409

When I search for some process that doesn't exist, e.g.

$ ps aux | grep fnord                          
wayne    15745  0.0  0.0  13580   928 pts/6    S+   03:58   0:00 grep fnord

Obviously I don't care about grep - that makes as much sense as searching for the ps process!

How can I prevent grep from showing up in the results?

Wayne Werner
  • 11,713
  • 38
    If you need only the PID of a process, you can replace ps aux |grep with pgrep (or pgrep -f ). – jofel Apr 30 '13 at 13:54
  • 7
    Same question on Serverfault and Superuser. – Thor Apr 30 '13 at 14:08
  • is that output legit? it seems that there IS no program named fnord running... – acolyte Apr 30 '13 at 17:10
  • 4
    @acolyte, that's precisely it - but because it's piping the output into grep, grep is running (waiting for the output of ps aux, I expect). So the question is how to prevent grep fnord from showing up as a running process because obviously I'm not interested in that one. – Wayne Werner May 02 '13 at 01:58
  • no no no no, what i meant is, is that all the output you get? because if so, then there IS no program named 'fnord' running, just the call to grep. if, however, there is a line that you omitted (understandably), which contains the program itself, it's a different problem altogether. – acolyte May 02 '13 at 05:23
  • 2
    @acolyte it's not a surprise that you cannot see the "fnord" line. You are not supposed to be able to see it. If you have some 2 or 3 minutes to spare, search for it. – Francesco May 02 '13 at 09:54

18 Answers18

593

Turns out there's a solution found in keychain.

$ ps aux | grep "[f]nord"

By putting the brackets around the letter and quotes around the string you search for the regex, which says, "Find the character 'f' followed by 'nord'."

But since you put the brackets in the pattern 'f' is now followed by ']', so grep won't show up in the results list. Neato!

Elijah Lynn
  • 1,045
Wayne Werner
  • 11,713
  • but, the line itself will be readong " grep fnord (possibly even grep [f]nord"), won't it? – acolyte Apr 30 '13 at 17:09
  • 39
    @acolyte: The output from ps will include a line ending with grep [f]nord. However, that line will not make in through the grep filter, because the string [f]nord does not match the regular expression [f]nord. – LarsH Apr 30 '13 at 17:58
  • 11
    @LarsH interesting, thanks! i would have suggested ps aux | grep fnord | grep -v grep ...which seems to have already been suggested by a few people...lol – acolyte Apr 30 '13 at 18:16
  • 3
    If you use bash, you don't need to escape or quote the []'s. In zsh you only need to escape the first one: \[c]onky == "[c]onky". – mike3996 May 01 '13 at 10:29
  • 6
    @progo Yes, you do need to quote the [ even in bash. Try it with a file called fnord in the current directory. – Gilles 'SO- stop being evil' May 01 '13 at 22:18
  • 27
    Grepping the output of ps may be an old trick, but it's unreliable. Use pgrep if available. – Gilles 'SO- stop being evil' May 01 '13 at 22:19
  • 1
    @Gilles, I think I'm slow but I don't get it, what makes the trick "unreliable"? – n611x007 Nov 24 '13 at 22:33
  • 9
    @naxa Imagine you have a program call fnord and a program called safnorde. Or there's a user called bfnord, and you end up killing all his processes. Etc. – Gilles 'SO- stop being evil' Nov 24 '13 at 22:37
  • 1
    Very clever! Nothing else to say, but good thinking. – Jay Dec 15 '15 at 18:27
  • 1
    Correct me if I am wrong, but this also should work on any position of the grepped character: ps aux| grep "fn[o]rd". – meso_2600 Mar 23 '16 at 09:42
  • 1
    Where have you been all my life? Why didn't I google this sooner... – Amir Mehler Jan 25 '17 at 09:37
  • 1
    @AmirMehler Here for at least 5 years ;) – Wayne Werner Jan 25 '17 at 14:13
  • I still don't understand why this works. Anyone can clarify? I understand regex, but why simple using [f] should not match the grep anymore? – lucaswxp Mar 29 '17 at 13:23
  • @lucaswxp when you run ps aux | grep fnord, that shows up in the output of ps, and grep fnord finds it. However, when you use ps aux | grep [f]nord then grep [f]nord doesn't match on [f]nord - it would only match fnord. – Wayne Werner Mar 29 '17 at 18:11
  • Sure this answer is the best, but these works just for fun: ps aux | grep "f[n]ord", ps aux | grep "fn[o]rd", ps aux | grep "fno[r]d", ps aux | grep "fnor[d]", ps aux | grep "[f]\{1\}nord", ... – Nabi K.A.Z. Oct 31 '17 at 23:18
  • wow, great easy solution +1 – Flash Thunder Dec 02 '17 at 15:39
  • this solution is very, very, very ancient (much more so than "keychain"!). It was one of the first answers found on the Usenet's shell faqs. it works by "desaligning" the word ps is looking for and the regexp to match it : the regexp some[t]hing will match any line containing something but will not match a line containing some[t]hing (for ex: grep "some[t]hing") as after matching "some" with "some" it will try to match a 't' with the character '[' and fail – Olivier Dulac Nov 02 '21 at 12:59
208

