39

Is there a way to find out the directory/disk location a process was started from? I am aware of the /proc mount but not really where to look inside of it.

2
  • 1
    Do you mean the location of the binary, or the directory from which a process started?
    – Lekensteyn
    Commented Jun 16, 2011 at 10:59
  • Sorry for the ambiguity, I mean the binary
    – SuperJumbo
    Commented Jun 16, 2011 at 11:11

5 Answers 5

49

The /proc way would be to inspect the exe link in the directory corresponding to the pid.

Let's take an example with update-notifier:

Find the pid, which is 15421 in this example:

egil@gud:~$ ps x | grep update-notifier
 2405 pts/4    S+     0:00 grep update-notifier
15421 ?        Sl     0:00 update-notifier

Look up the symbolic link:

egil@gud:~$ file /proc/15421/exe
/proc/15421/exe: symbolic link to `/usr/bin/update-notifier'
3
  • Oh yeah, I was almost there. Legend, thank you.
    – SuperJumbo
    Commented Jun 16, 2011 at 11:11
  • 1
    To do this in a shell script (to find the path to your shell binary; not the script's path) you can run readlink /proc/${$}/exe - to make sure it's not a symlink, you can do readlink -f instead. Just remember that readlink isn't really a "POSIX" standard command. parsing file might work but I'm not sure if its output is strictly standardized. Should work on systems with GNU coreutils, though (most of them).
    – Wyatt Ward
    Commented Jan 6, 2021 at 22:11
  • I'm getting /proc/24076/exe: broken symbolic link to /newroot/app/bin/slade What does that mean? Commented Aug 28, 2021 at 11:27
18

Maybe which is what you are looking for. For instance, on my system

which firefox 

returns

/usr/bin/firefox

See also Find Path of Application Running on Solaris, Ubuntu, Suse or Redhat Linux .

1
  • 6
    which is cool, but it only returns programs in your $PATH. If I run RandomProgramIDownloadedToErisKnowsWhere.bin, this won't be of much use.
    – djeikyb
    Commented Jun 16, 2011 at 11:02
8

Providing you've a process ID available, you can use:

readlink -f /proc/$pid/exe

(replace $pid by the process ID of a process)

If the process is not owned by you, you'll have to put sudo in front of it.

An example for determining the location of the command firefox:

  1. The output of ps ax -o pid,cmd | grep firefox :

    22831 grep --color=auto firefox
    28179 /usr/lib/firefox-4.0.1/firefox-bin
    
  2. 28179 is the process ID, so you've to run:

    readlink -f /proc/28179/exe
    

    which outputs:

    /usr/bin/firefox
    
1
  • 2
    You can do cool things with /proc/$pid/exe, if the binary is accidentally deleted, you can restore it with: dd if=/proc/$pid/exe of=restored-binary
    – Lekensteyn
    Commented Jun 16, 2011 at 11:05
1

Press Ctrl+Alt+T to go to a terminal and type:

ls -al /proc/{pid}/fd  

and then check the output

This will list all the files your process is associated with...

1
  • Could you please review my edits and also review the editing help to improve the readability of your answers in the future... ;-)
    – Fabby
    Commented Jul 4, 2018 at 17:05
1

All the commands in the other answers are good, but you could do even more - seeing how some process has been actually run before it got to the process list.

Run in terminal:

top

And while it is running, press keyboard C and you will get a command of the processes that was run.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .