Questions tagged [proc]

procfs (or the proc filesystem) is a special filesystem in UNIX-like operating systems that presents information about processes and other system information in a hierarchical file-like structure

Filter by
Sorted by
Tagged with
0
votes
1answer
27 views

What can a debugger do with /proc that cannot be done with ptrace?

The Wikipedia article on ptrace says: Communications between the controller and target take place using repeated calls of ptrace, passing a small fixed-size block of memory between the two (...
0
votes
1answer
49 views

kswapd0 in ubuntu slows down the system

We don't have any service running in the ubuntu but currently, we see the system becomes very slow from the morning, When I tried top command, I see there are two new services running like below, top ...
0
votes
1answer
25 views

Is there any way to recover files from the informations in `/proc`? [duplicate]

I have just asked in an interview that if someone mistakenly deletes apache logfile from /var/log/apache/access.log while it's being written, can you recover it? After my answer interviewer said that ...
1
vote
2answers
41 views

Detailed information on a single process in a greppable format

Utilities such as ps and top are good for looking at many processes side-by-side. However, they are inconvenient for examining many fields of a single process and are not amenable to using grep. For ...
0
votes
0answers
19 views

Unix Close File descriptor of another process [duplicate]

I need to close the file descriptor of another process. lrwx------ 1 root root 64 Jan 5 01:10 9 -> /opt/xxx/xxxx . I tried exec 6<&-as well but it didn't work and i don't have gdb ...
0
votes
1answer
10 views

pidstat %CPU vs htop %CPU of a process

I'm using the pidstat to monitor the cpu usage of a process and it shows 100%. For the same process the htop or top shows 200% for the same process. The system has 16 cores, and the process i am ...
2
votes
1answer
34 views

How do I restore files removed from /usr/bin?

TL;DR at the bottom. Background: The following occured on my CentOS 6.10 production server. I was using a browser based terminal program to run the program Midnight Commander which is a console-...
0
votes
1answer
15 views

Does statting /proc/PID/stat make the kernel generate the contents so that a file size is returned?

I'm implementing an alternative to top, and thought that I should preallocate an appropriately sized buffer to hold the read contents of /proc/PID/stat. However, knowing that it's a pseudo filesystem ...
0
votes
1answer
44 views

How to determine active/passive end of TCP connection

If I inspect information about established TCP connections as returned by sock_diag(7) (or in /proc/net/tcp), how can I determine whether a given connection originated with the local side owning the ...
0
votes
1answer
77 views

permission denied, even when I have permission

This may be a dumb question, but how does symbolic link preserve permission? $ls -ld /proc/1/exe ls: cannot read symbolic link '/proc/1/exe': Permission denied so I look up what the link point to ...
3
votes
0answers
29 views

failure to stat /proc/self/map_files symlink - permission denied?

I am writing some code that checksums executable mappings. Through /proc/$PID/map_files, Linux provides symlinks to the files that back memory mappings. My code is calling "stat()" on one of these ...
0
votes
1answer
16 views

autofs --force unmounts /proc

Historically I've seen autofs get into situtations where systemctl restart autofs will hang indefinitely due to stale nfs handles. As a result I've employed the --force option to make autofs play a ...
1
vote
0answers
23 views

Identify filesystem for each mtd

In /proc/mtd I can see all partition in my device dev: size erasesize name mtd0: 0xxxxx00 0xxxxx00 "yyyy" mtd1: 0xxxxx00 0xxxxx00 "yyyy" mtd2: 0xxxxx00 0xxxxx00 "yyyy" How can I know which ...
0
votes
1answer
35 views

How does OS kernel get known connected hardware configuration to save it in `/proc` files?

In my student assignment I'm asked to track how Linux kernel discovers configurations of any device connected. For instance, the system has a new printer plugged in. As far as I can see, all features ...
15
votes
1answer
405 views

I accidentally backed up /proc/* , and now I'm stuck with a 28Tb file called “cifs2695” that I can't remove!

Recently my boss asked me to backup a Ubuntu 16 workstation. I wanted to preserve all the libraries and system files, since we have C++ code that can only compile on that particular machine. Being ...
-1
votes
1answer
25 views

What do drivers have to do with modules?

I need to research and find out "which drivers are loaded on my system" using /proc. In /proc there is a dir called "driver" so I thought that was it, but reading about it online, I saw I should also ...
2
votes
1answer
109 views

Why procfs mount option only working on remount?

I have written own init process (pid 1) for my system, to improve security I decided to add hidepid=2 while mounting procfs in /proc location (procfs not mounted by default). After mounting the ...
1
vote
1answer
55 views

how to query information from the /proc filesystem?

how would I begin to do this? I want to write a shell script file that would allow me to pull information from the proc filesystem. Information like PID, state of processes, etc... a short code demo ...
0
votes
1answer
41 views

How to find out what function is runnng when reading /proc

I am trying to write a kernel module that hides some sockets from netstat. I checked how netstat is working and saw that it's reading from /proc/net/tcp. Now I am stuck. I am trying to figure out ...
0
votes
1answer
95 views

What is the best way to restrict /proc fs from malicious users (linux)? [closed]

I am trying to make a restriction to procfs like only a certain groups of members can perform read and write actions. kernel document says we can do that by setting hidepid and gid in /etc/fstab. It ...
0
votes
1answer
39 views

Is “/proc/<pid>/map_files” include mapped file of all tid or just include mapped file of tid=pid only?

There is /proc/pid/task/tid/maps file but no corresponding /proc/pid/task/tid/map_files.
0
votes
1answer
63 views

What does the 4th column (root) in /proc/…/mountinfo mean?

From the proc manual it names the 4th column of mountinfo as "root", and describes it as "the pathname of the directory in the filesystem which forms the root of this mount". But how to understand it? ...
2
votes
1answer
60 views

inotifywait not responding to change in /proc/mounts

I'm trying to get notification of the state of a problematic sshfs mount I have tried two bash scripts while inotifywait -e modify /proc/mounts; do echo "modified" done and inotifywait -m /...
1
vote
1answer
136 views

Why does `sudo cat /proc/self/attr/current` return “Invalid argument”?

I have read that the current AppArmor profile should be listed in the /proc/self/attr/current file, and that if it's empty the current profile is "unconfined". But why does cat return "Invalid ...
1
vote
1answer
89 views

How to check the device number of a device in `/proc/1/ns/{ns}`?

How to check the device number of a device in /proc/1/ns/{ns}? I've read the code for a Go library (see below), which states that it's possible to determine, if a container is in the host namespace ...
4
votes
2answers
909 views

Linux Kernel.org misleading about kernel panic

I always have /proc/sys/kernel/panic set up to 0. Looking at description of this option in kernel.org we can see: panic: The value in this file represents the number of seconds the kernel ...
1
vote
1answer
64 views

What are BSDs' equivalents to /proc and /sys?

The amount of information that can be gathered in linux using the procfs and sysfs which are normally mounted at /proc and /sys is quite substantial. Being not on a FreeBSD install I am amazed to ...
0
votes
1answer
117 views

How to view Stack Trace of a process?

I have seen this answer and according to that Stack Trace can be seen like: $ cat /proc/<PID>/stack [<ffffffff81012b72>] save_stack_trace_tsk+0x22/0x40 [<ffffffff81213abe>] ...
0
votes
1answer
74 views

Why are the virtual memory regions for the same program different on every run?

I am studying virtual memory mappings of memory regions in Linux. The executable is a simple counting program. When two instances of the program are run, the following are the mappings shown by /proc/...
6
votes
3answers
416 views

Way to unambiguously parse /proc/<pid>/stat (given arbitrary contents of name field)

In linux procfs, /proc/<pid>/stat includes as its second argument the name of the process in parentheses. As far as I can tell (by experimentation) this is unescaped. For example, I have been ...
1
vote
0answers
125 views

The vmRSS value of /proc/$pid/status seems not accurate? Why?

I wrote a test program to help me understand the output field of different memory utilities such as free,ps,top,/proc/$pid/status,/proc/$pid/smaps,/proc/$pid/statm etc. One question finally rose up ...
0
votes
1answer
39 views

Why we have so many 0's in intr field of /proc/stat

I am looking into intr field of /proc/stat. # cat stat cpu 10438 2056 25767 10098612 2490 0 1846 0 0 0 cpu0 1768 260 4750 1681597 119 0 608 0 0 0 cpu1 1735 67 5119 1683444 342 0 280 0 0 0 cpu2 1908 ...
0
votes
1answer
28 views

use proc info to increase pc's speed

Just to filter the answers, I am a completely beginner trying to understand the basics about Linux Filesystem. According to many resources the proc directory in the filesystem shows information about ...
0
votes
1answer
31 views

watch to remember its last zero exit output

I run a process that takes lot of time. Time is not a problem actually but I would like to know how much RAM memory it requires. Process is already running so /usr/bin/time is not an option. I found ...
0
votes
0answers
33 views