Another option I use (especially just to look if a process is running) is the pgrep command. This will search for a matching process, but not list a grep line for the search. I like it because it is a quick way of search, without regexing or escaping anything.

pgrep fnord

Moreover, to print both the process ID and the process name that is being matched, use (thanks phemmer)

pgrep -l fnord
AdminBee
  • 22,803
BriGuy
  • 3,211
  • 1
  • 15
  • 20
79

The ideal solution is the one presented by BriGuy

pgrep fnord 

But if you do not want to do that, you can just exclude all lines that matches with grep with:

ps aux | grep -v grep | grep "fnord"
RSFalcon7
  • 4,407
41

Not the most elegant solution but you could do this:

$ ps aux | grep fnord | grep -v grep

  • 1
    It's bad answer! Because if there was a word grep in your phrase. It will not show that process. For example, suppose a file called foo_grep_bar.txt is being edited by the nano command. So there's a process running: root 14908 0.0 0.0 110012 1692 pts / 3 S + Oct31 0:00 nano foo_grep_bar.txt According to this answer, this will not work: $ ps aux | grep nano | grep -v grep Because there's a grep word in your filename. – Nabi K.A.Z. Oct 31 '17 at 23:33
  • I prefer this as its more explicit about its intention than the accepted answer and works in all but one case. – samaspin Mar 28 '18 at 11:20
  • 3
    as per https://superuser.com/a/409658/450260 you should be excluding the full grep fnord not just grep i.e. $ ps aux | grep fnord | grep -v "grep fnord" – Davos Jul 26 '18 at 07:22
  • 1
  • I like this answer best because people reading this don't have to wonder why in the world the grep requires brackets in the other case, it's not obvious at all unless you know why it's needed. This one is really clear. But both are great answers! – p e p Aug 16 '21 at 15:41
21

In zsh, grep fnord =(ps aux).

The idea is, first run ps aux, put the result in a file, then use grep on that file. Only, we don't have a file, as we use zsh's "process substitution".

To illustrate, try

ps aux > ps.txt
grep fnord ps.txt
rm ps.txt

The result should be the same.

General comment on some of the other answers. Some are far to complicated and/or long to type. It is not only a matter of being right, it should be usable as well. But that doesn't mean some of those solutions are bad; only, they must be wrapped within a mini-UI to make them usable.

Emanuel Berg
  • 6,903
  • 8
  • 44
  • 65
10

This answer is procps-ng-specific. See Wayne's answer for a more general solution.

Searching for processes

If you're just looking for fnord processes, you can use the -C option to select by command name:

ps -C fnord

This can be mixed with BSD- and POSIX-style format options to your liking. See the ps man page for a complete list.

Looking for someting else ?

If you need something more advanced than an exact search for a command name, don't loose hope! This can still be done on the ps side of the pipe. All we have to do is to tell ps to exclude grep processes from the result :

ps -NC grep | grep 'fnord'

-C grep selects all grep processes, and -N negates the selection. This can be used to search for command arguments, part of a command name, or more complex regular expressions.

