0

This question already has an answer here:

Given a certain PID, is it possible to discover what command-line executed this process?

top, atop, ps provide real time informations, I'm looking for something whereby I can look the past, because I've seen a process taking many resources of the machine, I've killed it, but now I want to know more about it

marked as duplicate by Gilles, cuonglm, G-Man, Archemar, garethTheRed Nov 1 '15 at 8:40

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • On systems with /proc the "directory" for the PID usually has a cmdline or such "file" inside – vonbrand Nov 1 '15 at 0:21
1

In the general classic sense, no, it's not possible to discover that information by PID. For one thing, PIDs wrap at 64k. There may be other security packages or loggers that would retain this information.

Not the answer you're looking for? Browse other questions tagged or ask your own question.