You want to catch a process, but they just shoot by too quickly.
Every time you run a ps, you cannot spot that specific command.
You need a capture script.
Run the code at the example and it will catch changing and new processes. To be more aggressive, just change “sleep 5” to “sleep 1”.
ps –fu $user > catchdiff
ps -fu $user | diff - catchdiff | egrep -v 'catchdiff|-bash$|^---|^[0-9]'