Find Files Responsible for Starting Process on Mac While running a local port scan for a troublesome process I discovered a few unknown open ports.

 Open TCP Port:     106         3com-tsmux
 Open TCP Port:     3001        redwood-broker


I believe I know what redwood-broker is for, but the other one not so much..

I began by looking up its PID with:

sudo lsof -i :106


Then killed it with 

sudo kill [PID]


But it keeps popping up.  

How can I find the path to the files responsible for starting this process?
If the process keeps reappearing then most likely it is started by launchd. Use launchctl to list jobs loaded to launchd:

sudo launchctl list
launchctl list


Job definitions for launchd in .plist files are stored in:

~/Library/LaunchAgents         Per-user agents provided by the user.
/Library/LaunchAgents          Per-user agents provided by the administrator.
/Library/LaunchDaemons         System-wide daemons provided by the administrator.
/System/Library/LaunchAgents   Per-user agents provided by Mac OS X.
/System/Library/LaunchDaemons  System-wide daemons provided by Mac OS X.


You might also grep the above files for actual path to executable.



For all processes you can check the output of ps -ef | grep &lt;process_name&gt; and check the parent process PPID.

  UID   PID  PPID   C STIME   TTY           TIME CMD
  501 17151  7357   0  9:35AM ttys000    0:00.00 grep grep


In this example grep process was spawned from process 7357. Later you can check ps -ef | grep 7357 to find out it was bash process that started grep.