359

If I have the PID number for a process (on a UNIX machine), how can I find out the name of its associated process?

What do I have to do?

Improve this question
4
  • 9
    You can use ps or ls -l /proc/$PID/exe
    – Eddy_Em
    Commented Aug 17, 2013 at 7:25
  • 1
    @Eddy_Em that'll give you the executable file, which isn't always the process name. Also, that's not portable...
    – derobert
    Commented Aug 21, 2013 at 21:44
  • 11
    ps -fp PID will show full command
    – Temak
    Commented Nov 4, 2016 at 0:10
  • readlink /proc/$PID/exe
    – Pedro Lobito
    Commented May 22, 2020 at 16:21

11 Answers 11

Reset to default
398

On all POSIX-compliant systems, and with Linux, you can use ps:

ps -p 1337 -o comm=

Here, the process is selected by its PID with -p. The -o option specifies the output format, comm meaning the command name.

For the full command, not just the name of the program, use:

ps -p 1337 -o command

See also: ps – The Open Group Base Specifications Issue 6

Improve this answer
3
  • 40
    comm seems to truncate the command to 15 characters. Using command instead fixes it.
    – Nemo
    Commented Aug 15, 2014 at 17:10
  • 1
    [Ubuntu 14.04.4 LTS] $ ps -p 1 -o comm= init $ ps -p 1 -o command= /sbin/init; which means it is not about 15 characters, maybe just the binary's name vs. its full path.
    – OmarOthman
    Commented Jul 23, 2016 at 9:48
  • 4
    Actually, comm gives the binary's name and command returns argument 0
    – robbie
    Commented Jan 1, 2017 at 22:04
64

You can find the process name or the command used by the process-id or pid from

/proc/<pid>/cmdline

by doing 

cat /proc/<pid>/cmdline

Here pid is the pid for which you want to find the name
For example:

 # ps aux

   ................
   ................
   user  2480  0.0  1.2 119100 12728 pts/0  Sl   22:42   0:01 gnome-terminal
   ................
   ................

To find the process name used by pid 2480 you use can 

# cat /proc/2480/cmdline 

 gnome-terminal
Improve this answer
2
  • 15
    Be careful: The OP mentions UNIX. Not all UNIXes implement the Plan 9 like process-specific file. Your answer generally only applies to Linux.
    – slhck
    Commented Aug 17, 2013 at 8:08
  • 7
    Whilst that's true, they did tag the question "linux". Anyone who is using a non-Linux based UNIX OS will be quite used to having to modify answers to fit their needs
    – Andrew White
    Commented May 9, 2017 at 3:33
21

To get the path of of the program using a certain pid you can use:

ps ax|egrep "^ [PID]"

enter image description here

alternatively you can use:

ps -a [PID]

Or also: 

readlink /proc/[PID]/exe
Improve this answer
2
  • 1
    ps -a list all the processes that is associated with the terminal, it doesn't take any input.
    – Mike Lee
    Commented Mar 10, 2016 at 18:30
  • 1
    @MichaelLee I guess it depenends on the ps version, on procps version 3.2.7 works fine.
    – Pedro Lobito
    Commented May 27, 2017 at 13:11
14

You can use pmap. I am searching for PID 6649. And cutting off the extra process details.

$ pmap 6649 | head -1
6649:   /usr/lib64/firefox/firefox
Improve this answer
1
  • This command helped me more than I needed, I have the full line of the process that started. Given a Java process, with the ps command all you'll see is just java, but the rest of parameters passed will be displayed fully with pmap.
    – Daniel Andrei Mincă
    Commented Aug 31, 2018 at 7:21
9 
# ls -la /proc/ID_GOES_HERE/exe

Example:

