Determining Which Service Kicked Off A Linux Process

I recently found myself needing to check the status of a service. I would traditionally do this via:

sudo systemctl status {service-name}

While this has historically worked for the service in question, this time it gave me a message that there was no service found with that name. That being said, I knew for a fact that the application in question was running because the vendor cloud that it was regularly phoning into was receiving data. The vendor’s documentation made no mention of modifying how the service for their agent ran, though.

Looking at the processes running on the system, I knew that the package was being executed under the JVM. So I could determine the process ID (PID) of that by running:

ps axu | grep {process-name}

After making note of that PID, I could get the PID for the parent of that process with:

ps -o pid,ppid,cmd -p {PID}

Then I could figure out what kicked off the parent PID (PPID) with:

ps -fp {PPID}

In this case, systemd was what kicked it off, telling me that it is, in fact, running under a service. I could get the service of the original process (the PID, not the PPID) with:

systemctl status {PID}

This finally gave me the clue that I needed, as my service in question was running as a machine user service rather than as a system-level service. The service itself was called “user@1001.service” and showed several other services, one of which is the one I was concerned about, running underneath it. Now that I knew the machine account, I could finally access the service status and restart it if necessary via:

sudo systemctl --user --machine=1001@ status {service-name}

After this I reached out to the vendor who confirmed that they did change how their agent runs back at the end of December and simply hadn’t updated their documentation (shame on them).