Stephen Kitt
  • 434,908
Morgan
  • 431
7
ps aux | grep $(echo fnord | sed "s/^\(.\)/[\1]/g")
yPhil
  • 222
  • 3
    this looks like an IOCCC, but for unix command line instead of C ^^ Just | grep $(echo fnord) wasn't enough ? you also ask sed to search and replace each char in "fnord" by its own value? ^^ congrats. I bet I can do an even longer one, but it probably won't be as funny ^^ – Olivier Dulac Apr 30 '13 at 16:26
  • 1
    I apologize as the tone of my above comment may sound offensive (and I can't edit it after 5mn)... Your answer was really a joyful read, and I wasn't trying to make you look bad. I really think you did it like this on purpose ^^ – Olivier Dulac Apr 30 '13 at 16:31
  • 1
    Don't apologize, your answer was really fun to read (and spot-on right too). I meant pgrep -l $1 anyway ;) – yPhil Apr 30 '13 at 16:48
  • Thanks (+1) for your humor :) And I made a mistake too : you don't ask sed to replace "each char in fnord by its own value" : as you anchor the regexp to the left of the string, you only replace "f" by "f" ... a bit like sed "s/^./&/" would do, but adding the comedic effect of saving it in a named buffer ^^ – Olivier Dulac Apr 30 '13 at 16:56
  • 3
    @OlivierDulac: He doesn't just replace the first char with its own value; he replaces it with the concatenation of its value among square brackets. (Those square brackets are not special, they're literal.) Basically, he's generalizing on Wayne Werner's answer, so that the process of putting square brackets around the first character can be scripted. +1 – LarsH Apr 30 '13 at 18:02
  • @LarsH : indeed ^^ (I'm tired, read the 2nd part as a regexp ^^). Good catch! (And doing that, it proves my first comments were wrong also on the intent!) Indeed Bravo to xaccrocheur ^^ the idea is, in retrospect, neat (and +1 worth!). It could be rewrote as a generic function : function newps { for i in "$@" ; do ps aux | grep "$(echo $1 | sed 's/^\(.\)/[\1]/g')" ; done ; } #but may need testing ^^. Use: newps exe1 exe2 – Olivier Dulac Apr 30 '13 at 18:09
  • sh scripting is all about killing time ;) This regexp has been in my .*shrc for ages, and I stare at it when sleep eludes me. – yPhil Apr 30 '13 at 18:29
  • 3
    ps aux | grep '[^]]fnord' would avoid that gymnastic. – Stéphane Chazelas Apr 30 '13 at 20:21
  • It works, But was funny :-D – Nabi K.A.Z. Oct 31 '17 at 23:22
6

The simplest shell-agnostic way to do this would be to store it in a variable first:

PS_OUTPUT="$(ps aux)"; echo "$PS_OUTPUT" |grep fnord

From my rc files, I have a case-insensitive version that takes grep's options:

psl() {
  local PS_OUTPUT="$(ps auxww)"
  echo "${PS_OUTPUT%%$'\n'*}" >&2  # title, in stderr to avoid pipes
  echo "${PS_OUTPUT#*$'\n'}" |grep -i "${@:-^}"
}

Code walk, one bullet per line of code:

  • Capture the verbose ps output (in a local variable so it is scoped to the function)
  • Display the first line (the title) in standard error so the results can be further filtered without affecting the title. The substitution says: take $PS_OUTPUT and remove everything after the first line feed (regex equiv: s/\n.*$//msg). This prevents us from grepping the title
  • Display the ps output with everything except the first line (regex equiv: s/^.*\n//m) and grep its contents with -i (case-insensitive) and all of the options handed to this function (in the case of no pattern, use ^ to match the start of each line)

Call-out: @EmanuelBerg's grep fnord =(ps aux) answer is by far the most elegant, though it requires zsh. I briefly had it in my rc files, but bash complains about that syntax even despite a conditional that should prevent its evaluation.

Adam Katz
  • 3,965
3

My answer is a variation on the typical answer for searching for "foobar" in a 'ps' listing. The argument of "-A" "ps" is more portable than "aux", I believe, but this change is irrelevant to the answer. The typical answer looks like this:

$ ps -A -ww | grep [f]oobar

Instead I use this pattern:

$ ps -A -ww | grep [^]]foobar

The main advantage is that it's easier to write scripts based on this patterns because you simply concatenate a static string "[^]]" with whatever pattern you are looking for. You don't need to strip off the first letter of the string then insert it between the square braces and then concatenate the that back together again. When scripting in shell it's easier to simply stick "[^]]" in front of the pattern you were lookginfor looking for. String slicing in Bash is an ugly thing, so my variation avoids that. This variation says show the lines where the pattern matches WITHOUT a leading right-square-bracket ]. Since the search pattern to exclude a square bracket actually adds the square bracket to the pattern then it will never match itself.

