Why does `ps -x | grep foo` include the grep command?

jhericks

1/24/23, 12:29 AM

I know that it does (often) include the grep process and I know adding | grep -v grep or grepping on [f]oo instead will prevent it, but my question is more about order of operations I guess.

For example, in this contrived example, I see several grep processes:

% ps -x | grep login | grep login | grep login | grep login
 2475 ??         0:00.03 /usr/libexec/loginitemregisterd
 2115 ttys004    0:00.04 login -fp jasonerickson
29715 ttys004    0:00.00 grep login
29716 ttys004    0:00.00 grep login
29717 ttys004    0:00.00 grep login
29718 ttys004    0:00.00 grep login

That tells me that ps -x must be executed last in that line, since it lists all of those subsequent grep commands. However, it is not consistent. Sometimes it will list 4 or 3 or 2 or even none of the grep processes. That would imply to me that it is not always last.

What's going on?

1246

0 + 0

shell

shell-scripting

Bravo

1/24/23, 12:33 AM

`|` establishes a pipe from `ps -x` stdout to `grep login` stdin ... so, both processes would both need to be running for the pipe to exist

Score:3

Server

tsc_chazz

1/24/23, 12:44 AM

As Bravo points out, a pipe in Linux is not a file, it is dynamic. So ps -x | grep login will actually start both programs at once, so that one can pitch down the pipe and the other can catch. The reason it is not deterministic, why your contrived example doesn't always show four grep instances, is that an instance may not be started until there is something in the pipe for it to do; or the instance in question may not be fully started when ps reads the process list.

0 + 0

Score:1

Server

user10489

1/24/23, 1:53 AM

Unix is a multitasking operating system. It doesn't start ps first or last. It starts all the things in the pipeline in parallel. Some might finish first or start after ps starts, and that's where your race comes from that makes the results slightly non-deterministic.

Basically, there is no order of operations here. A pipeline is a data stream, not a math formula.

The beauty of the pipe in unix is that the second program can start processing the input before the first program finishes, and thus it isn't necessary to collect and store the entire data stream in memory (or disk) before giving it to the next thing in the pipe.

0 + 0