Meaning of when a process in "ps -el" output does not show full path to executable?

Question

On Catalina v10.15.7, I am using:

ps -el

to investigate all running processes.

I have 430 running processes. Ignoring those associated with open terminals, I'd like to understand why these 6 processes do not have the full path to their executable file listed when using ps -el:
aslmanager, auditd, autofsd, cloudphotod, endpointsecurityd, SafeEjectGPUAgent

aslmanager and auditd are in /usr/sbin, and yet /usr/sbin/syslogd, /usr/sbin/notifyd, and 31 other running processes from /usr/sbin do have their full path listed in ps -el output.

autofsd and endpointsecurityd are both located in /usr/libexec, yet 97 other running processes located in /usr/libexec do have their full paths listed.

There seems to be aliasing going on with cloudphotod and SafeEjectGPUAgent for executable files in the context of ps -el output.

I'd like to learn anything about the ps -el output exceptions when full file paths are not displayed to the executable.

Answer 1

It's not really a case of output exceptions inside the ps command.

What ps does is that it lists all the processes - and in particular it prints out the first element of the so called argv for each process. By convention the first element contains the name of the executable - but it is not actually required to be that way.

Described roughly, when you for example start a program in the Terminal by typing this command:

/usr/bin/less document.txt

The shell (for example zsh or bash) will perform some variant of exec() to ask the operating system to run that process. exec() takes a number of parameters - namely first and foremost the path and name of the program to run (/usr/bin/less) - and a list of arguments for the program to process. The first argument is by convention the name of the program itself - and so the shell will usually put whatever you wrote to start the program in there. The second argument is "document.txt" in this example.

So with less running, you can run ps -el in another terminal, and you'll see the process and it will be listed as /usr/bin/less.

However, if you instead type this in the Terminal:

cd /usr/bin/
./less ~/document.txt

You'll find that running ps -el in another Terminal now lists the process as being simply ./less.

So that's the reason why some programs lists a full path and some do not. It is simply because of how they were originally started.

If you now run