How to list Application hierarchy like Activity Monitor?

Question

Created Dec ’15

Replies 2

Boosts 0

Views 1.7k

Participants 3

When I view processes in Activity Monitor's "All Processes, Hierarchical" view, it shows which processes launched other processes. For instance, if I have "Network" open inside "System Preferences", then when I expand System Preferences, I see (irrelevant columns omitted):

Process NamePID

System Preferences	22033
com.apple.preference.network.remoteservice	22043

I.e. Activity Monitor knows that remoteservice was created by System Preferences.

However, when I use 'ps' from the command line, both processes' parent PID values are 1 (launchd):

$ ps -ww -o 'pid,ppid,command' -p 22033,22043

PIDPPIDCOMMAND

22033	1	/Applications/System Preferences.app/Contents/MacOS/System Preferences
22043	1	/System/Library/PreferencePanes/Network.prefPane/Contents/XPCServices/com.apple.preference.network.remoteservice.xpc/Contents/MacOS/com.apple.preference.network.remoteservice

sysctl("kern.proc.pid") is the same.

How can I learn that remoteservice (pid 22043) was created by System Preferences (pid 22033)?

This is OS X Yosemite 10.10.5, but I believe El Capitan behaves the same way.

Answer 1

DTS Engineer OP

Apple

Jan ’16

How can I learn that remoteservice (pid 22043) was created by System Preferences (pid 22033)?

I researched this a while back as part of a DTS incident. The system has a ‘responsibility’ mechanism that it uses to track these relationships. The API for this is not public (r. 14860959).

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

Answer 2

hepting_airbnb OP

Apr ’24

Since there aren't any other replies here, for my future self I'll share that you can run sudo eslogger exec and look for the responsible_audit_token key to get the parent pid.