How to find a Linux process working directory from its PID

What you will learn

• How to identify the PID for a running process.
• How to inspect the process working directory from /proc.
• When this trick helps during Linux troubleshooting.

Problem statement

Sometimes you know a process is running, but you need to know where it was started from. That working directory can explain relative paths, log locations, file writes, failed commands, or confusing behavior in scripts and services.

When this matters in real work

This is useful during Linux troubleshooting, process investigation, ad hoc debugging, and incident review. It is especially helpful when a process uses relative file paths or was started manually from a shell.

Find the PID

Use ps, pgrep, or another process tool to identify the process ID.

pgrep -af nginx
ps aux | grep nginx

Inspect /proc/<pid>/cwd

Linux exposes the current working directory as a symbolic link under /proc. Use readlink to resolve it:

readlink -f /proc/<pid>/cwd

You can also inspect it directly:

ls -l /proc/<pid>/cwd

Alternative command

On systems that include it, pwdx prints the working directory for a process:

pwdx <pid>

Common mistakes

• Using the wrong PID after a process restarts.
• Expecting access when your user does not have permission to inspect that process.
• Confusing the working directory with the executable path.
• Ignoring deleted directories; Linux may show a path with “deleted” when the original directory has been removed.

Summary

For most troubleshooting, readlink -f /proc/<pid>/cwd is the fastest way to find a process working directory. Check permissions, confirm the PID is current, and remember that the working directory is not always the same as the binary or configuration path.

Example output

The quickest check is the cwd symlink under /proc. Use readlink -f /proc with the process ID you are investigating:

$ ps -ef | grep nginx
www-data  1234     1  0 10:15 ?  00:00:00 nginx: worker process

$ readlink -f /proc/1234/cwd
/var/www/html

cwd vs executable vs config path

Path	Command	What it tells you
cwd	readlink -f /proc/<pid>/cwd	The process working directory. Relative file paths are resolved from here.
Executable	readlink -f /proc/<pid>/exe	The binary that started the process.
Command line	tr '' ' ' < /proc/<pid>/cmdline	Arguments passed at start time, often including config file paths.
Open files	ls -l /proc/<pid>/fd	Files, sockets, and descriptors the process currently has open.

This is a useful troubleshooting move, but it is only one part of Linux process investigation. If you are building a broader DevOps/SRE troubleshooting path, the mentorship page describes focused support. For remote terminal workflows that help preserve investigation context, read tmux for DevOps engineers.