
    # If $REPLY not contains a path = is process name
    elif grep -qv "/" <<< "$LIST_PROCESS" ; then
        # You can use PROCESS_PATH with "which" command
        # or PROCESS_PID and PROCESS_PATH with "ls -l"
        #PROCESS_PATH=$(which "$PATH_OR_NAME")
        GUESS="$PATH_OR_NAME"
                PROCESS_PID=$(echo "$REPLY"  | awk '{ print $2 }')
                PROCESS_PATH=$(ls -l  /proc/$PROCESS_PID/exe | awk '{print $NF}')
    else
        echo "error = $REPLY"
    fi

    PACKAGE_OF_PATH=$(/usr/bin/dpkg -S "$PROCESS_PATH" | awk '{ print $1 }' |  sed 's/://')
    echo "$USER_PID = $GUESS = $PROCESS_PATH = $PACKAGE_OF_PATH"

done <<< "$LIST_PROCESS"

In output should be:
USER = PID = NAME (if not exist path) = PATH = PACKAGE (which provide this path)

______________________________________
The reason for writing the script was situation,
when i saw running processes and didn't know what they were from.
One of the processes came from a nautilus or nautilus dependency, which I don't need / I don't use. So I removed some packages.

Code: Select all

libtracker-control-2.0-0
libtracker-miner-2.0-0
libtracker-sparql-2.0-0
easytag-nautilus
nautilus
tracker
tracker-extract
tracker-miner-fs

I also used

Code: Select all

pstree

Then you can see where does the process start from.

[1000]

I installed linux-tools-.... and linux-tools-....-generic

Do you know how I can check [kworker/3:0] or other [abc123] kernel process from which path or kernel module working ?


Edit
Only info:
I tried use perf and inside I have warning about missing file
I saw a similar topic in Fedora
so I tried check also and

Code: Select all

# strace -f -e file perf report 2>&1 | grep tips.txt
access("/usr/share/doc/perf-tip/tips.txt", F_OK) = -1 ENOENT (There is no such file or directory )
access("/build/linux-ECRZz3/linux-5.4.0/debian/build/tools-perarch/tools/perf/Documentation/tips.txt", F_OK) = -1 ENOENT (There is no such file or directory )

and someone copied a file from github ( probably from source code of kernel )