If I can see a process running using
ps -e, how can I find the file which launched it?
On Linux: if you know the PID, you can cat the cmdline file for that file. E.g.:
This will probably fail if the binary was moved after the program was started.
And of course:
lsof -n | grep PID | grep ' txt '
ls -la /proc/PID/exe
which is a symbolic link to the executable.
None of the methods (
cat) in the other answers work for me.
If I do:
$ nano test.txt
This is my winner,:
$ pgrep -f -l test 3074 nano test.txt
Or, in order to obtain only the PID to use it in programming:
$ pgrep -f test 3074
Tested on Kali Linux v1.0.6 (Debian based).
Compared to a simple
ls, I must admit it is not a so portable solution, but at least it works.