semi-functional shell script: for PID in $(ps -eo pid,user,lstart,cmd|grep xxx|cut -d" " -f1) do sudo readlink /proc/$PID/exe >>output done