8

On Linux: Normally pseudo terminals are allocated one after the other.

Today I realized that even after a reboot of my laptop the first opened terminal window (which was always pts/0 earlier) suddenly became pts/5.

This was weird and made me curious. I wanted to find out which process is occupying the device /dev/pts/0 and had no luck using common tools like who and lsof or even ps as suggested in the comment:

pf@pfmaster-P170EM:pts/6 /var/log 1115> ps auxww | grep pts/0 
pf        7042  0.0  0.0  17208   964 pts/6    S+   12:32   0:00 grep --color=auto pts/0

What I'm missing here? Possibly infected by a rookit?

Gilles 'SO- stop being evil'
  • 807,993
  • 194
  • 1,674
  • 2,175
pefu
  • 220
  • 2
  • 8
  • 1
    What's the output of `ps auxww|grep pts/0`? (Edit it into your question, please!) – MadHatter Jan 29 '14 at 11:28
  • My session is also on a pts other than `pts/0`. In my case, the other pts entries are from dead processes; see the output of `who -a`. – Jonas Malaco Jan 28 '16 at 11:27
  • 1
    @jonasmalacofilho: Many thanks for having a look into this. In my case (running Kubuntu 14.04.3 LTS based on Debian jessie/sid) it remains mysterious to me, which process occupies pts/0. It is not listed in the output oft the command ``who -a``. – pefu Jan 29 '16 at 09:24

2 Answers2

4

If you have fuser installed and have the permission to use sudo:

for i in $(sudo fuser /dev/pts/0); do
    ps -o pid= -o command= -p $i
done

eg:

24622 /usr/bin/python /usr/bin/terminator
24633 ksh93 -o vi
pefu
  • 220
  • 2
  • 8
jlliagre
  • 60,319
  • 10
  • 115
  • 157
1

I finally found an although very ugly way to figure out which process occupies the pseudo terminal pts/0.

As Superuser I did cd /proc and entered the following bash command:

for pid in [0-9]* ; do  \
    RES=`ls -l $pid/fd/* 2>/dev/null| grep pts/0`; \
    if [ -n "$RES" ]; then echo "Process $pid owns: $RES"; fi; \
done

This way I figured out that in my case the pts/0 was occupied by the process /usr/sbin/bumblebeed.

pefu
  • 220
  • 2
  • 8