Tell if running process is running under Rosetta or is M1-native by Command Line

Question

If you have an M1-based Macbook you can tell if a process running on the machine is Apple/M1 or Intel/Rosetta in Activity Monitor, but is there a way to get this information on the command line?

I'd like to be able to quickly show a count of how many Intel processes are currently running on my machine under Rosetta.

Answer 1

TL,DR: fuser /usr/libexec/rosetta/runtime

I know how to see which processes are non-native. I don't know how to tell between different non-native architectures, but in practice there's only one

A non-native process has the Rosetta runtime open. You can use fuser to list which processes have a given file open. You can use lsof to see what files a given process has open.

$ arch -x86_64 sleep 868686 &
[1] 65444
$ sleep 123123123 &
[2] 65446
$ fuser /usr/libexec/rosetta/runtime
/usr/libexec/rosetta/runtime: 65444
$ lsof -p65444 -p65446 | grep /usr/libexec/rosetta/runtime
sleep   65444 gilles  txt    REG   1,18    220064 1152921500312773394 /usr/libexec/rosetta/runtime

You'll need sudo to see other users' processes (but normally system processes should be native).

Answer 2

Here is some snippet to check all Rosetta 2 pids and inspect them:

ps -p `fuser /usr/libexec/rosetta/runtime | sed -e 's/.*: //' | sed -e 's/ /,/g'`

Answer 3

This actually can be done with AppleScript if you know the PID of the process:

osascript -e 'tell application "System Events" to return architecture of processes whose unix id is 758'

Answer 4

Get the list of pids (one per line):

fuser /usr/libexec/rosetta/runtime 2>/dev/null | xargs -n1

You can then use it to filter with grep:

ps aux | grep -f <(fuser /usr/libexec/rosetta/runtime 2>/dev/null | xargs -n1)

Answer 5

You can definitely rule out some things (go to the terminal). e.g.

# ps -ef | grep -i firefox$
  502 56288     1   0 11Mar21 ??       207:43.89 /Applications/Firefox.app/Contents/MacOS/firefox

USE the executable name and pass to file command.

# file /Applications/Firefox.app/Contents/MacOS/firefox
/Applications/Firefox.app/Contents/MacOS/firefox: Mach-O 64-bit executable x86_64

So if that gives you x86_64 it has to be running under Rosetta - it's got only x86_64 architecture (the pre-M1 one).

On a M1 machine some things ship with universal binaries - for instance do the same thing for Safari and I get something like this (sorry machine is air-gapped .. this is TCP-over-ME so may not be 100% correct :-)

# file /Applications/Safari.app/Contents/MacOS/Safari
/Applications/Safari.app/Contents/MacOS/Safari:Mach-O universal binary with 2 architectures: [x86_64:Mach_o 64 bit executable x86_64][arm64e:Mach-o 64-bit executable arm64e]

.. and then proceeds to give output that is for each architecture ... According to Apple it will "prefer" arm64e.