# how to find a script running



## ProServ (Mar 23, 2017)

Hi, had a FreeBSD Server run out of swap today. After rebooting found the following in top

```
1317  -  IWJ   0:00.00 /bin/sh ./run
1319  -  IWJ   0:00.00 /bin/sh ./run

# ps auxwwww |grep 1319
root    1319   0.0  0.0  17096      0  -  IWJ  -        0:00.00 /bin/sh ./run
```
Can't find where this 'run' script is.

Question is how to find it?

Thanks.


----------



## IPTRACE (Mar 23, 2017)

Try tu use the below command.

`find / -name 'run'`


----------



## SirDice (Mar 23, 2017)

Alternatively, you can try to see what it's doing using `truss -p 1319`. That may provide clues to what it is.


----------



## tobik@ (Mar 23, 2017)

Use procstat(1) to look at open file descriptors of the process. It should have an entry for run with an absolute path: `procstat -f 1319 | grep run`


----------

