Path: utzoo!attcan!uunet!cs.utexas.edu!romp!auschs!d75!awdprime!doorstop.austin.ibm.com!tif
From: tif@doorstop.austin.ibm.com (/32767)
Newsgroups: comp.unix.questions
Subject: Re: Finding if a process is active
Message-ID: <2546@awdprime.UUCP>
Date: 13 Jun 90 18:28:20 GMT
References: <1629@s3.ireq.hydro.qc.ca> <13095@smoke.BRL.MIL>
Sender: news@awdprime.UUCP
Reply-To: tif@doorstop.austin.ibm.com
Distribution: comp.unix.questions
Organization: IBM AWD, Austin, TX
Lines: 20

In article <13095@smoke.BRL.MIL> gwyn@smoke.BRL.MIL (Doug Gwyn) writes:
>Processes don't have names, only numbers (PIDs).  The image that was
>exec()ed came from a file that had a name, but the process could
>easily alter the only record of the name assigned to its argv[0],

I thought that the "name" was stored in two separate places?  argv[0]
was just one place.  I was led to believe that this is the difference
between "ps" and "ps -f".  The output of "ps -f" can be tinkered with
but the output of "ps" (according to my info) was guaranteed.

For instance, when you run nethack (I think it was), it tried to hide
itself by changing its name.  "ps -f" would give "-" as the name, but
just "ps" would give "nethack".  (I have come to believe that the latter
name is what is used for process accounting as well.)

Am I completely off?

(Mail may not make it to me...)
Paul Chamberlain | I do NOT represent IBM	  tif@doorstop, sc30661@ausvm6
512/838-7008	 | ...!cs.utexas.edu!ibmaus!auschs!doorstop.austin.ibm.com!tif