30

Is there a way to find out the directory/disk location a process was started from? I am aware of the /proc mount but not really where to look inside of it.

  • 1
    Do you mean the location of the binary, or the directory from which a process started? – Lekensteyn Jun 16 '11 at 10:59
  • Sorry for the ambiguity, I mean the binary – SuperJumbo Jun 16 '11 at 11:11
37

The /proc way would be to inspect the exe link in the directory corresponding to the pid.

Let's take an example with update-notifier:

Find the pid, which is 15421 in this example:

egil@gud:~$ ps x | grep update-notifier
 2405 pts/4    S+     0:00 grep update-notifier
15421 ?        Sl     0:00 update-notifier

Look up the symbolic link:

egil@gud:~$ file /proc/15421/exe
/proc/15421/exe: symbolic link to `/usr/bin/update-notifier'
  • Oh yeah, I was almost there. Legend, thank you. – SuperJumbo Jun 16 '11 at 11:11
15

Maybe which is what you are looking for. For instance, on my system

which firefox 

returns

/usr/bin/firefox

See also Find Path of Application Running on Solaris, Ubuntu, Suse or Redhat Linux .

  • 6
    which is cool, but it only returns programs in your $PATH. If I run RandomProgramIDownloadedToErisKnowsWhere.bin, this won't be of much use. – djeikyb Jun 16 '11 at 11:02
6

Providing you've a process ID available, you can use:

readlink -f /proc/$pid/exe

(replace $pid by the process ID of a process)

If the process is not owned by you, you'll have to put sudo in front of it.

An example for determining the location of the command firefox:

  1. The output of ps ax -o pid,cmd | grep firefox :

    22831 grep --color=auto firefox
    28179 /usr/lib/firefox-4.0.1/firefox-bin
    
  2. 28179 is the process ID, so you've to run:

    readlink -f /proc/28179/exe
    

    which outputs:

    /usr/bin/firefox
    
  • 2
    You can do cool things with /proc/$pid/exe, if the binary is accidentally deleted, you can restore it with: dd if=/proc/$pid/exe of=restored-binary – Lekensteyn Jun 16 '11 at 11:05
1

Press Ctrl+Alt+T to go to a terminal and type:

ls -al /proc/{pid}/fd  

and then check the output

This will list all the files your process is associated with...

  • Could you please review my edits and also review the editing help to improve the readability of your answers in the future... ;-) – Fabby Jul 4 '18 at 17:05
0

All the commands in the other answers are good, but you could do even more - seeing how some process has been actually run before it got to the process list.

Run in terminal:

top

And while it is running, press keyboard C and you will get a command of the processes that was run.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.