So you could write a portable 'psgrep' command as follows. Here, I make some allowance for differences between Linux, OS X BSD, and others. This adds the column headers from 'ps', provides a more custom 'ps' format that suits my needs betters, and displays processes listing extra, extra wide so that none of the command-line arguments are missed. Well, most are not missed. Java being Java, it often does things in the worst possible way, so you some java services will run past the maximum allowed length of arguments that the process table will keep track of. I believe this is 1024 characters. The command-lone length allowed to start a process is much longer, but the kernel process table doesn't bother to keep track of anything over 1K in length. Once the command is started the command-name and argument list isn't needed against, so what gets stored in the process table is just informational.

psgrep ()
{
    pattern=[^]]${1};
    case "$(uname -s)" in
        Darwin)
            ps -A -ww -o pid,ppid,nice,pri,pcpu,pmem,etime,user,wchan,stat,command | grep -i -e "^[[:space:]]*PID" -e ${pattern}
        ;;
        Linux)
            ps -A -ww -o pid,ppid,tid,nice,pri,pcpu,pmem,etime,user,wchan:20,stat,command | grep -i -e "^[[:space:]]*PID" -e ${pattern}
        ;;
        *)  # other UNIX flavors get a minimalist version.
            ps -A -ww | grep -i -e ${pattern}
        ;;
    esac
}
3

Here's an extended version of the grep -v grep solution, filtering out all grep processes that have not been running for more than a second, which is an improvement over "just discard all occurrences of grep".

$ ps -ef | grep -vw "00:00:00 grep" | grep <searchTerm>

respectively

$ ps aux | grep -vw "0:00 grep" | grep <searchTerm>

This may not be portable, and depends on the actual output format of your local ps command.

You may want to combine this with a coloured grep output for convenience:

$ alias grep='grep --color=auto'
Murphy
  • 2,649
  • It has the advantage of allowing | grep -E "string1|string2|string3" (for getting a list of the processes that have "string1" AND a list of the processes that have "string2" AND a list of the processes that have "string3") and it doesn't have the disadvantages mentioned in the comments of https://unix.stackexchange.com/a/74189/156298 – Ganton Dec 05 '23 at 17:44
1

Maybe time to use a real sequence this time. The use of pipes makes it parallel.

ps aux >f && grep tmpfs <f

Ugly because there will be a file f, but it's not my fault that there is no syntax for sequential processes where you still want to use the output of a previously run process.

Suggestion for the syntax of a sequential operator:

ps aux ||| grep tmpfs
  • The inability of the common people to easily filter a stream is hardly a reason for the elite to base themselves with sequences. It would be a step backward in computing. – Asclepius Aug 18 '14 at 20:27
  • @A-B-B https://en.wikipedia.org/wiki/Communicating_sequential_processes have many more operators than those that ended up in the Thompson shell. There could just have been an operator that is sequential, and which communicated its result to the next process in the sequence as soon as its exits. A "step backward in computing" by providing an additional operator seems a bit harsh. – Anne van Rossum Aug 19 '14 at 07:09
  • Nice link, but of course sequential processing is worse in both CPU and memory (or disk) use -- relative to parallel processing. In this instance, if I must first store all ps output before I grep, I'm using more memory (or disk) for longer. – Asclepius Aug 19 '14 at 19:37
1

Lots of great answers here already and it probably doesn't need another, but I just can't help myself... So what about leveraging command substitution via a "here string"?:

grep fnord <<<$(ps aux)

This ensures that the ps aux completes prior to the grep (via command substitution), then feeds the result into the stdin of grep (via here string), so that the grep never appears in the ps aux output.

0

Here is a simple example to find PID of ssh-agent for username without showing PID of grep process itself:

ps xu | grep "${USER}.*[ ]/usr/bin/ssh-agent" | awk '{print $1 $2;}'

If you want for example to kill ssh-agent for current user you might use following command:

kill `ps xu | grep "${USER}.*[ ]/usr/bin/ssh-agent" | awk '{print $2;}'`

To create a handy alias add to your ~/.bashrc or ~/.zshrc file the following code:

function function1 () {
    ps xu | grep "$1.*$2" | awk '{print $1" "$2" "$11;}'
}
alias mygrep="function1"

And to use alias here are examples to force everyone to learn regular expressions:

. /etc/profile #to make alias usable
mygrep ${USER} ${PROCESS_PATH}
mygrep ${USER} "[f]nord"
mygrep "[f]nord"
mygrep ".*[s]shd"

P.S. I've only tested these commands on Ubuntu and Gentoo.

