3

I am working on a script I can run to debloat various Linux distros to remove unnecessary prepackaged software based on a persons varying use cases. However there are lots of processes, particularly in the graphical environment, which might be performing some important or expected role which isn't obvious just by looking at top or the installed package list. I've been able to diagnose some of these programs just by simple trial and error, removing a program and seeing what breaks, but this is time consuming and the results aren't always accurate. Sometimes these programs are also nested within processes being run by other programs, such as your file manager popping up when you download a file in Firefox so you can decide where you want to save it.

I want to know is there a program that will identify what application owns a given window being focused on screen? To go back to the Firefox example, when I go to download a file and the file manager pops up I'd want to know what application if giving me the file manager, not just that this overall process is owned by Firefox. Ideally it would be helpful to know what application own various elements of the graphical environment simply by hovering over them. For example if I hover over the wifi applet on my panel that let's me select a network, how would I identify that this program is "nm-applet" rather than just the main networkmanager program thats actually carrying out the process I'm running?

As I said I've tried reverse engineering to identify what is what but its not efficient. If anyone knows of methods to try or programs that would just do this for me it'd be a big help.

Improve this question

2 Answers 2

Reset to default
2

This method comes from the article Finding the process that a window belongs to:

It is possible to discover which process a window belongs to by using the xprop command line tool (which is part of the Debian package x11-utils).

  1. Execute the following command in a shell:

    xprop _NET_WM_PID | sed 's/_NET_WM_PID(CARDINAL) = //'

  2. Click on the window whose process should be identified. (If the desired window is not visible, use Alt+Tab to bring it to the foreground.) The above command should then output the process ID, for example:

    923

To output the parent process ID (PPID), process ID (PID) and the complete command used for executing a process, the following command can be used (in the same way):

ps ww -o ppid=,pid=,cmd= -q `xprop _NET_WM_PID | sed 's/_NET_WM_PID(CARDINAL) = //'`

Example output:

854    2101 /usr/lib/firefox/firefox https://www.froglogic.com
Improve this answer
0

If it's an X11 window, run xprop and look for the _NET_WM_PID property.

(Most clients set it, but not all. If a particular app doesn't, run forkstat, then xkill the window and see which process just died according to forkstat.)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .