357

If I have the PID number for a process (on a UNIX machine), how can I find out the name of its associated process?

What do I have to do?

4
  • 9
    You can use ps or ls -l /proc/$PID/exe
    – Eddy_Em
    Aug 17, 2013 at 7:25
  • 1
    @Eddy_Em that'll give you the executable file, which isn't always the process name. Also, that's not portable...
    – derobert
    Aug 21, 2013 at 21:44
  • 11
    ps -fp PID will show full command
    – Temak
    Nov 4, 2016 at 0:10
  • readlink /proc/$PID/exe May 22, 2020 at 16:21

11 Answers 11

395

On all POSIX-compliant systems, and with Linux, you can use ps:

ps -p 1337 -o comm=

Here, the process is selected by its PID with -p. The -o option specifies the output format, comm meaning the command name.

For the full command, not just the name of the program, use:

ps -p 1337 -o command

See also: ps – The Open Group Base Specifications Issue 6

3
  • 39
    comm seems to truncate the command to 15 characters. Using command instead fixes it.
    – Nemo
    Aug 15, 2014 at 17:10
  • 1
    [Ubuntu 14.04.4 LTS] $ ps -p 1 -o comm= init $ ps -p 1 -o command= /sbin/init; which means it is not about 15 characters, maybe just the binary's name vs. its full path.
    – OmarOthman
    Jul 23, 2016 at 9:48
  • 4
    Actually, comm gives the binary's name and command returns argument 0
    – robbie
    Jan 1, 2017 at 22:04
64

You can find the process name or the command used by the process-id or pid from

/proc/<pid>/cmdline

by doing

cat /proc/<pid>/cmdline

Here pid is the pid for which you want to find the name
For example:

 # ps aux

   ................
   ................
   user  2480  0.0  1.2 119100 12728 pts/0  Sl   22:42   0:01 gnome-terminal
   ................
   ................

To find the process name used by pid 2480 you use can

# cat /proc/2480/cmdline 

 gnome-terminal
2
  • 15
    Be careful: The OP mentions UNIX. Not all UNIXes implement the Plan 9 like process-specific file. Your answer generally only applies to Linux.
    – slhck
    Aug 17, 2013 at 8:08
  • 7
    Whilst that's true, they did tag the question "linux". Anyone who is using a non-Linux based UNIX OS will be quite used to having to modify answers to fit their needs May 9, 2017 at 3:33
20

To get the path of of the program using a certain pid you can use:

ps ax|egrep "^ [PID]"

enter image description here

alternatively you can use:

ps -a [PID]

Or also:

readlink /proc/[PID]/exe
2
  • 1
    ps -a list all the processes that is associated with the terminal, it doesn't take any input.
    – Mike Lee
    Mar 10, 2016 at 18:30
  • 1
    @MichaelLee I guess it depenends on the ps version, on procps version 3.2.7 works fine. May 27, 2017 at 13:11
14

You can use pmap. I am searching for PID 6649. And cutting off the extra process details.

$ pmap 6649 | head -1
6649:   /usr/lib64/firefox/firefox
1
  • This command helped me more than I needed, I have the full line of the process that started. Given a Java process, with the ps command all you'll see is just java, but the rest of parameters passed will be displayed fully with pmap. Aug 31, 2018 at 7:21
9
# ls -la /proc/ID_GOES_HERE/exe

Example:

# ls -la /proc/1374/exe
lrwxrwxrwx 1 chmm chmm 0 Mai  5 20:46 /proc/1374/exe -> /usr/bin/telegram-desktop
4
  • This one is perfect.
    – jayarjo
    Nov 17, 2016 at 17:58
  • 3
    Probably better: readlink /proc/1337/exe. readlink - print resolved symbolic links or canonical file names.
    – Pablo A
    Mar 6, 2018 at 0:58
  • Some one commented on the question that the executable name is not always the process name, e.g. gunicorn or nginx. Some processes will change it at runtime with setprocname
    – ttimasdf
    Nov 26, 2019 at 2:44
  • However if I want the executable name, this /proc way is perfect.
    – ttimasdf
    Nov 26, 2019 at 2:45
4

You can Also use awk in combination with ps

ps aux | awk '$2 == PID number for a process  { print $0 }'

example:

root@cprogrammer:~# ps aux | awk '$2 == 1 { print $0 }'
root         1  0.0  0.2  24476  2436 ?        Ss   15:38   0:01 /sbin/init    

to print HEAD LINE you can use

 ps --headers aux |head -n 1 && ps aux | awk '$2 == 1 { print $0 }'

                 (or) 

 ps --headers aux |head -n 1; ps aux | awk '$2 == 1 { print $0 }'


root@cprogrammer:~# ps --headers aux |head -n 1 && ps aux | awk '$2 == 1 { print $0 }'
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.2  24476  2436 ?        Ss   15:38   0:01 /sbin/init
3
  • 2
    This is unstable since it'd also select processes that happen to include the number anywhere in their command. Try ps ax | grep 1 and see whether it really returns the init process, for example. (In my case, it returns 119 lines—not desirable.)
    – slhck
    Aug 17, 2013 at 9:41
  • 1
    @slhck Modified the answer... thanks for info.. ps -p 1 -o comm= is best option for this question.
    – Gangadhar
    Aug 17, 2013 at 11:07
  • We don't need two runs to retain headers, instead use ps aux | awk 'NR==1 || $2==PID' -- and don't need to say {print $0} because it's the default. But as you commented, -p is better anyway. May 6, 2016 at 4:38
3

Simmilar to slhck's Answer, but relying on file operations instead of command invocations:

MYPID=1
cat "/proc/$MYPID/comm"
1
  • [Ubuntu 14.04.4 LTS] cat /proc/1/comm => init, not /sbin/init. His answer has the longer version included. But +1 anyway.
    – OmarOthman
    Jul 23, 2016 at 22:17
3

Surprisingly, no one has mentioned the -f (full command) option for ps. I like to use it with -e (everything) and pipe the results to grep so I can narrow my search.

ps -ef | grep <PID>

This is also very useful for looking at full commands that someone is running that are taking a lot of resources on your system. This will show you the options and arguments passed to the command.

1
  • 3
    Doesn't work on BSD (maybe including MacOSX? I'm not sure). Even where -e -f are available, grep can produce many false matches e.g. grep 33 includes pid=933 or 339, ppid=33 or 933 or 339, timeused of 33 seconds or 33 minutes, or programname or argument containing 33 -- including the grep itself. All (AFAIK) ps do have -p, so just ps -fp 33. May 6, 2016 at 4:41
0

I find the easiest method to be with the following command:

ps -awxs | grep pid
1
  • Apart from being highly inefficient compared to ps -p${pid}, this will pick up plenty of false positives - including the grep itself. Nov 22, 2016 at 16:55
0

If you want to see the path of the process by PID. You can use the pwdx command. The pwdx command reports the full path of the PID process.

$ pwdx 13896
13896: /home/user/python_program

Source: https://stackoverflow.com/a/63447358/6077264

0

You can also use this command:

cat /proc/PID/comm

It also works without root.

1
  • same answer was given 9 years ago !
    – Toto
    Jul 12, 2022 at 17:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .