Authors Top

If you have a few years of experience in the Linux ecosystem, and you’re interested in sharing that experience with the community, have a look at our Contribution Guidelines.

1. Overview

In this tutorial, we’ll discuss how to find the path of a process in Linux. As we know, each process has a unique PID. We can use that PID to get the path of any process.

2. Finding the PID

We can get the PID of a process with the help of the ps command.

Let’s start an editor process and get its PID using the ps command:

$ gedit test.c 
$ ps aux
USER      PID   %CPU  %MEM      VSZ    RSS   TTY   STAT  START  TIME  COMMAND
...      ...     ...   ...     ...    ...    ...   ...    ...   ...     ...
HARDIK  10899    2.3   1.3   797076  42716 pts/1    Sl   01:49  0:00  gedit test.c
...      ...     ...   ...     ...    ...    ...   ...    ...   ...     ...

Here, the ps command with option a lists all the processes for all users. We can see the user of the process by adding an option u. Moreover, option x will include processes without a controlling terminal. However, issuing this command may print lots of lines of data regarding processes.

Thus, from the above output, we can see that the PID of our newly created process is 10899. We will use this PID to get the desired information.

Moreover, we can use the ps command in combination with the grep command to list our process using its name:

$ ps aux | grep gedit
HARDIK  10899    2.3   1.3   797076  42716 pts/1    Sl   01:49  0:00  gedit test.c

3. Finding the Process Path

Information about processes is stored under the /proc directory, also called the proc filesystem. In this directory, each process stores its data in a sub-directory named after its PID.

If we list the directories in our proc file system, we see lots of directories named as numbers. These are nothing but PIDs of processes:

$ ls /proc
1     11772  1400  174   199   219   245  283  320  359  397  46    650  85   interrupts
10    11773  141   175   1991  22    246  284  321  36   398  47    651  86   iomem
100   11780  142   1754  2     220   247  285  322  360  399  48    652  87   ioports
101   118    143   1755  20    221   248  286  323  361  40   486   653  878  irq
102   119    144   1756  200   222   249  287  324  362  400  49    654  879  kallsyms
...   ...    ...   ...   ...   ...   ...  ...  ...  ...  ...  ...   ...  ...  ...

Furthermore, if we list the content of the directory named after the PID of the process we created earlier, we can see a few directories and symbolic links:

$ ls -a /proc/10899/
.          clear_refs       environ  latency    mountinfo   oom_adj        root       stat     uid_map
..         cmdline          exe      limits     mounts      oom_score      sched      statm    wchan
attr       comm             fd       loginuid   mountstats  oom_score_adj  schedstat  status
autogroup  coredump_filter  fdinfo   map_files  net         pagemap        sessionid  syscall
auxv       cpuset           gid_map  maps       ns          personality    smaps      task
cgroup     cwd              io       mem        numa_maps   projid_map     stack      timers

A symbolic link is a file that contains a text string in the form of a path that references another file or directory. Among these, the symbolic link exe contains the actual pathname of the executed command. We can get the path of our process by reading this symbolic link.

Next, we will see different ways to get the path of the process using its PID and symbolic link.

The readlink command displays the value of resolved symbolic links or canonical file names.

Here, when we read the exe symbolic link, it returns the path of the gedit executable:

$ readlink /proc/10899/exe
/usr/bin/gedit

Therefore, from the above output, it’s clear that the editor has been executed from the /usr/bin/ directory.

Additionally, we can use the verbose option(v) to list error messages, if any. For example, if we have entered the wrong PID, which does not exist, it displays an error message:

$ readlink -v /proc/10890/exe
readlink: /proc/10890/exe: No such file or directory

Alternatively, we can use the realpath command. This command prints the resolved path for the given symbolic link:

$ realpath /proc/10899/exe
/usr/bin/gedit

We can also use the ls command, which lists the directory content. By using ls in combination with the long listing option (l), we can know the path of the process:

$ ls -l /proc/10899/exe
lrwxrwxrwx 1 HARDIK users 0 Feb 23 01:49 /proc/10899/exe -> /usr/bin/gedit

4. Conclusion

In this article, we discussed how to get the path of a process from its PID in Linux. We saw that using the ps command we can get the PID of the process, and the exe symbol link of that PID gives us the path of that process.

Authors Bottom

If you have a few years of experience in the Linux ecosystem, and you’re interested in sharing that experience with the community, have a look at our Contribution Guidelines.

Comments are closed on this article!