Hot answers tagged

117

Check with lsof to see if there are files held open. Space will not be freed until they are closed. sudo /usr/sbin/lsof | grep deleted will tell you which deleted files are still held open.


76

In the beginning (way back in Unix), the way that programs found out about the running processes on the system was via directly reading process structures from the kernel memory (opening /dev/mem, and interpreting the raw data directly). This is how the very first 'ps' commands worked. Over time, some information was made available via system calls. ...


72

Whenever you read a file under /proc, this invokes some code in the kernel which computes the text to read as the file content. The fact that the content is generated on the fly explains why almost all files have their time reported as now and their size reported as 0 — here you should read 0 as “don't know”. Unlike usual filesystems, the filesystem which is ...


64

This has nothing to do with foreground and background processes; it only has to do with the currently running process. When the kernel has to answer the question “What does /proc/self point to?”, it simply picks the currently-scheduled pid, i.e. the currently running process (on the current logical CPU). The effect is that /proc/self always points to the ...


59

When trying to gain insight into what sort of magic is happening behind the scenes your best friend is strace. Learning to operate this tool is one of the best things you can do to get a better appreciation for what crazy magic is happening behind the scenes. $ strace -s 200 -m strace.log cat /proc/cpuinfo ... read(3, "processor\t: 0\nvendor_id\t: ...


46

The information that you read from the proc filesystem is not stored on any media (not even in RAM), so there is nothing to update. The purpose of the proc file system is to allow userspace programs to obtain or set kernel data using the simple and familiar file system semantics (open, close, read, write, lseek), even though the data that is read or written ...


44

On Linux at least, you can also do: ps -o lstart= -p the-pid to have a more useful start time. Note however that it's the time the process was started, not necessarily the time the command that it is currently executing was invoked. Processes can (and generally do) run more than one command in their lifetime. And commands sometimes spawn other processes. ...


40

Command lsof A good option might be lsof. As man lsof states it is handy for obtaining information about open files such as Internet sockets or Unix Domain sockets. Using it At first, get an overview about /proc/$PID/fd/ and the listed socket numbers. For example, socket:[14240] might interest you. Then use lsof -i -a -p $PID to print a list of all ...


37

Use lsof to find the deleted, but open, file still consuming space: lsof | grep deleted | grep etilqs_1IlrBRwsveCCxId chrome 3446 user 128u REG 253,2 16400 2364626 /var/tmp/etilqs_1IlrBRwsveCCxId (deleted) Find the entry in /proc/<pid>/fd/ that cooresponds to the filehandle: ls -l /proc/3446/fd/...


37

I've found the answer while still writing the question. I've decided to post it anyway because others may find this insightful, and then answer it myself; I hope this is not frowned upon :) The user Philipp Matthias Hahn on the linux-kernel mailing list has figured it out at least partially: As far as I researched for IPv4 some time ago, the "default" ...


37

The one that accesses the symlink (calls readlink() on it, or open() on a path through it). It would be running on the CPU at the time, but that's not relevant. A multiprocessor system could have several processes on the CPU simultaneously. Foreground and background processes are mostly a shell construct, and there's no unique foreground process either, ...


36

sudo has to cover whole the redirection so it can be completely executed by root: $ sudo sh -c "/usr/bin/echo 3 > /proc/sys/vm/drop_caches"


33

For sockets you can find more information about the inode in /proc/net/tcp, /proc/net/udp or /proc/net/unix. For example: ls -l /proc/<pid>/fd lrwx------ 1 root root 64 May 26 22:03 3 -> socket:[53710569] We see inode is 53710569. head -n1 < tcp ; grep -a 53710569 tcp sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt ...


31

The problem is that those /proc files on Linux appear as text files as far as stat()/fstat() is concerned, but do not behave as such. Because it's dynamic data, you can only do one read() system call on them (for some of them at least). Doing more than one could get you two chunks of two different contents, so instead it seems a second read() on them just ...


28

This command (from gdb) dumps memory reliably: gcore pid Dumps can be large, use -o outfile if your current directory doesn't have enough room.


27

I am logged in as root over SSH...It is a remote machine running Debian. Is it actually a remote machine, or a just a remote system? If this is a VPS slice somewhere, (at least some forms of) OS virtualization (e.g. openVZ) won't permit this from within the container. You don't run the machine, you just run your slice.


