Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

If I can see a process running using ps -e, how can I find the file which launched it?

share|improve this question
1  
What OS is this? Linux, BSD, Solaris... –  Patrick Dec 29 '11 at 12:59
    
linux ... but cross-unix solutions welcome. –  interstar Dec 29 '11 at 16:33
add comment

3 Answers

On Linux: if you know the PID, you can cat the cmdline file for that file. E.g.:

cat /proc/PID/cmdline

This will probably fail if the binary was moved after the program was started.

And of course:

lsof -n | grep PID | grep ' txt '

and:

ls -la /proc/PID/exe

which is a symbolic link to the executable.

share|improve this answer
1  
Note that /proc/PID/cmdline doesn't have a newline character, so you'll probably want to do something like cat /proc/PID/cmdline ; echo ''. –  Keith Thompson Dec 30 '11 at 0:56
    
Actually, it has NUL characters separating the arguments, so you might want something even more elaborate like tr '\0' ' ' < /proc/PID/cmdline ; echo '' –  Keith Thompson Dec 30 '11 at 1:00
add comment

Copy the process id from ps -e command and then run the following:

ps x | grep <process-id>
share|improve this answer
    
Won't that fail if an application edits argv[0]? iirc sendmail does that. –  Folkert van Heusden Dec 29 '11 at 13:14
    
Yes, it is a probability. None the less this comes handy almost every time. –  Aditya Patawari Dec 29 '11 at 13:22
add comment

None of the methods (ls, lsof or cat) in the other answers work for me. If I do:

$ nano test.txt

This is my winner,:

$ pgrep -f -l test
3074 nano test.txt

Or, in order to obtain only the PID to use it in programming:

$ pgrep -f test
3074

Tested on Kali Linux v1.0.6 (Debian based).
Compared to a simple ls, I must admit it is not a so portable solution, but at least it works.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.