Find what process is on the other end of a pipe

The symlink contents "pipe:[20043922]" are a unique ID; the other end of the pipe will have a matching ID.

(find /proc -type l | xargs ls -l | fgrep 'pipe:[20043922]') 2>/dev/null

should show you both ends of the pipe.


You can get the list of processes using the pipe by using lsof command:

lsof | grep 'FIFO.*20043922'

The output will show the readers (in the FD column with entries like 1r) and writers (same columns with entries like 2w).


I'd use px.

Disclaimer: I wrote it, so of course I'm recommending it.

px will tell you which other processes yours is talking to, sudo px 7926 would have gotten you the answer.

Example output (not your PID obviously, but still), scroll to the bottom for pipes tracing:

~ $ sudo px 76572
cat

kernel(0)               root
  launchd(1)            root
    iTerm2(39341)       johan
      iTerm2(39343)     johan
        login(39344)    root
          -fish(39346)  johan
----------> cat(76572)  johan

14.62s ago cat was started, at 2020-09-12T16:20:12+02:00.

Other processes started close to cat(76572):
  CoreServices/mdworker_shared(76468) was started 4m32s before cat(76572)
  CoreServices/mdworker_shared(76475) was started 4m02s before cat(76572)
  CoreServices/mdworker_shared(76541) was started 1m55s before cat(76572)
  cat(76573) was started just after cat(76572)
  sudo px(76583) was started 14.0s after cat(76572)

Users logged in when cat(76572) started:
  johan

2020-09-12T16:20:26.739132: Now invoking lsof, this can take over a minute on a big system...
2020-09-12T16:20:27.052847: lsof done, proceeding.

Others sharing this process' working directory (/Users/johan)
  cat(76573)
  -fish(39346)
  iTerm2(39343)
  login(39344)
  sudo px(76583)

File descriptors:
  stdin : [CHR] /dev/ttys000
  stdout: [PIPE] -> cat(76573) (0x204c1334a30aa50d)
  stderr: [CHR] /dev/ttys000

Network connections:

Inter Process Communication:
  cat(76573): [PIPE] ->0x204c1334a30aa50d

For a list of all open files, do "sudo lsof -p 76572", or "sudo watch lsof -p 76572" for a live view.
~ $