Find out the full path of the program that runs when I enter a command

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP








up vote
0
down vote

favorite












I am looking for a reliable way to find out the location in the filesystem of the program that runs when I enter a command.



ps -ef gives me list of all currently running processes (-e means every ; -f means full list with relevant parameters).



So, to find the location of the uname program, I tried



grep `uname -n &` `ps -ef`


I'm trying to catch uname -n's process ID (PID) and forward it to grep, which should return the line which contains that PID, so I could see which command is running at the moment.



I know there are commands like tee, pipes... but I haven't succeeded in combining them to achieve my goal.



I suppose there is some shell function which returns stdout of called function, something like:



stdout(some__command)


so I could call:



grep stdout(uname -n &) stdout(ps -ef).


What am I missing here?










share|improve this question



















  • 2




    I think you misunderstood the meaning of backticks aka Command Substitution. `uname -n &` gets replaced by the output of that very command, i.e. by job started (or something similar).
    – PerlDuck
    Mar 18 at 17:50







  • 1




    Don't you really just want to know the commands that are called? If so asking for the PID just complicates the issue.
    – WinEunuuchs2Unix
    Mar 23 at 0:37







  • 1




    When you do foo &, bash prints the PID, to stderr, not the command foo. What are you trying to accomplish here? This sounds like an XY problem.
    – muru
    Mar 23 at 0:41






  • 1




    @Zanna Is this an XY problem where as the title says OP wants to know names of commands called but complicates the issue thinking it needs to be reverse engineered from PID's?
    – WinEunuuchs2Unix
    Mar 23 at 0:41






  • 2




    Possible duplicate of Shell command for outputting absolute path of binary
    – Olorin
    Mar 24 at 10:50














up vote
0
down vote

favorite












I am looking for a reliable way to find out the location in the filesystem of the program that runs when I enter a command.



ps -ef gives me list of all currently running processes (-e means every ; -f means full list with relevant parameters).



So, to find the location of the uname program, I tried



grep `uname -n &` `ps -ef`


I'm trying to catch uname -n's process ID (PID) and forward it to grep, which should return the line which contains that PID, so I could see which command is running at the moment.



I know there are commands like tee, pipes... but I haven't succeeded in combining them to achieve my goal.



I suppose there is some shell function which returns stdout of called function, something like:



stdout(some__command)


so I could call:



grep stdout(uname -n &) stdout(ps -ef).


What am I missing here?










share|improve this question



















  • 2




    I think you misunderstood the meaning of backticks aka Command Substitution. `uname -n &` gets replaced by the output of that very command, i.e. by job started (or something similar).
    – PerlDuck
    Mar 18 at 17:50







  • 1




    Don't you really just want to know the commands that are called? If so asking for the PID just complicates the issue.
    – WinEunuuchs2Unix
    Mar 23 at 0:37







  • 1




    When you do foo &, bash prints the PID, to stderr, not the command foo. What are you trying to accomplish here? This sounds like an XY problem.
    – muru
    Mar 23 at 0:41






  • 1




    @Zanna Is this an XY problem where as the title says OP wants to know names of commands called but complicates the issue thinking it needs to be reverse engineered from PID's?
    – WinEunuuchs2Unix
    Mar 23 at 0:41






  • 2




    Possible duplicate of Shell command for outputting absolute path of binary
    – Olorin
    Mar 24 at 10:50












up vote
0
down vote

favorite









up vote
0
down vote

favorite











I am looking for a reliable way to find out the location in the filesystem of the program that runs when I enter a command.



ps -ef gives me list of all currently running processes (-e means every ; -f means full list with relevant parameters).



So, to find the location of the uname program, I tried



grep `uname -n &` `ps -ef`


I'm trying to catch uname -n's process ID (PID) and forward it to grep, which should return the line which contains that PID, so I could see which command is running at the moment.



I know there are commands like tee, pipes... but I haven't succeeded in combining them to achieve my goal.



I suppose there is some shell function which returns stdout of called function, something like:



stdout(some__command)


so I could call:



grep stdout(uname -n &) stdout(ps -ef).


What am I missing here?










share|improve this question















I am looking for a reliable way to find out the location in the filesystem of the program that runs when I enter a command.



ps -ef gives me list of all currently running processes (-e means every ; -f means full list with relevant parameters).



So, to find the location of the uname program, I tried



grep `uname -n &` `ps -ef`


I'm trying to catch uname -n's process ID (PID) and forward it to grep, which should return the line which contains that PID, so I could see which command is running at the moment.



I know there are commands like tee, pipes... but I haven't succeeded in combining them to achieve my goal.



I suppose there is some shell function which returns stdout of called function, something like:



stdout(some__command)


so I could call:



grep stdout(uname -n &) stdout(ps -ef).


