For security reason you may need to find out current working directory of a process. You can obtained this information by visiting /proc/pid/cwd directory or using the pwdx command. It reports the current working directory of a process or processes.
Find out out working directory for a process
Run ps aux to find out PID of a process:
$ ps aux | grep {process-name}
To find out current working directory of a PID 13456:
$ pwdx 13456
Output:
13456: /tmp/.xy
Look like someone try to hide process (PID # 13456) /tmp/.xy directory. You can also run command:
$ ls -l /proc/13456/cwd
Output:
lrwxrwxrwx 1 apache apache 0 Nov 14 05:30 /proc/13456/cwd -> /tmp/.xy
Featured Articles:
- 20 Linux System Monitoring Tools Every SysAdmin Should Know
- 20 Linux Server Hardening Security Tips
- Linux: 20 Iptables Examples For New SysAdmins
- My 10 UNIX Command Line Mistakes
- 25 PHP Security Best Practices For Sys Admins
- The Novice Guide To Buying A Linux Laptop
- Top 5 Email Client For Linux, Mac OS X, and Windows Users
- Top 20 OpenSSH Server Best Security Practices
- Top 10 Open Source Web-Based Project Management Software
Facebook it - Tweet it - Print it -
We're here to help you make the most of sysadmin work. So, subscribe!
{ 3 comments… read them below or add one }
Great thing, I usually use lsof | grep whtaiwant. Thanks!
yup, lsof is a nifty tool for admins.
Hey Vivek,
You can add the lsof command for this as well.
# lsof -p 13456|more
The more option over here is to make sure you don’t run out to the next page as the current working directory will be displayed right at the top.