Home / server / Questions / 345023
Accepted
brent
Asked: 2011-12-30 06:09:43 +0800 CST

How to track down the file a process is executed from on disk?

  • 772

I have a process being started on my server that appears to modify what ps/top sees, so I don't know the filename or the path of it since it's hiding it (it's a perl script). How can I track down where the file is on disk?

linux

2 Answers

  1. Best Answer

    Under /proc/<pid>/ there are various files which may help you find the culprit.

    • cmdline is the command line used to start the process (including parameters). Unfortunately, this is apparently also changed if the process modifies its own command line.
    • cwd is the working dir of the process, that might help as well
    • exe points to the running executable (however, for Perl scripts that will be the Perl interpreter, so might not be so helpful)
    • status contains various information. In particular, the parent process (Ppid) may be interesting; that will be the process that launched the script - might be helpful to find out who starts it.
    • under fd, you'll find the list of files the process has currently opened (as symlinks); that should help figure out what it does
    • 3

  2. On Linux you can check the /proc/[PID]/exe symlink, which points to the executable.

    • 1