How to identify executable path with its PID on AIX 5 or more
Ok so here's my answers to my questions.
First: Can I assume that the path of the proftpd is the first I'll find typing whereis as root ?
==> NO, at least with my experience it shows no reliable information to determine the process executable path.Second: How to determine executable path of a running process ?
I found a stackoverflow topic that state this possibility which is so far the only one that showed me the correct answer:
svmon -P <PID> -O format=nolimit,filename=on,filtertype=client
Problem with this command is that you have to wait until it shows you the information you want but it will probably give you the answer after a while. Another problem is that, this method can't be use in a script.Third: Concerning the "Why
ps -ef
is not showing neither a full nor a relative path"
The answer is probably (but feel free to correct me) that it shows the actual command typed by the user so ifroot
was in a folder containingproftpd
then it will only showproftpd
No idea so far.
That's so far the best answer I can came up with.
Edit 1:
Scriptable way of finding the path of a running executable (this method doesn't come from me but from an no longer online forum). Note that I will not provide a script because it's way over my capabilities and I have not the time right now.
First step is to get the inode of your executable binary
ls -i /proc/<PID>/object/a.out | cut -f 1 -d " "
This command will output a number.
Then you need to identify the device on which your file is for that take a look at that command:
ls -li /proc/<PID>/object/ | egrep "<inode>$"
This command while give you a name of file like this :
jfs2.51.3.<inode>
.jfs2
is the filesystem type,51
the major device number and3
the minor device number.Once you identify the device info we need to identify the block device where the file is located with the following command :
ls -l /dev/ | egrep "^b.*51, *3.+$"
^b.*51, *3.+$
^b
is used to match block device
51, *3
matches the major block51
followed by a comma and any space and minor block number3
find previously.
This command while give you something like :
brw-rw---- 1 root system 51, 3 24 feb 2009 myfilesystem
You can then identify the mount point of your block like this :
df | grep myfilesystem /dev/myfilesystem 31457280 144544 100% 107442 81% /opts
You now know where you need to search your number:
find /opts -inum <inode>
I admit this method is a bit complicated but it's the only one so far I found that is "easily scriptable". If someone ever write a script I'd glad to read it.
getPathByPid()
{
if [[ -e /proc/$1/object/a.out ]]; then
inode=`ls -i /proc/$1/object/a.out 2>/dev/null | awk '{print $1}'`
if [[ $? -eq 0 ]]; then
strnode=${inode}"$"
strNum=`ls -li /proc/$1/object/ 2>/dev/null | grep $strnode | awk '{print $NF}' | grep "[0-9]\{1,\}\.[0-9]\{1,\}\."`
if [[ $? -eq 0 ]]; then
# jfs2.10.6.5869
n1=`echo $strNum|awk -F"." '{print $2}'`
n2=`echo $strNum|awk -F"." '{print $3}'`
# brw-rw---- 1 root system 10, 6 Aug 23 2013 hd9var
strexp="^b.*"$n1,"[[:space:]]\{1,\}"$n2"[[:space:]]\{1,\}.*$" # "^b.*10, \{1,\}5 \{1,\}.*$"
strdf=`ls -l /dev/ | grep $strexp | awk '{print $NF}'`
if [[ $? -eq 0 ]]; then
strMpath=`df | grep $strdf | awk '{print $NF}'`
if [[ $? -eq 0 ]]; then
find $strMpath -inum $inode 2>/dev/null
if [[ $? -eq 0 ]]; then
return 0
fi
fi
fi
fi
fi
fi
return 1
}