What am I missing here?







command-line






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Mar 23 at 13:22









Zanna

48.1k13120228




48.1k13120228










asked Mar 18 at 17:14









mk1024

134211




134211







  • 2




    I think you misunderstood the meaning of backticks aka Command Substitution. `uname -n &` gets replaced by the output of that very command, i.e. by job started (or something similar).
    – PerlDuck
    Mar 18 at 17:50







  • 1




    Don't you really just want to know the commands that are called? If so asking for the PID just complicates the issue.
    – WinEunuuchs2Unix
    Mar 23 at 0:37







  • 1




    When you do foo &, bash prints the PID, to stderr, not the command foo. What are you trying to accomplish here? This sounds like an XY problem.
    – muru
    Mar 23 at 0:41






  • 1




    @Zanna Is this an XY problem where as the title says OP wants to know names of commands called but complicates the issue thinking it needs to be reverse engineered from PID's?
    – WinEunuuchs2Unix
    Mar 23 at 0:41






  • 2




    Possible duplicate of Shell command for outputting absolute path of binary
    – Olorin
    Mar 24 at 10:50












  • 2




    I think you misunderstood the meaning of backticks aka Command Substitution. `uname -n &` gets replaced by the output of that very command, i.e. by job started (or something similar).
    – PerlDuck
    Mar 18 at 17:50







  • 1




    Don't you really just want to know the commands that are called? If so asking for the PID just complicates the issue.
    – WinEunuuchs2Unix
    Mar 23 at 0:37







  • 1




    When you do foo &, bash prints the PID, to stderr, not the command foo. What are you trying to accomplish here? This sounds like an XY problem.
    – muru
    Mar 23 at 0:41






  • 1




    @Zanna Is this an XY problem where as the title says OP wants to know names of commands called but complicates the issue thinking it needs to be reverse engineered from PID's?
    – WinEunuuchs2Unix
    Mar 23 at 0:41






  • 2




    Possible duplicate of Shell command for outputting absolute path of binary
    – Olorin
    Mar 24 at 10:50







2




2




I think you misunderstood the meaning of backticks aka Command Substitution. `uname -n &` gets replaced by the output of that very command, i.e. by job started (or something similar).
– PerlDuck
Mar 18 at 17:50





I think you misunderstood the meaning of backticks aka Command Substitution. `uname -n &` gets replaced by the output of that very command, i.e. by job started (or something similar).
– PerlDuck
Mar 18 at 17:50





1




1




Don't you really just want to know the commands that are called? If so asking for the PID just complicates the issue.
– WinEunuuchs2Unix
Mar 23 at 0:37





Don't you really just want to know the commands that are called? If so asking for the PID just complicates the issue.
– WinEunuuchs2Unix
Mar 23 at 0:37





1




1




When you do foo &, bash prints the PID, to stderr, not the command foo. What are you trying to accomplish here? This sounds like an XY problem.
– muru
Mar 23 at 0:41




When you do foo &, bash prints the PID, to stderr, not the command foo. What are you trying to accomplish here? This sounds like an XY problem.
– muru
Mar 23 at 0:41




1




1




@Zanna Is this an XY problem where as the title says OP wants to know names of commands called but complicates the issue thinking it needs to be reverse engineered from PID's?
– WinEunuuchs2Unix
Mar 23 at 0:41




@Zanna Is this an XY problem where as the title says OP wants to know names of commands called but complicates the issue thinking it needs to be reverse engineered from PID's?
– WinEunuuchs2Unix
Mar 23 at 0:41




2




2




Possible duplicate of Shell command for outputting absolute path of binary
– Olorin
Mar 24 at 10:50




Possible duplicate of Shell command for outputting absolute path of binary
– Olorin
Mar 24 at 10:50










1 Answer
1






active

oldest

votes

















up vote
5
down vote













If all you want to know is the command location



If you want to know what directory the top level command is stored in you have a number of options:



$ which uname
/bin/uname

$ type -a uname
uname is /bin/uname

$ locate uname
/bin/uname
(... SNIP dozens of Windows files on C & D ...)
/usr/lib/klibc/bin/uname
/usr/lib/plainbox-provider-resource-generic/bin/uname_resource
/usr/share/man/man1/uname.1.gz
/usr/share/man/man2/oldolduname.2.gz
/usr/share/man/man2/olduname.2.gz
/usr/share/man/man2/uname.2.gz


The last option locate returns all files containing uname not just the program that is run from the command prompt.



strace - trace system calls and interrupts



You don't need the pid of commands called in order to find the names of various commands that are called by a function. With strace all the command names are displayed directly.



For your uname -n example the output is:



$ strace uname -n
execve("/bin/uname", ["uname", "-n"], [/* 62 vars */]) = 0
brk(NULL) = 0x2356000
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, st_mode=S_IFREG) = 0
mmap(NULL, 109073, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ff2f9a9f000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "177ELF21133>1Pt2"..., 832) = 832
fstat(3, 0755, st_size=1868984, ...) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff2f9a9e000
mmap(NULL, 3971488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7ff2f94cb000
mprotect(0x7ff2f968b000, 2097152, PROT_NONE) = 0
mmap(0x7ff2f988b000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1c0000) = 0x7ff2f988b000
mmap(0x7ff2f9891000, 14752, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7ff2f9891000
close(3) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff2f9a9d000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff2f9a9c000
arch_prctl(ARCH_SET_FS, 0x7ff2f9a9d700) = 0
mprotect(0x7ff2f988b000, 16384, PROT_READ) = 0
mprotect(0x606000, 4096, PROT_READ) = 0
mprotect(0x7ff2f9aba000, 4096, PROT_READ) = 0
munmap(0x7ff2f9a9f000, 109073) = 0
brk(NULL) = 0x2356000
brk(0x2377000) = 0x2377000
open("/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
fstat(3, 0644, st_size=10219008, ...) = 0
mmap(NULL, 10219008, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ff2f8b0c000
close(3) = 0
uname(sysname="Linux", nodename="alien", ...) = 0
fstat(1, 0620, st_rdev=makedev(136, 2), ...) = 0
write(1, "alienn", 6alien
) = 6
close(1) = 0
close(2) = 0
exit_group(0) = ?
+++ exited with 0 +++


For more information refer to man strace:



STRACE(1) General Commands Manual STRACE(1)

NAME
strace - trace system calls and signals

SYNOPSIS
strace [-CdffhikqrtttTvVxxy] [-In] [-bexecve] [-eexpr]... [-acolumn] [-ofile] [-sstr‐
size] [-Ppath]... -ppid... / [-D] [-Evar[=val]]... [-uusername] command [args]

strace -c[df] [-In] [-bexecve] [-eexpr]... [-Ooverhead] [-Ssortby] -ppid... / [-D]
[-Evar[=val]]... [-uusername] command [args]

DESCRIPTION
In the simplest case strace runs the specified command until it exits. It intercepts
and records the system calls which are called by a process and the signals which are
received by a process. The name of each system call, its arguments and its return value
are printed on standard error or to the file specified with the -o option.

strace is a useful diagnostic, instructional, and debugging tool. System administra‐
tors, diagnosticians and trouble-shooters will find it invaluable for solving problems
with programs for which the source is not readily available since they do not need to be
recompiled in order to trace them. Students, hackers and the overly-curious will find
that a great deal can be learned about a system and its system calls by tracing even
ordinary programs. And programmers will find that since system calls and signals are
events that happen at the user/kernel interface, a close examination of this boundary is
very useful for bug isolation, sanity checking and attempting to capture race condi‐
tions.


Above is just the beginning of manpage for strace






share|improve this answer






















  • Thank you very much! I was trying to find out first line in strace uname -a command, and you were right that PID and grep just confuse folk.
    – mk1024
    Mar 23 at 2:43







  • 2




    @MilosKalicanin what exactly in the first line did you want to know? It would be great if we could clarify the question to help people find this useful answer. (PS If this answer helped you, you can upvote and/or accept it.)
    – Zanna
    Mar 23 at 8:34







  • 2




    @MilosKalicanin Zanna's suggestion to clarify your question also means it could be reopened and/or likely upvoted. Clarification could also result in different answers being posted that might be more helpful or shorter to the point.
    – WinEunuuchs2Unix
    Mar 23 at 10:23






  • 3




    OK, all this story was about finding which command from filesystem runs when I type 'uname -a' in terminal. I just forgot that there is 'which' function has been already implemented in UNIX. Sorry about disturbing and my ignorance.
    – mk1024
    Mar 23 at 12:34











  • @MilosKalicanin I appreciate your apology but I don't think it's necessary. Having worked with constantly changing computers for thirty+ years, I have learned and then forgotten more than I now know. Your question was not disturbing at all. In fact it helped some of us think about when questions should be reopened. Your question was closed and I see now it's been reopened (before I got a chance to vote to reopen). Also your question was negative voted at one time but is now at neutral zero. So please don't feel bad.
    – WinEunuuchs2Unix
    Mar 23 at 23:57











Your Answer







StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "89"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: false,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);













 

draft saved


draft discarded


















StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1017049%2ffind-out-the-full-path-of-the-program-that-runs-when-i-enter-a-command%23new-answer', 'question_page');

);

Post as a guest






























1 Answer
1






active

oldest

votes








1 Answer
1






active

oldest

votes









active

oldest

votes






active

oldest

votes








up vote
5
down vote













If all you want to know is the command location



If you want to know what directory the top level command is stored in you have a number of options:



$ which uname
/bin/uname

$ type -a uname
uname is /bin/uname

$ locate uname
/bin/uname
(... SNIP dozens of Windows files on C & D ...)
/usr/lib/klibc/bin/uname
/usr/lib/plainbox-provider-resource-generic/bin/uname_resource
/usr/share/man/man1/uname.1.gz
/usr/share/man/man2/oldolduname.2.gz
/usr/share/man/man2/olduname.2.gz
/usr/share/man/man2/uname.2.gz


The last option locate returns all files containing uname not just the program that is run from the command prompt.



strace - trace system calls and interrupts



You don't need the pid of commands called in order to find the names of various commands that are called by a function. With strace all the command names are displayed directly.



For your uname -n example the output is:



$ strace uname -n
execve("/bin/uname", ["uname", "-n"], [/* 62 vars */]) = 0
brk(NULL) = 0x2356000
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, st_mode=S_IFREG) = 0
mmap(NULL, 109073, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ff2f9a9f000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "177ELF21133>1Pt2"..., 832) = 832
fstat(3, 0755, st_size=1868984, ...) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff2f9a9e000
mmap(NULL, 3971488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7ff2f94cb000
mprotect(0x7ff2f968b000, 2097152, PROT_NONE) = 0
mmap(0x7ff2f988b000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1c0000) = 0x7ff2f988b000
mmap(0x7ff2f9891000, 14752, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7ff2f9891000
close(3) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff2f9a9d000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff2f9a9c000
arch_prctl(ARCH_SET_FS, 0x7ff2f9a9d700) = 0
mprotect(0x7ff2f988b000, 16384, PROT_READ) = 0
mprotect(0x606000, 4096, PROT_READ) = 0
mprotect(0x7ff2f9aba000, 4096, PROT_READ) = 0
munmap(0x7ff2f9a9f000, 109073) = 0
brk(NULL) = 0x2356000
brk(0x2377000) = 0x2377000
open("/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
fstat(3, 0644, st_size=10219008, ...) = 0
mmap(NULL, 10219008, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ff2f8b0c000
close(3) = 0
uname(sysname="Linux", nodename="alien", ...) = 0
fstat(1, 0620, st_rdev=makedev(136, 2), ...) = 0
write(1, "alienn", 6alien
) = 6
close(1) = 0
close(2) = 0
exit_group(0) = ?
+++ exited with 0 +++


For more information refer to man strace:



STRACE(1) General Commands Manual STRACE(1)

NAME
strace - trace system calls and signals

SYNOPSIS
strace [-CdffhikqrtttTvVxxy] [-In] [-bexecve] [-eexpr]... [-acolumn] [-ofile] [-sstr‐
size] [-Ppath]... -ppid... / [-D] [-Evar[=val]]... [-uusername] command [args]

strace -c[df] [-In] [-bexecve] [-eexpr]... [-Ooverhead] [-Ssortby] -ppid... / [-D]
[-Evar[=val]]... [-uusername] command [args]

DESCRIPTION
In the simplest case strace runs the specified command until it exits. It intercepts
and records the system calls which are called by a process and the signals which are
received by a process. The name of each system call, its arguments and its return value
are printed on standard error or to the file specified with the -o option.

strace is a useful diagnostic, instructional, and debugging tool. System administra‐
tors, diagnosticians and trouble-shooters will find it invaluable for solving problems
with programs for which the source is not readily available since they do not need to be
recompiled in order to trace them. Students, hackers and the overly-curious will find
that a great deal can be learned about a system and its system calls by tracing even
ordinary programs. And programmers will find that since system calls and signals are
events that happen at the user/kernel interface, a close examination of this boundary is
very useful for bug isolation, sanity checking and attempting to capture race condi‐
tions.


Above is just the beginning of manpage for strace






share|improve this answer






















  • Thank you very much! I was trying to find out first line in strace uname -a command, and you were right that PID and grep just confuse folk.
    – mk1024
    Mar 23 at 2:43







  • 2




    @MilosKalicanin what exactly in the first line did you want to know? It would be great if we could clarify the question to help people find this useful answer. (PS If this answer helped you, you can upvote and/or accept it.)
    – Zanna
    Mar 23 at 8:34







  • 2




    @MilosKalicanin Zanna's suggestion to clarify your question also means it could be reopened and/or likely upvoted. Clarification could also result in different answers being posted that might be more helpful or shorter to the point.
    – WinEunuuchs2Unix
    Mar 23 at 10:23






  • 3




    OK, all this story was about finding which command from filesystem runs when I type 'uname -a' in terminal. I just forgot that there is 'which' function has been already implemented in UNIX. Sorry about disturbing and my ignorance.
    – mk1024
    Mar 23 at 12:34











  • @MilosKalicanin I appreciate your apology but I don't think it's necessary. Having worked with constantly changing computers for thirty+ years, I have learned and then forgotten more than I now know. Your question was not disturbing at all. In fact it helped some of us think about when questions should be reopened. Your question was closed and I see now it's been reopened (before I got a chance to vote to reopen). Also your question was negative voted at one time but is now at neutral zero. So please don't feel bad.
    – WinEunuuchs2Unix
    Mar 23 at 23:57















up vote
5
down vote













If all you want to know is the command location



If you want to know what directory the top level command is stored in you have a number of options:



$ which uname
/bin/uname

$ type -a uname
uname is /bin/uname

$ locate uname
/bin/uname
(... SNIP dozens of Windows files on C & D ...)
/usr/lib/klibc/bin/uname
/usr/lib/plainbox-provider-resource-generic/bin/uname_resource
/usr/share/man/man1/uname.1.gz
/usr/share/man/man2/oldolduname.2.gz
/usr/share/man/man2/olduname.2.gz
/usr/share/man/man2/uname.2.gz


The last option locate returns all files containing uname not just the program that is run from the command prompt.



strace - trace system calls and interrupts



You don't need the pid of commands called in order to find the names of various commands that are called by a function. With strace all the command names are displayed directly.



For your uname -n example the output is:



$ strace uname -n
execve("/bin/uname", ["uname", "-n"], [/* 62 vars */]) = 0
brk(NULL) = 0x2356000
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, st_mode=S_IFREG) = 0
mmap(NULL, 109073, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ff2f9a9f000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "177ELF21133>1Pt2"..., 832) = 832
fstat(3, 0755, st_size=1868984, ...) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff2f9a9e000
mmap(NULL, 3971488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7ff2f94cb000
mprotect(0x7ff2f968b000, 2097152, PROT_NONE) = 0
mmap(0x7ff2f988b000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1c0000) = 0x7ff2f988b000
mmap(0x7ff2f9891000, 14752, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7ff2f9891000
close(3) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff2f9a9d000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff2f9a9c000
arch_prctl(ARCH_SET_FS, 0x7ff2f9a9d700) = 0
mprotect(0x7ff2f988b000, 16384, PROT_READ) = 0
mprotect(0x606000, 4096, PROT_READ) = 0
mprotect(0x7ff2f9aba000, 4096, PROT_READ) = 0
munmap(0x7ff2f9a9f000, 109073) = 0
brk(NULL) = 0x2356000
brk(0x2377000) = 0x2377000
open("/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
fstat(3, 0644, st_size=10219008, ...) = 0
mmap(NULL, 10219008, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ff2f8b0c000
close(3) = 0
uname(sysname="Linux", nodename="alien", ...) = 0
fstat(1, 0620, st_rdev=makedev(136, 2), ...) = 0
write(1, "alienn", 6alien
) = 6
close(1) = 0
close(2) = 0
exit_group(0) = ?
+++ exited with 0 +++


For more information refer to man strace:



STRACE(1) General Commands Manual STRACE(1)

NAME
strace - trace system calls and signals

SYNOPSIS
strace [-CdffhikqrtttTvVxxy] [-In] [-bexecve] [-eexpr]... [-acolumn] [-ofile] [-sstr‐
size] [-Ppath]... -ppid... / [-D] [-Evar[=val]]... [-uusername] command [args]

strace -c[df] [-In] [-bexecve] [-eexpr]... [-Ooverhead] [-Ssortby] -ppid... / [-D]
[-Evar[=val]]... [-uusername] command [args]

DESCRIPTION
In the simplest case strace runs the specified command until it exits. It intercepts
and records the system calls which are called by a process and the signals which are
received by a process. The name of each system call, its arguments and its return value
are printed on standard error or to the file specified with the -o option.

strace is a useful diagnostic, instructional, and debugging tool. System administra‐
tors, diagnosticians and trouble-shooters will find it invaluable for solving problems
with programs for which the source is not readily available since they do not need to be
recompiled in order to trace them. Students, hackers and the overly-curious will find
that a great deal can be learned about a system and its system calls by tracing even
ordinary programs. And programmers will find that since system calls and signals are
events that happen at the user/kernel interface, a close examination of this boundary is
very useful for bug isolation, sanity checking and attempting to capture race condi‐
tions.


Above is just the beginning of manpage for strace






share|improve this answer






















  • Thank you very much! I was trying to find out first line in strace uname -a command, and you were right that PID and grep just confuse folk.
    – mk1024
    Mar 23 at 2:43







  • 2




    @MilosKalicanin what exactly in the first line did you want to know? It would be great if we could clarify the question to help people find this useful answer. (PS If this answer helped you, you can upvote and/or accept it.)
    – Zanna
    Mar 23 at 8:34







  • 2




    @MilosKalicanin Zanna's suggestion to clarify your question also means it could be reopened and/or likely upvoted. Clarification could also result in different answers being posted that might be more helpful or shorter to the point.
    – WinEunuuchs2Unix
    Mar 23 at 10:23






  • 3




    OK, all this story was about finding which command from filesystem runs when I type 'uname -a' in terminal. I just forgot that there is 'which' function has been already implemented in UNIX. Sorry about disturbing and my ignorance.
    – mk1024
    Mar 23 at 12:34











  • @MilosKalicanin I appreciate your apology but I don't think it's necessary. Having worked with constantly changing computers for thirty+ years, I have learned and then forgotten more than I now know. Your question was not disturbing at all. In fact it helped some of us think about when questions should be reopened. Your question was closed and I see now it's been reopened (before I got a chance to vote to reopen). Also your question was negative voted at one time but is now at neutral zero. So please don't feel bad.
    – WinEunuuchs2Unix
    Mar 23 at 23:57













up vote
5
down vote










up vote
5
down vote









If all you want to know is the command location



If you want to know what directory the top level command is stored in you have a number of options:



$ which uname
/bin/uname

$ type -a uname
uname is /bin/uname

$ locate uname
/bin/uname
(... SNIP dozens of Windows files on C & D ...)
/usr/lib/klibc/bin/uname
/usr/lib/plainbox-provider-resource-generic/bin/uname_resource
/usr/share/man/man1/uname.1.gz
/usr/share/man/man2/oldolduname.2.gz
/usr/share/man/man2/olduname.2.gz
/usr/share/man/man2/uname.2.gz


The last option locate returns all files containing uname not just the program that is run from the command prompt.



strace - trace system calls and interrupts



You don't need the pid of commands called in order to find the names of various commands that are called by a function. With strace all the command names are displayed directly.



For your uname -n example the output is:



$ strace uname -n
execve("/bin/uname", ["uname", "-n"], [/* 62 vars */]) = 0
brk(NULL) = 0x2356000
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, st_mode=S_IFREG) = 0
mmap(NULL, 109073, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ff2f9a9f000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "177ELF21133>1Pt2"..., 832) = 832
fstat(3, 0755, st_size=1868984, ...) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff2f9a9e000
mmap(NULL, 3971488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7ff2f94cb000
mprotect(0x7ff2f968b000, 2097152, PROT_NONE) = 0
mmap(0x7ff2f988b000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1c0000) = 0x7ff2f988b000
mmap(0x7ff2f9891000, 14752, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7ff2f9891000
close(3) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff2f9a9d000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff2f9a9c000
arch_prctl(ARCH_SET_FS, 0x7ff2f9a9d700) = 0
mprotect(0x7ff2f988b000, 16384, PROT_READ) = 0
mprotect(0x606000, 4096, PROT_READ) = 0
mprotect(0x7ff2f9aba000, 4096, PROT_READ) = 0
munmap(0x7ff2f9a9f000, 109073) = 0
brk(NULL) = 0x2356000
brk(0x2377000) = 0x2377000
open("/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
fstat(3, 0644, st_size=10219008, ...) = 0
mmap(NULL, 10219008, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ff2f8b0c000
close(3) = 0
uname(sysname="Linux", nodename="alien", ...) = 0
fstat(1, 0620, st_rdev=makedev(136, 2), ...) = 0
write(1, "alienn", 6alien
) = 6
close(1) = 0
close(2) = 0
exit_group(0) = ?
+++ exited with 0 +++


For more information refer to man strace:



STRACE(1) General Commands Manual STRACE(1)

NAME
strace - trace system calls and signals

SYNOPSIS
strace [-CdffhikqrtttTvVxxy] [-In] [-bexecve] [-eexpr]... [-acolumn] [-ofile] [-sstr‐
size] [-Ppath]... -ppid... / [-D] [-Evar[=val]]... [-uusername] command [args]

strace -c[df] [-In] [-bexecve] [-eexpr]... [-Ooverhead] [-Ssortby] -ppid... / [-D]
[-Evar[=val]]... [-uusername] command [args]

DESCRIPTION
In the simplest case strace runs the specified command until it exits. It intercepts
and records the system calls which are called by a process and the signals which are
received by a process. The name of each system call, its arguments and its return value
are printed on standard error or to the file specified with the -o option.

strace is a useful diagnostic, instructional, and debugging tool. System administra‐
tors, diagnosticians and trouble-shooters will find it invaluable for solving problems
with programs for which the source is not readily available since they do not need to be
recompiled in order to trace them. Students, hackers and the overly-curious will find
that a great deal can be learned about a system and its system calls by tracing even
ordinary programs. And programmers will find that since system calls and signals are
events that happen at the user/kernel interface, a close examination of this boundary is
very useful for bug isolation, sanity checking and attempting to capture race condi‐
tions.


