11

If I can see a process running using ps -e, how can I find the file which launched it?

  • 2
    What OS is this? Linux, BSD, Solaris... – Patrick Dec 29 '11 at 12:59
  • linux ... but cross-unix solutions welcome. – interstar Dec 29 '11 at 16:33
15

On Linux: if you know the PID, you can cat the cmdline file for that file. E.g.:

cat /proc/PID/cmdline

This will probably fail if the binary was moved after the program was started.

And of course:

lsof -n | grep PID | grep ' txt '

and:

ls -la /proc/PID/exe

which is a symbolic link to the executable.

  • 1
    Note that /proc/PID/cmdline doesn't have a newline character, so you'll probably want to do something like cat /proc/PID/cmdline ; echo ''. – Keith Thompson Dec 30 '11 at 0:56
  • Actually, it has NUL characters separating the arguments, so you might want something even more elaborate like tr '\0' ' ' < /proc/PID/cmdline ; echo '' – Keith Thompson Dec 30 '11 at 1:00
2

Copy the process id from ps -e command and then run the following:

ps x | grep <process-id>
  • Won't that fail if an application edits argv[0]? iirc sendmail does that. – Folkert van Heusden Dec 29 '11 at 13:14
  • Yes, it is a probability. None the less this comes handy almost every time. – Aditya Patawari Dec 29 '11 at 13:22
0

None of the methods (ls, lsof or cat) in the other answers work for me. If I do:

$ nano test.txt

This is my winner,:

$ pgrep -f -l test
3074 nano test.txt

Or, in order to obtain only the PID to use it in programming:

$ pgrep -f test
3074

Tested on Kali Linux v1.0.6 (Debian based).
Compared to a simple ls, I must admit it is not a so portable solution, but at least it works.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.