comm column and the first word of the
args column in the
ps output show the name of the executable program if everybody involved follows the default convention. However it is possible to have discrepancies for various reasons.
When a program starts, the command name as shown in the
args column is chosen by the parent program that executes the program and passed as an argument (
argv). By convention, the parent chooses the base name of the executable (i.e. the path to the executable without the directory part), but this is not enforced. Once the program is running, it can overwrite that string.
Init (at least the traditional Linux SysVinit) overwrites its
argv to indicate the current runlevel.
On Linux, the
comm column is initially filled in by the kernel to the first 16 characters of the base name of the executable. The process can change the content with the
prctl system call.
If the executable is renamed or deleted, neither the
comm column nor the
args column will reflect this.
ps doesn't display the path to the executable, that's not in its job description.
lsof can tell you with
lsof -a -p 1 -d txt.
On Linux, you can see this information in files in
- The process name (
comm field) in in
/proc/1/stat (second field in parentheses) and
- The path to the executable via
- The arguments (starting with
/proc/1/cmdline (the arguments are separated by null bytes).