Above is just the beginning of manpage for strace






share|improve this answer














If all you want to know is the command location



If you want to know what directory the top level command is stored in you have a number of options:



$ which uname
/bin/uname

$ type -a uname
uname is /bin/uname

$ locate uname
/bin/uname
(... SNIP dozens of Windows files on C & D ...)
/usr/lib/klibc/bin/uname
/usr/lib/plainbox-provider-resource-generic/bin/uname_resource
/usr/share/man/man1/uname.1.gz
/usr/share/man/man2/oldolduname.2.gz
/usr/share/man/man2/olduname.2.gz
/usr/share/man/man2/uname.2.gz


The last option locate returns all files containing uname not just the program that is run from the command prompt.



strace - trace system calls and interrupts



You don't need the pid of commands called in order to find the names of various commands that are called by a function. With strace all the command names are displayed directly.



For your uname -n example the output is:



$ strace uname -n
execve("/bin/uname", ["uname", "-n"], [/* 62 vars */]) = 0
brk(NULL) = 0x2356000
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, st_mode=S_IFREG) = 0
mmap(NULL, 109073, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ff2f9a9f000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "177ELF21133>1Pt2"..., 832) = 832
fstat(3, 0755, st_size=1868984, ...) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff2f9a9e000
mmap(NULL, 3971488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7ff2f94cb000
mprotect(0x7ff2f968b000, 2097152, PROT_NONE) = 0
mmap(0x7ff2f988b000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1c0000) = 0x7ff2f988b000
mmap(0x7ff2f9891000, 14752, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7ff2f9891000
close(3) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff2f9a9d000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff2f9a9c000
arch_prctl(ARCH_SET_FS, 0x7ff2f9a9d700) = 0
mprotect(0x7ff2f988b000, 16384, PROT_READ) = 0
mprotect(0x606000, 4096, PROT_READ) = 0
mprotect(0x7ff2f9aba000, 4096, PROT_READ) = 0
munmap(0x7ff2f9a9f000, 109073) = 0
brk(NULL) = 0x2356000
brk(0x2377000) = 0x2377000
open("/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
fstat(3, 0644, st_size=10219008, ...) = 0
mmap(NULL, 10219008, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ff2f8b0c000
close(3) = 0
uname(sysname="Linux", nodename="alien", ...) = 0
fstat(1, 0620, st_rdev=makedev(136, 2), ...) = 0
write(1, "alienn", 6alien
) = 6
close(1) = 0
close(2) = 0
exit_group(0) = ?
+++ exited with 0 +++


For more information refer to man strace:



STRACE(1) General Commands Manual STRACE(1)

NAME
strace - trace system calls and signals

SYNOPSIS
strace [-CdffhikqrtttTvVxxy] [-In] [-bexecve] [-eexpr]... [-acolumn] [-ofile] [-sstr‐
size] [-Ppath]... -ppid... / [-D] [-Evar[=val]]... [-uusername] command [args]

strace -c[df] [-In] [-bexecve] [-eexpr]... [-Ooverhead] [-Ssortby] -ppid... / [-D]
[-Evar[=val]]... [-uusername] command [args]

DESCRIPTION
In the simplest case strace runs the specified command until it exits. It intercepts
and records the system calls which are called by a process and the signals which are
received by a process. The name of each system call, its arguments and its return value
are printed on standard error or to the file specified with the -o option.

strace is a useful diagnostic, instructional, and debugging tool. System administra‐
tors, diagnosticians and trouble-shooters will find it invaluable for solving problems
with programs for which the source is not readily available since they do not need to be
recompiled in order to trace them. Students, hackers and the overly-curious will find
that a great deal can be learned about a system and its system calls by tracing even
ordinary programs. And programmers will find that since system calls and signals are
events that happen at the user/kernel interface, a close examination of this boundary is
very useful for bug isolation, sanity checking and attempting to capture race condi‐
tions.


Above is just the beginning of manpage for strace







share|improve this answer














share|improve this answer



share|improve this answer








edited Mar 23 at 10:19

























answered Mar 23 at 0:22









WinEunuuchs2Unix

35.9k759134




35.9k759134











  • Thank you very much! I was trying to find out first line in strace uname -a command, and you were right that PID and grep just confuse folk.
    – mk1024
    Mar 23 at 2:43







  • 2




    @MilosKalicanin what exactly in the first line did you want to know? It would be great if we could clarify the question to help people find this useful answer. (PS If this answer helped you, you can upvote and/or accept it.)
    – Zanna
    Mar 23 at 8:34







  • 2




    @MilosKalicanin Zanna's suggestion to clarify your question also means it could be reopened and/or likely upvoted. Clarification could also result in different answers being posted that might be more helpful or shorter to the point.
    – WinEunuuchs2Unix
    Mar 23 at 10:23






  • 3




    OK, all this story was about finding which command from filesystem runs when I type 'uname -a' in terminal. I just forgot that there is 'which' function has been already implemented in UNIX. Sorry about disturbing and my ignorance.
    – mk1024
    Mar 23 at 12:34











  • @MilosKalicanin I appreciate your apology but I don't think it's necessary. Having worked with constantly changing computers for thirty+ years, I have learned and then forgotten more than I now know. Your question was not disturbing at all. In fact it helped some of us think about when questions should be reopened. Your question was closed and I see now it's been reopened (before I got a chance to vote to reopen). Also your question was negative voted at one time but is now at neutral zero. So please don't feel bad.
    – WinEunuuchs2Unix
    Mar 23 at 23:57

















  • Thank you very much! I was trying to find out first line in strace uname -a command, and you were right that PID and grep just confuse folk.
    – mk1024
    Mar 23 at 2:43







  • 2




    @MilosKalicanin what exactly in the first line did you want to know? It would be great if we could clarify the question to help people find this useful answer. (PS If this answer helped you, you can upvote and/or accept it.)
    – Zanna
    Mar 23 at 8:34







  • 2




    @MilosKalicanin Zanna's suggestion to clarify your question also means it could be reopened and/or likely upvoted. Clarification could also result in different answers being posted that might be more helpful or shorter to the point.
    – WinEunuuchs2Unix
    Mar 23 at 10:23






  • 3




    OK, all this story was about finding which command from filesystem runs when I type 'uname -a' in terminal. I just forgot that there is 'which' function has been already implemented in UNIX. Sorry about disturbing and my ignorance.
    – mk1024
    Mar 23 at 12:34











  • @MilosKalicanin I appreciate your apology but I don't think it's necessary. Having worked with constantly changing computers for thirty+ years, I have learned and then forgotten more than I now know. Your question was not disturbing at all. In fact it helped some of us think about when questions should be reopened. Your question was closed and I see now it's been reopened (before I got a chance to vote to reopen). Also your question was negative voted at one time but is now at neutral zero. So please don't feel bad.
    – WinEunuuchs2Unix
    Mar 23 at 23:57
















Thank you very much! I was trying to find out first line in strace uname -a command, and you were right that PID and grep just confuse folk.
– mk1024
Mar 23 at 2:43





Thank you very much! I was trying to find out first line in strace uname -a command, and you were right that PID and grep just confuse folk.
– mk1024
Mar 23 at 2:43





2




2




@MilosKalicanin what exactly in the first line did you want to know? It would be great if we could clarify the question to help people find this useful answer. (PS If this answer helped you, you can upvote and/or accept it.)
– Zanna
Mar 23 at 8:34





@MilosKalicanin what exactly in the first line did you want to know? It would be great if we could clarify the question to help people find this useful answer. (PS If this answer helped you, you can upvote and/or accept it.)
– Zanna
Mar 23 at 8:34





2




2




@MilosKalicanin Zanna's suggestion to clarify your question also means it could be reopened and/or likely upvoted. Clarification could also result in different answers being posted that might be more helpful or shorter to the point.
– WinEunuuchs2Unix
Mar 23 at 10:23




@MilosKalicanin Zanna's suggestion to clarify your question also means it could be reopened and/or likely upvoted. Clarification could also result in different answers being posted that might be more helpful or shorter to the point.
– WinEunuuchs2Unix
Mar 23 at 10:23




3




3




OK, all this story was about finding which command from filesystem runs when I type 'uname -a' in terminal. I just forgot that there is 'which' function has been already implemented in UNIX. Sorry about disturbing and my ignorance.
– mk1024
Mar 23 at 12:34





OK, all this story was about finding which command from filesystem runs when I type 'uname -a' in terminal. I just forgot that there is 'which' function has been already implemented in UNIX. Sorry about disturbing and my ignorance.
– mk1024
Mar 23 at 12:34













@MilosKalicanin I appreciate your apology but I don't think it's necessary. Having worked with constantly changing computers for thirty+ years, I have learned and then forgotten more than I now know. Your question was not disturbing at all. In fact it helped some of us think about when questions should be reopened. Your question was closed and I see now it's been reopened (before I got a chance to vote to reopen). Also your question was negative voted at one time but is now at neutral zero. So please don't feel bad.
– WinEunuuchs2Unix
Mar 23 at 23:57





@MilosKalicanin I appreciate your apology but I don't think it's necessary. Having worked with constantly changing computers for thirty+ years, I have learned and then forgotten more than I now know. Your question was not disturbing at all. In fact it helped some of us think about when questions should be reopened. Your question was closed and I see now it's been reopened (before I got a chance to vote to reopen). Also your question was negative voted at one time but is now at neutral zero. So please don't feel bad.
– WinEunuuchs2Unix
Mar 23 at 23:57


















 

draft saved


draft discarded















































 


draft saved


draft discarded














StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1017049%2ffind-out-the-full-path-of-the-program-that-runs-when-i-enter-a-command%23new-answer', 'question_page');

);

Post as a guest













































































Popular posts from this blog

GRUB: Fatal! inconsistent data read from (0x84) 0+xxxxxx

`kcmshell` modules relation with `/usr/share/applications`

How to enroll fingerprints to Ubuntu 17.10 with VFS491