4

If I have output from ps like the following, is there any way to determine where 'blah' is on the file system? For my particular situation, the -p specifies which port the application should run on.

user 22913 22470  0 09:58 ?        00:00:06 ./blah -p 12345

My question is basically whether or not it is possible to find the location of an executable given the PID or port of the application. The distro being used is Redhat.

4 Answers 4

6

Do any of these give information?

ps -ef

ps -eLf

ps axms

Or maybe

ps -o cmd= -p $PID

This might be more useful:

readlink -f /proc/$PID/exe

?

5
  • readlink just echoes back what the input is on the system I'm using. The other commands give me back the ./blah instead of the /abc/def/blah I'm looking for.
    – bcasp
    Dec 18, 2009 at 16:20
  • What do you mean by the input the system is using? bsilver@desktop:~$ ps PID TTY TIME CMD 29626 pts/3 00:00:00 bash 29644 pts/3 00:00:00 ps bsilver@desktop:~$ readlink -f /proc/29626/exe /bin/bash bsilver@desktop:~$ Dec 18, 2009 at 16:26
  • Whoops didn't format that right...but it did show that ps was saying "bash" but readlink for that PID said /bin/bash is the executable path. Dec 18, 2009 at 16:26
  • The command I used was "readlink -f /proc/29626/exe" to get that pathname. Dec 18, 2009 at 16:27
  • Sorry. It was because the user I was logged on as didn't have permissions. readlink is exactly what I was looking for.
    – bcasp
    Dec 18, 2009 at 16:33
5

Like Bart suggested,

readlink -f /proc/$PID/exe

shoud give you your answer.

5

To build on the readlink stuff, another way might be readlink -f /proc/$PID/cwd. This will display the Current Working Directory of a process, which can be handy if you've executed a bash script, since the exe link is then /bin/bash, with an argument of ./blah.

And as a bit more random information, you can just cd to /proc/$PID. There will be symlinks for cwd and exe, as mentioned, as well as where that processes root directory is (useful if chrooted) ls -l will show where these are pointing, which is essentially what readlink is doing.

0
sudo /usr/sbin/lsof -p 22913

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .