How to identify executable path with its PID on AIX 5 or more

Ok so here's my answers to my questions.

  • First: Can I assume that the path of the proftpd is the first I'll find typing whereis as root ?
    ==> NO, at least with my experience it shows no reliable information to determine the process executable path.

  • Second: How to determine executable path of a running process ?
    I found a stackoverflow topic that state this possibility which is so far the only one that showed me the correct answer:
    svmon -P <PID> -O format=nolimit,filename=on,filtertype=client
    Problem with this command is that you have to wait until it shows you the information you want but it will probably give you the answer after a while. Another problem is that, this method can't be use in a script.

  • Third: Concerning the "Why ps -ef is not showing neither a full nor a relative path"
    The answer is probably (but feel free to correct me) that it shows the actual command typed by the user so if root was in a folder containing proftpd then it will only show proftpd
    No idea so far.

That's so far the best answer I can came up with.


Edit 1:

Scriptable way of finding the path of a running executable (this method doesn't come from me but from an no longer online forum). Note that I will not provide a script because it's way over my capabilities and I have not the time right now.

  • First step is to get the inode of your executable binary

    ls -i /proc/<PID>/object/a.out  |  cut -f 1 -d " "
    

    This command will output a number.

  • Then you need to identify the device on which your file is for that take a look at that command:

    ls -li /proc/<PID>/object/ | egrep "<inode>$"
    

    This command while give you a name of file like this : jfs2.51.3.<inode>. jfs2 is the filesystem type, 51 the major device number and 3 the minor device number.

  • Once you identify the device info we need to identify the block device where the file is located with the following command :

    ls -l /dev/ | egrep "^b.*51, *3.+$"  
    

    ^b.*51, *3.+$ ^b is used to match block device
    51, *3 matches the major block 51 followed by a comma and any space and minor block number 3 find previously.
    This command while give you something like :
    brw-rw---- 1 root system 51, 3 24 feb 2009 myfilesystem

  • You can then identify the mount point of your block like this :

    df | grep myfilesystem
    /dev/myfilesystem     31457280    144544  100%   107442    81% /opts
    
  • You now know where you need to search your number:

    find /opts -inum <inode>
    

I admit this method is a bit complicated but it's the only one so far I found that is "easily scriptable". If someone ever write a script I'd glad to read it.


getPathByPid()
{
    if [[ -e /proc/$1/object/a.out ]]; then
        inode=`ls -i /proc/$1/object/a.out 2>/dev/null | awk '{print $1}'`
        if [[ $? -eq 0 ]]; then
            strnode=${inode}"$"
            strNum=`ls -li /proc/$1/object/ 2>/dev/null | grep $strnode | awk '{print $NF}' | grep "[0-9]\{1,\}\.[0-9]\{1,\}\."`
            if [[ $? -eq 0 ]]; then
                # jfs2.10.6.5869
                n1=`echo $strNum|awk -F"." '{print $2}'`
                n2=`echo $strNum|awk -F"." '{print $3}'`
                # brw-rw----    1 root     system       10,  6 Aug 23 2013  hd9var
                strexp="^b.*"$n1,"[[:space:]]\{1,\}"$n2"[[:space:]]\{1,\}.*$"   # "^b.*10, \{1,\}5 \{1,\}.*$"
                strdf=`ls -l /dev/ | grep $strexp | awk '{print $NF}'`
                if [[ $? -eq 0 ]]; then
                    strMpath=`df | grep $strdf | awk '{print $NF}'`
                    if [[ $? -eq 0 ]]; then
                        find $strMpath -inum $inode 2>/dev/null
                        if [[ $? -eq 0 ]]; then
                            return 0
                        fi
                    fi
                fi
            fi
        fi
    fi
    return 1
}

Tags:

Path

Ps

Aix