Processed Linux: from exec to exit

David M Williams
Monday, 03 March 2008 09:50

Opinion and Analysis

Now, all these processes are well and good, but how can you find out just what is running on your system in a finely-grained way, with important process monitoring information.

The answer is the /procfs directory which is a pseudo file system to present information about all the running processes. A user can cd into this directory and inspect files as if they were legitimate disk-based files. You can get lots of valuable information without having to resort to any further tools. Meanwhile, a program can inspect the contents with nothing more than basic open, read, write and close system calls.

Each process has a subdirectory under /proc named after its process ID. So, process ID #1, init, has a directory called /proc/1 which exists for its lifetime. Additionally, a special directory called /proc/self also exists which is a link to the directory of the currently running process.

Inside each directory is a set of files that give detailed information on the process footprint. Most of these are ASCII text files. Some of the more interesting and important are as follows:

cmdline The command line used to invoke the program. Strings are separated by the NULL (ASCII 0) character. This is how a C program would see the argv vector.

environ The processes’ environment, with string delimination as above. This is how a C program would see the envp vector.

fd A directory with a symbolic link for every file descriptor open by the process. This includes disk files, sockets used for network communications and pipes for interprocess communication. Here’s where you can really get info on what your processes are doing.

oom_score A text file holding the processes “out of memory” score. When Linux runs out of memory it kills processes with high scores first.

stat A one-line textual representation of the process status. This is used by the ps command.
status The same information as given in stat, but in a more human-friendly format.

wchan Indicates just which kernel system call is causing a process to block, if it is blocking.
As well as exploring this directory by yourself you can call upon the free tools in the SourceForge procps project. This is a collection of small useful utilities that make use of the proc file system. Some will be very familiar – namely ps, kill, w, top and possibly vmstat. Others will be possibly new to you like slabtop and skill.

Come back next time for more!