  • (1) The question doesn't say that the user is looking for one of his own processes — the user might not know the owner of the process he's looking for.  (2) As fancy as this answer is, it would still fail if you had said "${USER}.* /usr/bin/ssh-agent".  It works because you said [ ]; i.e., you are just using the mechanism of the accepted answer.  You might as well just grep "[s]sh-agent". – G-Man Says 'Reinstate Monica' Nov 06 '15 at 14:27
  • You are right. (1) I shared what might be useful as I found myself facing this page once in a while (2) Yes I used regular expression as in accepted answer. (3) I updated my answer to be the same as accepted as the one is better, but I also showed how to make and alias to be used with username provided or without it. (4) Also shown how to define function, though it is not necessary but works in interesting way as $1 and $2 doesn't overlap. Thx #G-Man – Constantin Zagorsky Nov 07 '15 at 16:30
0

Using the -x (exact match) option worked for me. I combined it with -f (full command line), so I could match my process precisely with:

pgrep -x -f "path_i_used_when_starting/cmd params_i_used"
moodboom
  • 167
  • Will whoever is doing the drive-by downvoting explain themselves? This has been working to solve this issue for me without fail for years. – moodboom Apr 13 '19 at 18:37
0

Elaborating on @Emmanuel-Berg & @Adam-katz answers, you may use the POSIX option "-f $file" together with Bash's "Process Substitution" "<( $cmd)":

$ ps aux | grep -f <( echo fnord)

The pattern is passed to grep through a pseudo-file filled up by the command echo fnord. You may use this handy form which allows for several patterns (fnord + syslog), vs only one:

$ alias psgrep='ps aux | grep -f <( echo -e "$a")'
$ a="fnord\nsyslog"; psgrep
wjb
  • 1
0

For a 'fnord' both the regular expression [f]nord or pgrep usage may work.

But for a generic use, the regex is by far more flexible, allowing to get more information on the output in case you need to refine the search. This make the solution more reliable than the one that 'pgrep' offers returning just a PID

Imagine a machine where several Tomcat instances are running with processes like:

tomcat   154304      1  8 10:43 ?        00:00:59 /usr/lib/jvm/jre/bin/java -Djava.util.logging.config.file=/somewhere/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.awt.headless=true -Djava.security.egd=file:/dev/./urandom -Djdk.tls.ephemeralDHKeySize=2048 -Djava.protocol.handler.pkgs=org.apache.catalina.webresources -Dorg.apache.catalina.security.SecurityListener.UMASK=0027 -Xms512M -Xmx1024M -server -XX:+UseParallelGC -Dignore.endorsed.dirs= -classpath ....

In this case, 'pgrep' won't be reliable (if usable at all) for identifying the exact process you need.

On the other hand:

ps -fea|grep "[j]ava"

probably will not be precise enough, but will allow to further process the output to refine the search

0

The pgrep command, as others have stated, will return the PID (process ID) of processes based on name and other attributes. For example,

pgrep -d, -u <username> <string>

will give you the PIDs, delimited by a comma (,) of all processes whose name matches being run by user <username>. You can use the -x switch before to return only exact matches.

If you want to get more information about these processes (as running the aux options from ps implies), you can use the -p option with ps, which matches based on PID. So, for example,

ps up $(pgrep -d, -u <username> <string>)

will give detailed information of all the PIDs matched by the pgrep command.

Anthon
  • 79,293
-3

You can do it easily, just with defining an ALIAS in your .bashrc like this:

alias grep='grep -v grep | grep'
Chris Davies
  • 116,213
  • 16
  • 160
  • 287
  • 1
    Not sure who down-voted or why but this allows you to use full use of ps that pgrep doesn't. – opticyclic Nov 27 '16 at 00:05
  • 1
    Not only that this inadvertently excludes other grep processes; it also breaks grep usage in other cases. Try echo I love grep | grep love. – trosos May 21 '17 at 22:54
  • @trosos Almost 11 years I've been *nix-ing .. and have never used that pattern ever ... maybe next year though - who knows right. – a20 Mar 29 '18 at 11:08