Is there a way to find out the directory/disk location a process was started from? I am aware of the /proc mount but not really where to look inside of it.
25 Answers
The /proc way would be to inspect the exe link in the directory corresponding to the pid.
Let's take an example with update-notifier:
Find the pid, which is 15421 in this example:
egil@gud:~$ ps x | grep update-notifier 2405 pts/4 S+ 0:00 grep update-notifier
15421 ? Sl 0:00 update-notifierLook up the symbolic link:
egil@gud:~$ file /proc/15421/exe
/proc/15421/exe: symbolic link to `/usr/bin/update-notifier'Maybe which is what you are looking for. For instance, on my system
which firefox returns
/usr/bin/firefoxSee also Find Path of Application Running on Solaris, Ubuntu, Suse or Redhat Linux .
1Providing you've a process ID available, you can use:
readlink -f /proc/$pid/exe(replace $pid by the process ID of a process)
If the process is not owned by you, you'll have to put sudo in front of it.
An example for determining the location of the command firefox:
The output of
ps ax -o pid,cmd | grep firefox:22831 grep --color=auto firefox 28179 /usr/lib/firefox-4.0.1/firefox-bin28179is the process ID, so you've to run:readlink -f /proc/28179/exewhich outputs:
/usr/bin/firefox
Press Ctrl+Alt+T to go to a terminal and type:
ls -al /proc/{pid}/fd and then check the output
This will list all the files your process is associated with...
1All the commands in the other answers are good, but you could do even more - seeing how some process has been actually run before it got to the process list.
Run in terminal:
topAnd while it is running, press keyboard C and you will get a command of the processes that was run.
