Is there a way to find out the directory/disk location a process was started from? I am aware of the /proc mount but not really where to look inside of it.
5 Answers
The /proc
way would be to inspect the exe
link in the directory corresponding to the pid.
Let's take an example with update-notifier
:
Find the pid, which is 15421 in this example:
egil@gud:~$ ps x | grep update-notifier
2405 pts/4 S+ 0:00 grep update-notifier
15421 ? Sl 0:00 update-notifier
Look up the symbolic link:
egil@gud:~$ file /proc/15421/exe
/proc/15421/exe: symbolic link to `/usr/bin/update-notifier'
-
-
1To do this in a shell script (to find the path to your shell binary; not the script's path) you can run
readlink /proc/${$}/exe
- to make sure it's not a symlink, you can doreadlink -f
instead. Just remember that readlink isn't really a "POSIX" standard command. parsingfile
might work but I'm not sure if its output is strictly standardized. Should work on systems with GNU coreutils, though (most of them). Jan 6, 2021 at 22:11 -
I'm getting
/proc/24076/exe: broken symbolic link to /newroot/app/bin/slade
What does that mean? Aug 28, 2021 at 11:27
Maybe which
is what you are looking for. For instance, on my system
which firefox
returns
/usr/bin/firefox
See also Find Path of Application Running on Solaris, Ubuntu, Suse or Redhat Linux .
-
6
which
is cool, but it only returns programs in your $PATH. If I runRandomProgramIDownloadedToErisKnowsWhere.bin
, this won't be of much use.– djeikybJun 16, 2011 at 11:02
Providing you've a process ID available, you can use:
readlink -f /proc/$pid/exe
(replace $pid
by the process ID of a process)
If the process is not owned by you, you'll have to put sudo
in front of it.
An example for determining the location of the command firefox
:
The output of
ps ax -o pid,cmd | grep firefox
:22831 grep --color=auto firefox 28179 /usr/lib/firefox-4.0.1/firefox-bin
28179
is the process ID, so you've to run:readlink -f /proc/28179/exe
which outputs:
/usr/bin/firefox
-
2You can do cool things with
/proc/$pid/exe
, if the binary is accidentally deleted, you can restore it with:dd if=/proc/$pid/exe of=restored-binary
Jun 16, 2011 at 11:05
Press Ctrl+Alt+T to go to a terminal and type:
ls -al /proc/{pid}/fd
and then check the output
This will list all the files your process is associated with...
-
Could you please review my edits and also review the editing help to improve the readability of your answers in the future... ;-)– FabbyJul 4, 2018 at 17:05
All the commands in the other answers are good, but you could do even more - seeing how some process has been actually run before it got to the process list.
Run in terminal:
top
And while it is running, press keyboard C
and you will get a command of the processes that was run.