If I see a process running using ps, how can I find the executable?

Question

If I can see a process running using ps -e, how can I find the file which launched it?

Folkert van Heusden · Answer 1 · 2011-12-29 13:46:29Z

up vote 9 down vote

On Linux: if you know the PID, you can cat the cmdline file for that file. E.g.:

cat /proc/PID/cmdline

This will probably fail if the binary was moved after the program was started.

And of course:

lsof -n | grep PID | grep ' txt '

and:

ls -la /proc/PID/exe

which is a symbolic link to the executable.

edited Dec 29 '11 at 13:46

answered Dec 29 '11 at 13:01

Folkert van Heusden
436110

	Note that `/proc/PID/cmdline` doesn't have a newline character, so you'll probably want to do something like `cat /proc/PID/cmdline ; echo ''`. – Keith Thompson Dec 30 '11 at 0:56
	Actually, it has NUL characters separating the arguments, so you might want something even more elaborate like `tr '\0' ' ' < /proc/PID/cmdline ; echo ''` – Keith Thompson Dec 30 '11 at 1:00

Aditya Patawari · Answer 2 · 2011-12-29 13:12:12Z

up vote 1 down vote

Copy the process id from ps -e command and then run the following:

ps x | grep <process-id>

answered Dec 29 '11 at 13:12

Aditya Patawari
656111

	Won't that fail if an application edits argv[0]? iirc sendmail does that. – Folkert van Heusden Dec 29 '11 at 13:14
	Yes, it is a probability. None the less this comes handy almost every time. – Aditya Patawari Dec 29 '11 at 13:22

2 Answers