# Processes

## Single Process

Processes can be investigated through a variety of tools:

1. The files in `/proc/$PID/`, in particular
   - `/proc/$PID/fd/*`: the open files of the process
   - `/proc/$PID/environ`: the process' environment
2. `strace` allows tracing a process' system calls.
3. `ltrace` allows tracing a process' library calls.

```{note}
Both `strace` and `ltrace` slow the target process down **a lot**, which might cause problems.
```


## What Processes are Started

To see what processes are started by the system install `bcc-tools` and run

```
# /usr/share/bcc/tools/execsnoop
PCOMM            PID     PPID    RET ARGS
kill             1067985 433809    0 /bin/kill -0 433461
sleep            1067986 433809    0 /usr/bin/sleep 5
kcm-cleanup      1067989 847604    0 /opt/pli/bin/kcm-cleanup
klist            1067992 1067991   0 /usr/bin/klist -l
```