Wanted to check Disk IO Per process/services - per-proc IOP's (no of reads, no of writes), rw wait time, disk busy ness, inodes

I am looking for DISK IO per process/services in the linux machine : need following details: per-proc IOP's (no of reads, no of writes) rw wait time disk busy ness inodes I do not ...
0
votes
1answer
27 views

Get data about system load in an easy-to-process format

Often I feel the need to run some computation on the data about my system load. For instance about the data that top shows. And possibly iotop and htop as well. Some of the things I'd like to do are ...
2
votes
1answer
295 views

file /proc/cmdline is empty

I'm having a problem to boot my system, because the initramfs which should get its values from /proc/cmdline, such as the root device, isn't able to obtain any value, and that's because this file is ...
0
votes
1answer
279 views

Connections in /proc/[pid]/net/tcp which don't appear in /proc/net/tcp

I'm implementing code to fetch all network connections and associate them with the PIDs using them. Say, for tcp4, for each pid, I'm listing /proc/pid/fd, searching there for links to sockets, ...
2
votes
6answers
1k views

Redirect output on-the-fly - looks not possible in Linux, why?

I tried web search but have not found answer by searching for Linux redirect output on the fly. As far as I understand, output to say stdout works by using file descriptor 1: $ ls -l /proc/pid/fd/1 ...
1
vote
0answers
37 views

Arbitrary “files” in /proc/? [duplicate]

Is there a way to create files in /proc/ without actually writing a kernel module? This is for reverse engineering purposes, an app expects certain things in /proc/ and I do not want to write a ...
0
votes
1answer
52 views

Difference between pid_max/ulimit. How to create fake processes?

I am trying to learn the nuances between pid_max and setting user limits through ulimit. My understanding is that, no matter how high you set the user limits (for example setting user max processes to ...
3
votes
1answer
263 views

What are the non-numeric IRQs in /proc/interrupts?

cat /proc/interrupts shows a bunch of IRQs such as NMI and LOC. The per-line comments in the output give clear explanation, but if they do not have a numeric IRQ number, how does the x86 CPU respond ...
2
votes
0answers
32 views

Read per thread network statistics from C/C++

I have a Linux process with let's say 10 threads. Some of them make network traffic. From another thread or it can be even within another process I need to find out which threads have network activity....
1
vote
0answers
121 views

Absolute path to current user's home directory without using bash expansions?

This is a problem that crops up from time to time and annoys me greatly. Sometimes I need to provide an absolute path, normally in a configuration file, that should refer to the current user's home ...
2
votes
1answer
348 views

How to use sysctl on UNIX variants, e.g. macOS, to read information normally found in /proc/self on Linux?

I've been using /proc/self for a long time to read process-related information like /proc/self/maps etc. However, on some UNIX variants, like macOS, the procfs filesystem is not implemented; but as ...
3
votes
1answer
61 views

How to find which mountpoint current working directory of a process correspond to?

I have a program a.out running from /tmp/test. If I list /proc/$(pgrep a.out)/cwd, it is a symbolic link to /tmp/test. Now, I bind /mnt/othertest onto /tmp/test with mount -o bind /mnt/othertest /tmp/...
2
votes
1answer
167 views

How to configure auditd to collect logs from /proc

I've been looking for this for about 2 days and have come up empty-handed. I am looking for a way to build a threat alert for Linux-based credential dumping in Splunk. To do this, I need to be able ...
3
votes
1answer
313 views

Hiding processes on Unix/Linux

I found an interesting article about how to hide specific processes on linux from process monitoring tools like ps, top, lsof, ... Person states that there are several possible ways to hide processes:...
2
votes
0answers
70 views

Linux task state different in /proc/pid/stat compared to Ftrace output of sched events

I'm trying to trace the flow of a piece of code just to understand the points where the tasks go into D/S/R states (uninterruptible/interruptible/running). I do understand the meaning of each state, ...
0
votes
0answers
50 views

`pstree` truncation

Is there a way to limit the depth of pstree? It's very useful, but sometimes I just want to know the ancestors of a particular process without seeing the large number of subprocesses it has. If I do ...

1
2 3 4 5
10