How to Find Process Name Using PID in Linux?

In the complex world of Linux, processes are the core of system operation, each identified by a unique “Process ID” (PID). Whether a system administrator is troubleshooting runaway processes or a developer is debugging an application, knowing how to map a PID to its corresponding process name is a fundamental skill.

Understanding PID and Process Name

“Process ID” (PID) is a unique numeric identifier assigned to each running process in a Linux system. The “Process Name” is typically the name of the executable file or command that started the process. For example, a web server process might have a PID like <span>1234</span> and a process name like <span>nginx</span>.

The ability to associate a PID with a process name is crucial in the following scenarios:

• “Troubleshooting”: Identifying which application is consuming excessive CPU or memory.
• “System Monitoring”: Tracking specific processes during system audits.
• “Security Management”: Detecting suspicious processes by verifying the consistency of process names with expected applications.

Linux provides a rich set of command-line tools and filesystem interfaces to achieve this mapping. Below, we will comprehensively explore these methods, starting with the most commonly used commands and gradually delving into advanced techniques.

Method 1: Using the <span>ps</span> Command

<span>ps</span> command is one of the most common tools in Linux for checking processes. It can display detailed information about running processes, including PID and process name.

Basic Usage

To find the process name for a specific PID, you can use the following command:

ps -p <PID> -o comm=

• “<span>-p <PID></span>“: Specifies the PID of the process to check.
• “<span>-o comm=</span>“: Selects the command name (process name) and suppresses header output for a concise result.

Example: Suppose you want to find the process name for PID <span>873</span>:

ps -p 873 -o comm=

The output might be:

This indicates that the process with PID <span>873</span> was started by <span>nginx</span>.

Extended Usage

If you need more information (such as full command line arguments), you can use the following format:

ps -p <PID> -o pid,comm,cmd

• “<span>-o pid,comm,cmd</span>“: Displays PID, process name, and full command line.

Example::

ps -p 873 -o pid,comm,cmd

The output might be:

Advanced Options

“List All Processes”: If you do not know the specific PID, you can list all processes and search:

ps aux

• <span>a</span>: Displays processes for all users.
• <span>u</span>: Displays detailed user-oriented format.
• <span>x</span>: Includes processes without a controlling terminal.

The output will include PID, user, CPU/memory usage, process name, etc.

“Filter Specific Processes”: Combine with <span>grep</span> to find processes containing a specific PID:

ps aux | grep 873

Method 2: Using <span>top</span> and <span>htop</span> Interactive Tools

<span>top</span> Command

<span>top</span> is an interactive process viewing tool that displays system process information in real-time.

1. Run:

top

1. Press <span>f</span> to enter the field management interface.
2. Select <span>PID</span> and <span>COMMAND</span> columns to ensure they are displayed.
3. Use the arrow keys to navigate, find the target PID, and view the corresponding process name.

“Find Specific PID”:

In <span>top</span>, press <span>t</span> to toggle display mode, then manually search for the PID, or specify it at startup:

top -p 873

<span>htop</span> Command

<span>htop</span> is an enhanced version of <span>top</span>, with a more user-friendly interface and mouse support.

Installation (if not already installed):

sudo apt install htop  # Debian/Ubuntu

sudo yum install htop  # CentOS/RHEL

Run:

htop

• Use the arrow keys or mouse to find the PID.
• Press <span>F4</span> to filter processes by PID.
• The corresponding process name will be displayed in the <span>COMMAND</span> column.

Method 3: Using the <span>/proc</span> Filesystem

The <span>/proc</span> filesystem in Linux provides low-level access to processes, with each PID corresponding to a directory <span>/proc/<PID></span>.

View Process Name

The process name is typically stored in the <span>/proc/<PID>/comm</span> file.

“Command”:

cat /proc/873/comm

“Output”:

Get More Information

“Full Command Line”: View <span>/proc/<PID>/cmdline</span>:

cat /proc/873/cmdline

The output might be:

Note: Fields are separated by null characters and may need to be processed with <span>tr</span>:

cat /proc/873/cmdline | tr '\0' ' '

“Status Information”: View <span>/proc/<PID>/status</span>:

head -n 1 /proc/873/status

Output:

Method 4: Using <span>pidof</span> and <span>pkill</span> for Reverse Lookup

<span>pidof</span> Command

<span>pidof</span> is typically used to find the PID corresponding to a process name, but can be combined with other tools to indirectly verify the process name.

Example: Suppose you suspect that PID <span>873</span> is <span>nginx</span>, you can check:

pidof nginx

If the output includes <span>873</span>, it confirms that this PID corresponds to <span>nginx</span>.

<span>pkill</span> Check

<span>pkill</span> can find and operate on processes based on their name. Use the <span>-l</span> option to list matching processes:

pkill -l nginx

This will display all <span>nginx</span> processes’ PIDs and names, indirectly verifying whether PID <span>873</span> belongs to <span>nginx</span>.

Method 5: Using <span>lsof</span> to Find Processes with Open Files

If you know a process has opened a certain file, you can use <span>lsof</span> to find it:

lsof -p 873

The output includes the process name (<span>COMMAND</span> column) and the opened file descriptors.

Example::

lsof -p 873 | head -n 1

Output:

COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF    NODE NAME
nginx    873 root  cwd    DIR  253,0     4096 131072 /etc/nginx

Method 6: Using <span>pmap</span> and <span>stat</span>

<span>pmap</span> Command

<span>pmap</span> displays the memory mapping of a process but also includes the process name:

pmap 873 | head -n 1

Output:

<span>stat</span> Command

<span>/proc/<PID>/stat</span> file contains process status information, including the name:

awk '{print $2}' /proc/873/stat

Output:

Method 7: Using System Monitoring Tools

<span>glances</span>

<span>glances</span> is a powerful system monitoring tool that displays a list of processes:

glances

In the interface, press <span>p</span> to sort by PID, find the target PID, and view the <span>COMMAND</span> column.

<span>nmon</span>

<span>nmon</span> provides similar functionality; run it after installation:

nmon

Press <span>t</span> to display the list of processes and find the PID.

Advanced Tips: Writing Scripts to Automate Lookup

To simplify repetitive tasks, you can write a Bash script:

#!/bin/bash

if [ -z "$1" ]; then
  echo "Please provide a PID"
  exit 1
fi

PID=$1

if [ -d "/proc/$PID" ]; then
  echo "Process Name: $(cat /proc/$PID/comm)"
  echo "Full Command: $(cat /proc/$PID/cmdline | tr '\0' ' ')"
else
  echo "PID $PID does not exist"
fi

Save it as <span>find_process.sh</span>, and grant execute permissions:

chmod +x find_process.sh

Run:

./find_process.sh 873

Output:

Process Name: nginx
Full Command: /usr/sbin/nginx -g daemon on; master_process on;

Important! Operations and Maintenance Discussion Group Open for External Access! Scan the code to add the editor’s WeChat, apply to join the group▲ Long press to join the group