I can't find certain PID

[Josef Forman]

Hi everybody!
I've just found a process with certain PID using top, but I can't find the same process using `ps aux`. How is it possible?

JF

[Stuart Browne · Accepted solution]

Try using 'ps -fp ' instead.

Failing that, use 'ls -l /proc/'.

If neither of the 'ps' commands work, but the last 'ls' does, then I'd say you have trojan'd executables on your system, and you've been root-kit'd.

If the 'ls' doesn't work either, then the PID doesn't actually exist any more. I'm assuming it was a transient PID which came and went. If 'top' is showing the same PID still, and you can't find it with those commands, then your system is seriously unhealthy.

[Josef Forman]

I can't see the process using the other commands, but I can still see the process using top command.

As you wrote - I assume that the system is little bit unhealthy ;o)
I'm gonna reboot it later today.

THANKS

[Ilay_1]

top show processes as well as threads,where ps show processes only.
So one of possibilities that you talk about thread and not process

cat /proc/yourPID/status |grep PPid

will say who is parent of this process.
As well you can find in /proc/yourPID/ a lot of interesting information

[George Liu_4]

It is likely the process dies very quickly. This is a kind of problems happened when a process can't start child processes due to errors.