Why does "ps -p proc1 proc2 proc3" show "-csh", "-tcsh", and "-/bin/tcsh", whereas "ps -p proc[n]" individually all say "tcsh"?

Question

I use tcsh (not csh), and ran pgrep csh | xargs ps -p to see why I appeared to be running csh. A portion of the results:

 1529 pts/0    Ss     0:00 -csh
 1764 pts/3    Ss     0:00 -tcsh
 1979 pts/4    Ss+    0:00 -bin/tcsh

I then did ps -p 1529 1764 1979 and got the same thing:

  PID TTY      STAT   TIME COMMAND
 1529 pts/0    Ss     0:00 -csh
 1764 pts/3    Ss     0:00 -tcsh
 1979 pts/4    Ss+    0:00 -bin/tcsh

Then I did ps -p 1529; ps -p 1764; ps -p 1979

  PID TTY          TIME CMD
 1529 pts/0    00:00:00 tcsh
  PID TTY          TIME CMD
 1764 pts/3    00:00:00 tcsh
  PID TTY          TIME CMD
 1979 pts/4    00:00:00 tcsh

ps --version gives procps-ng version 3.3.10 and tcsh --version yields tcsh 6.19.00 (Astron) 2015-05-21 (x86_64-unknown-linux) options wide,nls,dl,al,kan,sm,rh,color,filec.

Why this odd behavior? I'm trying to write a process monitor, and having tcsh take three different forms is annoying.

score 0 · Answer 1 · answered Nov 27 '16 at 17:06

You are comparing two different fields.

Note the header lines. The one with the dashes has COMMAND, whereas the one with tcsh has CMD. See the Standard format specifiers section of the man 1 ps man page.

Essentially:

cmd (CMD) is the command with all its arguments as a string.
comm (COMMAND) is the name of the executable the process is running.

In Linux, the latter can also be set using prctl(PR_SET_NAME, string) for the entire process, and with pthread_setname_np(thread, string) for an individual thread. string is limited to 16 characters, though.

Shells routinely set their name based on the symlink or mode they were executed in, so that the process list looks logically correct. In particular, starting the name with a dash (as in -tcsh) is used to indicate a login shell.

In OP's case, there are three shells running the tcsh shell binary, all three as login shells, but one of them is in csh mode.

A login shell is just a shell in a certain interactive mode; the shell behaving slightly differently to one that say executes a script. Consider it a mode that has bells and whistles to make shell use easier for humans, that scripts do not need.

The OP almost certainly has csh aliased to tcsh, and the three shells were started using tcsh -l, csh -l, and bin/tcsh -l, respectively. To find out which actual binary a command starts, use realpath $(which command).

score 0 · Answer 2 · edited Apr 13 '17 at 12:36

This is an oddity of Linux's ps command. It tries to emulate the behavior of ps of several Unix variants, and guesses the variant based on the options you pass. This is described as “personality” in the man page.

Depending on the guessed variant, the default set of output fields is different. In the Linux personality, ps shows the pid (“PID”), tty (“TTY”), time (“TIME”) and args (“CMD”) columns. In the BSD personality, ps shows pid “PID”, tty “TTY”, stat “STAT”,time“TIME” andcomm“COMMAND”.ps -p 1529is (historically) System V syntax, and in that case Linux chooses the Linux personality.ps -p 1529 1764 1979has the-poption with the argument1529, and two more arguments1764and1979(they're argument topsitself, not to the-poption). With a process ID as argument,pschooses the BSD output format. You get the same withps 1529`.

The difference between the args column (alias command, header “CMD”) and the comm column (header “COMMAND”) is that CMD shows the command line with all arguments separted by spaces (possibly truncated), whereas COMMAND shows only the executable name. The first argument (argument number 0) in a program's command line is normally the name of the executable, by convention. However, when a shell is invoked as a login shell, argument 0 has a dash (-) as a prefix — this is how a shell finds out that it's supposed to act as a login shell. On this topic, see Difference between Login Shell and Non-Login Shell? and Why we can not see a single hyphen from $0 on a login shell invoked with `--login` option?

As for the appearance of csh as opposed to tcsh, that means you ran csh somewhere. You might not have noticed if csh is just a symbolic to tcsh.

Why does "ps -p proc1 proc2 proc3" show "-csh", "-tcsh", and "-/bin/tcsh", whereas "ps -p proc[n]" individually all say "tcsh"?

2 Answers2