27

The /proc/PID/fd/NUM symlinks are quasi-universal on Linux, but they don't exist anywhere else (except on Cygwin which emulates them). /proc/PID/fd/NUM also exist on AIX and Solaris, but they aren't symlinks. Portably, to get information about open files, install lsof. Unices with /proc/PID/fd Linux Under Linux, /proc/PID/fd/NUM is a slightly magic ...


27

The wording could have been better but then again any wording you try to compose to express the idea of self reference is going to be confusing. The name of the directory is more descriptive in my opinion. Basically, /proc/self/ represents the process that's reading /proc/self/. So if you try to open /proc/self/ from a C program then it represents that ...


25

/proc is a filesystem because user processes can navigate through it with familiar system calls and library calls, like opendir(), readdir(), chdir() and getcwd(). Even open(), read() and close() work on a lot of the "files" that appear in /proc. For most intents and almost all purposes, /proc is a filesystem, despite the fact that its files don’t occupy ...


25

If /proc is only the proc mount (and no one is playing tricks with overlays), no, a pid-based folder only exists as long as the corresponding process exists in some state (including as a zombie). In fact, just before returning a directory entry for a process id, the kernel re-validates the process’ existence — so at the instant a directory entry is returned, ...


24

It is updated on every access. You see the state of the kernel in that moment. That's why the size shown for the "files" is not the real size. The real size can change and is determined the moment you access the file. You could say, it may be not updated for days. If you don't look at it. :-)


24

You can look at field 5th in output of /proc/[pid]/stat. $ ps -ejH | grep firefox 3043 2683 2683 ? 00:00:21 firefox $ < /proc/3043/stat sed -n '$s/.*) [^ ]* [^ ]* \([^ ]*\).*/\1/p' 2683 From man proc: /proc/[pid]/stat Status information about the process. This is used by ps(1). It is defined in /usr/src/linux/fs/proc/array....


23

The following will convert each environment variable into an export statement, properly quoted for reading into a shell (because LS_COLORS, for example, is likely to have semicolons in it), then sources it. [The printf in /usr/bin, unfortunately, generally doesn't support %q, so we need to call the one built into bash.] . <(xargs -0 bash -c 'printf "...


23

Under the /proc directory, you can also find the IPv4 addresses in the Forwarding Information Base table, at /proc/net/fib_trie The table is pretty intelligible doing a mere cat, first comes the Main: and then Local: cat /proc/net/fib_trie or to see your network, IP addresses and netmask: cat /proc/net/fib_trie | grep "|--" | egrep -v "0.0.0.0| 127." ...


22

It represent the bitmask for events supported by the device. Sample of devices entry for a AT Keyboard: I: Bus=0011 Vendor=0001 Product=0001 Version=ab41 N: Name="AT Translated Set 2 keyboard" P: Phys=isa0060/serio0/input0 S: Sysfs=/devices/platform/i8042/serio0/input/input2 U: Uniq= H: Handlers=sysrq kbd event2 B: PROP=0 B: EV=120013 B: KEY=20000 200 20 ...


22

I can read the /proc/$PID/net/tcp file for example and get information about TCP ports opened by the process. That file is not a list of tcp ports opened by the process. It is a list of all open tcp ports in the current network namespace, and for processes running in the same network namespace is identical to the contents of /proc/net/tcp. To find ports ...


22

The intent of the “bugs” field in /proc/cpuinfo is described in the commit message which introduced it: x86/cpufeature: Add bug flags to /proc/cpuinfo Dump the flags which denote we have detected and/or have applied bug workarounds to the CPU we're executing on, in a similar manner to the feature flags. The advantage is that those are not ...


21

If you want to limit yourself to ELF detection, you can read the ELF header of /proc/$PID/exe yourself. It's quite trivial: if the 5th byte in the file is 1, it's a 32-bit binary. If it's 2, it's 64-bit. For added sanity checking: If the first 5 bytes are 0x7f, "ELF", 1: it's a 32 bit ELF binary. If the first 5 bytes are 0x7f, "ELF", 2: it's a 64 bit ELF ...


20

http://lxr.linux.no/linux+v3.2.9/fs/proc/base.c#L2482 is the current implementation. The proc filesystem is entirely virtual, and is implemented so the internal VFS readlink delegates to the right place for special symlinks. So, it calculates what self points to when it is read / traversed, not every context switch.


20

The perl function kill(0,$pid) can be used. If the return code is 1 then the PID exists and you're allowed to send a signal to it. If the return code is 0 then you need to check $!. It may be EPERM (permission denied) which means the process exists or ESRCH in which case the process doesn't exist. If your checking code is running as root then you can ...


Only top voted, non community-wiki answers of a minimum length are eligible