6

How can I see the raw memory data used by an application ? Like , suppose I have a file name something.sh . Now I run the command ./something.sh , and then I want see all the data its accessing in ram and all the files its accessing in my filesystem,network data or connection its using.May be the hex dump of the memory used by this application. Can I do that in ubuntu ?

6

How can I see the raw memory data used by an application...

Once you have obtained the process' PID (using ps(1) or pidof(8) for instance), you may access the data in its virtual address space using /proc/PID/maps and /proc/PID/mem. Gilles wrote a very detailled answer about that here.

... and all the files its accessing in my filesystem, network data or connections

lsof can do just that. netstat may be more appropriate for network-related descriptors. For instance :

$ netstat -tln    # TCP connections, listening, don't resolve names.
$ netstat -uln    # UDP endpoints, listening, don't resolve names.
$ netstat -tuan   # TCP and UDP, all sorts, don't resolve names.
$ lsof -p PID     # "Files" opened by process PID.

Note: netstat's -p switch will allow you to print the process associated with each line (at least, your processes). To select a specific process, you can simply use grep:

$ netstat -tlnp | grep skype    # TCP, listening, don't resolve (Skype).

For more information about these tools: netstat(8) and lsof(8). See also: proc(5) (and the tools mentionned in other answers).

4

Partial answer:

You can see the files it accesses in real-time by using

strace something.sh

Specifically, it shows you every system call made by the process.

  • OMG! It's too much of data! – Santosh Kumar Aug 15 '15 at 8:30
  • do you think I should delete my answer? – Adam.at.Epsilon Aug 15 '15 at 18:07
4

You can get this information through the virtual /proc file-system (under Linux only).

Try to run this command when the process is running (replace the <pid> by the PID of the observed process):

grep 'VmSize' /proc/<pid>/status 

Beware, you have to have read access to the process to get these information (you cannot access it if you do not own it) !

If you want to know all the information given by /proc/<pid>/status, just do:

cat /proc/self/status
2

If you are just interested in minimal information, try in terminal, type sudo gnome-system-monitor. Click on processes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.