# ls -la /proc/1374/exe
lrwxrwxrwx 1 chmm chmm 0 Mai  5 20:46 /proc/1374/exe -> /usr/bin/telegram-desktop
Improve this answer
4
  • This one is perfect.
    – jayarjo
    Commented Nov 17, 2016 at 17:58
  • 3
    Probably better: readlink /proc/1337/exe. readlink - print resolved symbolic links or canonical file names.
    – Pablo A
    Commented Mar 6, 2018 at 0:58
  • Some one commented on the question that the executable name is not always the process name, e.g. gunicorn or nginx. Some processes will change it at runtime with setprocname
    – ttimasdf
    Commented Nov 26, 2019 at 2:44
  • However if I want the executable name, this /proc way is perfect.
    – ttimasdf
    Commented Nov 26, 2019 at 2:45
4

You can Also use awk in combination with ps 

ps aux | awk '$2 == PID number for a process  { print $0 }'

example: 

root@cprogrammer:~# ps aux | awk '$2 == 1 { print $0 }'
root         1  0.0  0.2  24476  2436 ?        Ss   15:38   0:01 /sbin/init

to print HEAD LINE you can use 

 ps --headers aux |head -n 1 && ps aux | awk '$2 == 1 { print $0 }'

                 (or) 

 ps --headers aux |head -n 1; ps aux | awk '$2 == 1 { print $0 }'


root@cprogrammer:~# ps --headers aux |head -n 1 && ps aux | awk '$2 == 1 { print $0 }'
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.2  24476  2436 ?        Ss   15:38   0:01 /sbin/init
Improve this answer
3
  • 2
    This is unstable since it'd also select processes that happen to include the number anywhere in their command. Try ps ax | grep 1 and see whether it really returns the init process, for example. (In my case, it returns 119 lines—not desirable.)
    – slhck
    Commented Aug 17, 2013 at 9:41
  • 1
    @slhck Modified the answer... thanks for info.. ps -p 1 -o comm= is best option for this question.
    – Gangadhar
    Commented Aug 17, 2013 at 11:07
  • We don't need two runs to retain headers, instead use ps aux | awk 'NR==1 || $2==PID' -- and don't need to say {print $0} because it's the default. But as you commented, -p is better anyway.
    – dave_thompson_085
    Commented May 6, 2016 at 4:38
3

Simmilar to slhck's Answer, but relying on file operations instead of command invocations:

MYPID=1
cat "/proc/$MYPID/comm"
Improve this answer
1
  • [Ubuntu 14.04.4 LTS] cat /proc/1/comm => init, not /sbin/init. His answer has the longer version included. But +1 anyway.
    – OmarOthman
    Commented Jul 23, 2016 at 22:17
3

Surprisingly, no one has mentioned the -f (full command) option for ps. I like to use it with -e (everything) and pipe the results to grep so I can narrow my search.

ps -ef | grep <PID>

This is also very useful for looking at full commands that someone is running that are taking a lot of resources on your system. This will show you the options and arguments passed to the command.

Improve this answer
1
  • 3
    Doesn't work on BSD (maybe including MacOSX? I'm not sure). Even where -e -f are available, grep can produce many false matches e.g. grep 33 includes pid=933 or 339, ppid=33 or 933 or 339, timeused of 33 seconds or 33 minutes, or programname or argument containing 33 -- including the grep itself. All (AFAIK) ps do have -p, so just ps -fp 33.
    – dave_thompson_085
    Commented May 6, 2016 at 4:41
0

I find the easiest method to be with the following command:

ps -awxs | grep pid
Improve this answer
1
  • Apart from being highly inefficient compared to ps -p${pid}, this will pick up plenty of false positives - including the grep itself.
    – Toby Speight
    Commented Nov 22, 2016 at 16:55
0

If you want to see the path of the process by PID. You can use the pwdx command. The pwdx command reports the full path of the PID process.

$ pwdx 13896
13896: /home/user/python_program

Source: https://stackoverflow.com/a/63447358/6077264

Improve this answer
0

You can also use this command:

cat /proc/PID/comm

It also works without root.

Improve this answer
1
  • same answer was given 9 years ago !
    – Toto
    Commented Jul 12, 2022 at 17:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .