Skip to content

Processes

Single Process

Processes can be investigated through a variety of tools:

  1. The files in /proc/$PID/, in particular
  2. /proc/$PID/fd/*: the open files of the process
  3. /proc/$PID/environ: the process' environment
  4. strace allows tracing a process' system calls.
  5. ltrace allows tracing a process' library calls.
Both `strace` and `ltrace` slow the target process down **a lot**, which might cause problems.

What Processes are Started

To see what processes are started by the system install bcc-tools and run

# /usr/share/bcc/tools/execsnoop
PCOMM            PID     PPID    RET ARGS
kill             1067985 433809    0 /bin/kill -0 433461
sleep            1067986 433809    0 /usr/bin/sleep 5
kcm-cleanup      1067989 847604    0 /opt/pli/bin/kcm-cleanup
klist            1067992 1067991   0 /usr/bin/klist -l