If I can see a process running using ps -e, how can I find the file which launched it?
-
2What OS is this? Linux, BSD, Solaris...phemmer– phemmer2011-12-29 12:59:19 +00:00Commented Dec 29, 2011 at 12:59
-
linux ... but cross-unix solutions welcome.interstar– interstar2011-12-29 16:33:50 +00:00Commented Dec 29, 2011 at 16:33
Add a comment
|
3 Answers
On Linux: if you know the PID, you can cat the cmdline file for that file. E.g.:
cat /proc/PID/cmdline
This will probably fail if the binary was moved after the program was started.
And of course:
lsof -n | grep PID | grep ' txt '
and:
ls -la /proc/PID/exe
which is a symbolic link to the executable.
-
1Note that
/proc/PID/cmdlinedoesn't have a newline character, so you'll probably want to do something likecat /proc/PID/cmdline ; echo ''.Keith Thompson– Keith Thompson2011-12-30 00:56:33 +00:00Commented Dec 30, 2011 at 0:56 -
1Actually, it has NUL characters separating the arguments, so you might want something even more elaborate like
tr '\0' ' ' < /proc/PID/cmdline ; echo ''Keith Thompson– Keith Thompson2011-12-30 01:00:06 +00:00Commented Dec 30, 2011 at 1:00
Copy the process id from ps -e command and then run the following:
ps x | grep <process-id>
-
Won't that fail if an application edits argv[0]? iirc sendmail does that.Folkert van Heusden– Folkert van Heusden2011-12-29 13:14:57 +00:00Commented Dec 29, 2011 at 13:14
-
Yes, it is a probability. None the less this comes handy almost every time.Aditya Patawari– Aditya Patawari2011-12-29 13:22:50 +00:00Commented Dec 29, 2011 at 13:22
None of the methods (ls, lsof or cat) in the other answers work for me.
If I do:
$ nano test.txt
This is my winner,:
$ pgrep -f -l test
3074 nano test.txt
Or, in order to obtain only the PID to use it in programming:
$ pgrep -f test
3074
Tested on Kali Linux v1.0.6 (Debian based).
Compared to a simple ls, I must admit it is not a so portable solution, but at least it works.
answered Apr 10, 2014 at 15:06
Sopalajo de Arrierez
6,84121 gold badges65 silver badges106 bronze badges