From the Linux command line, give a count of the number of active processes per user, sorted in descending order by count. #Linux #DFIR #CommandLine #Trivia

Nov 11, 2022 · 12:49 PM UTC

5
5
Props to istar_nil for a great answer to yesterday's #Linux #DFIR #CommandLine #Trivia: ps -ef | tail +2 | awk '{ print $1 }' | sort | uniq -c | sort -nr First off, ＊chef's kiss＊ to the "tail +2" to skip the initial header line in… infosec.exchange/@hal_pomera…

Hal Pomeranz (@hal_pomeranz@infosec.exchange)

Props to @istar_nil@twitter.com for a great answer to yesterday's #Linux #DFIR #CommandLine #Trivia: ps -ef | tail +2 | awk '{ print $1 }' | sort | uniq -c | sort -nr First off, *chef's kiss* to the...

infosec.exchange
1
3
Replying to @hal_pomeranz
I haven't done this in any real capacity since 2013 but this thread makes me deeply happy
Replying to @hal_pomeranz
as usual i have no idea how this would work in Linux, but on FreeBSD or any other 4.4BSD derivative it would be: ps axo user= | sort | uniq -c | sort -nr
5
Replying to @hal_pomeranz
ps -ef | tail +2 | awk '{ print $1 }' | sort | uniq -c | sort -nr
2
Replying to @hal_pomeranz
ps -eo user:30 --no-headers | col1 | uniq -c | sort -nr