How do I determine the path to a binary of a process?

Question

Is there a way to find out the directory/disk location a process was started from? I am aware of the /proc mount but not really where to look inside of it.

Do you mean the location of the binary, or the directory from which a process started? — Lekensteyn, Jun 16 '11 at 10:59

Egil · Accepted Answer · 2011-06-16T11:07:28.133

49

The /proc way would be to inspect the exe link in the directory corresponding to the pid.

Let's take an example with update-notifier:

Find the pid, which is 15421 in this example:

egil@gud:~$ ps x | grep update-notifier
 2405 pts/4    S+     0:00 grep update-notifier
15421 ?        Sl     0:00 update-notifier

Look up the symbolic link:

egil@gud:~$ file /proc/15421/exe
/proc/15421/exe: symbolic link to `/usr/bin/update-notifier'

edited Jun 16 '11 at 11:07

answered Jun 16 '11 at 10:56

Egil

14,162

Oh yeah, I was almost there. Legend, thank you. – SuperJumbo Jun 16 '11 at 11:11
1

To do this in a shell script (to find the path to your shell binary; not the script's path) you can run readlink /proc/${$}/exe - to make sure it's not a symlink, you can do readlink -f instead. Just remember that readlink isn't really a "POSIX" standard command. parsing file might work but I'm not sure if its output is strictly standardized. Should work on systems with GNU coreutils, though (most of them). – Wyatt Ward Jan 06 '21 at 22:11
I'm getting /proc/24076/exe: broken symbolic link to /newroot/app/bin/slade What does that mean? – Mark Jeronimus Aug 28 '21 at 11:27

score 18 · Answer 2 · answered Jun 16 '11 at 10:51

18

Maybe which is what you are looking for. For instance, on my system

which firefox

returns

/usr/bin/firefox

See also Find Path of Application Running on Solaris, Ubuntu, Suse or Redhat Linux .

answered Jun 16 '11 at 10:51

N.N.

18,219

6

which is cool, but it only returns programs in your $PATH. If I run RandomProgramIDownloadedToErisKnowsWhere.bin, this won't be of much use. – djeikyb Jun 16 '11 at 11:02

Lekensteyn · Answer 3 · 2011-06-16T11:03:12.983

8

Providing you've a process ID available, you can use:

readlink -f /proc/$pid/exe

(replace $pid by the process ID of a process)

If the process is not owned by you, you'll have to put sudo in front of it.

An example for determining the location of the command firefox:

The output of ps ax -o pid,cmd | grep firefox :

22831 grep --color=auto firefox
28179 /usr/lib/firefox-4.0.1/firefox-bin

28179 is the process ID, so you've to run:
```
readlink -f /proc/28179/exe
```
which outputs:
```
/usr/bin/firefox
```

edited Jun 16 '11 at 11:03

answered Jun 16 '11 at 10:57

Lekensteyn

174,277

2

You can do cool things with /proc/$pid/exe, if the binary is accidentally deleted, you can restore it with: dd if=/proc/$pid/exe of=restored-binary – Lekensteyn Jun 16 '11 at 11:05

score 1 · Answer 4 · edited Jul 04 '18 at 17:05

1

Press Ctrl+Alt+T to go to a terminal and type:

ls -al /proc/{pid}/fd

and then check the output

This will list all the files your process is associated with...

edited Jul 04 '18 at 17:05

Fabby

34,259

answered Jul 04 '18 at 05:24

xiaoyifang

957

Could you please review my edits and also review the editing help to improve the readability of your answers in the future... ;-) – Fabby Jul 04 '18 at 17:05

score 1 · Answer 5 · answered Feb 14 '19 at 16:04

All the commands in the other answers are good, but you could do even more - seeing how some process has been actually run before it got to the process list.

Run in terminal:

top

And while it is running, press keyboard C and you will get a command of the processes that was run.

How do I determine the path to a binary of a process?

5 Answers5