Reading up on an answer to find out which process registered inotify watchers, I executed the following commands
echo 1 | sudo tee /sys/kernel/debug/tracing/events/syscalls/sys_exit_inotify_add_watch/enable sudo cat /sys/kernel/debug/tracing/trace
The resulting output from the
trace file had a header that indicated that the first column should have the name of the process (task?), along with the PID:
# _-----=> irqs-off # / _----=> need-resched # | / _---=> hardirq/softirq # || / _--=> preempt-depth # ||| / delay # TASK-PID CPU# |||| TIMESTAMP FUNCTION # | | | |||| | | gmain-1715  .... 23200.386116: sys_inotify_add_watch -> 0xfffffffffffffffe
Surprisingly, none of the PIDs listed in the many lines of output exist when I grep for them using
ps -ef | grep $THE_PID (where $THE_PID would be 1715). Also, the task name is unknown to me and does not exist in the
ps output either.
Further, the entire list is all tuples like
gmain-<some number>. Not the expected
node. So what is this
gmain process? And what are these PIDs that do not exist in /proc/? Are they historic by the time I try accessing them?
gmain is a thing in these kernel docs by Theodore Ts'o on tracing, so it's something.