Questions tagged [proc]
procfs (or the proc filesystem) is a special filesystem in UNIX-like operating systems that presents information about processes and other system information in a hierarchical file-like structure
578 questions
1
vote
1
answer
65
views
file-nr keeps increasing forever
I have a cloud VM running linux-yocto 6.17 and a few daemon processes--postfix, dovecot, rspamd, nginx, sshd, fail2ban and redis.
Ever since upgrading from 6.11 to 6.17, I've noticed that /proc/sys/fs/...
- 11
1
vote
1
answer
61
views
Why is there a discrepancy between the stack address in /proc/PID/maps vs. /proc/PID/stat?
Why does there appear to be a discrepancy between a process stack address within /proc/PID/maps compared to the stack start address within /proc/PID/stat, where the latter is a smaller subset of the ...
- 129
1
vote
1
answer
55
views
Discrepancies for entries for the same map in different /proc/*/smaps files
The snippet below:
shows statistics for what appears to be the exact same memory mapping: same device number, same inode, same offset, same length (0x7f8656e78000-0x7f8656cbb000 = 0x7f2f4ef6a000-...
- 11
5
votes
1
answer
345
views
How to interpret the refcnt field in /proc/crypto?
Here's an example /proc/crypto entry:
name : md5
driver : md5-generic
module : kernel
priority : 0
refcnt : 1
selftest : passed
internal : no
type : shash
...
- 61
2
votes
1
answer
81
views
OpenBSD process maps
I am using OpenBSD 7.7.
So I know that procfs is not mounted on /proc, and I need to use sysctl to fetch process maps. But this fails as I am not running as a root user. The secure level is set to 1 ...
4
votes
0
answers
123
views
Recovering text of Unsaved document from process memory? (frozen Xed window - process still "running" but in Sleeping status)
The window of my text editor Xed froze with Unsaved documents just as I was doing 'File'->'Save as...' to save them... [How ironic.]
Since the process still exists, I am trying to recover the text ...
- 454
7
votes
2
answers
414
views
How can I find location of PRI in /proc
I have sshd with PID of 1957:
mohsen@debian:~$ ps ax -o pid,nice,pri,cmd |grep 1957
1957 -2 21 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
According to above, my nice number is -2 ...
- 11.3k
1
vote
0
answers
31
views
reading stdout from /proc [duplicate]
I'm running the following C program
// hello.c
#include <stdio.h>
#include <unistd.h>
int main() {
while (1) {
printf("Hello\n");
fflush(stdout);
sleep(1);
}
...
- 319
0
votes
0
answers
50
views
Finding actual memory usage of process
I have seen similar questions 1, 2, and understand the difference between RSS/VSZ.
I've some uses of mmap'ing distinct virtual memory regions to the same underlying physical memory.
In this case, /...
- 101
0
votes
2
answers
138
views
Why are some symlinks unreadable when their target is readable?
On Linux, I'm looking at /proc/1/cwd. This symlink is not readable as a normal user:
$ ls /proc/1/cwd
ls: cannot access '/proc/1/cwd': Permission denied
But /proc/1 is accessible:
$ ls /proc/1
<...
- 215
1
vote
1
answer
150
views
In /proc/$PID/smaps in the VmFlags what is the difference between "readable" and "may read"?
The man page describes the meaning of the VmFlags:
The "VmFlags" line (available since Linux 3.8) represents
the kernel flags associated with the virtual memory ...
- 831
0
votes
1
answer
170
views
Why is dd unable to read /proc/pid/mem?
Why is GNU Coreutil's dd unable to read /proc/pid/mem? PHP is able to read it, check this:
$ dd if=/proc/357668/mem bs=100 skip=93824992231424 count=1 iflag=fullblock
dd: /proc/357668/mem: cannot skip ...
- 705
0
votes
1
answer
106
views
Is there a linux kernel interface (/proc) that counts kernel error log messages?
The comand dmesg --level=emerg,alert,crit,err lists all error messages with a high severity.
I wondered for monitoring purposes whether the count of messages is somehow exposed in the /proc filesystem....
- 103
0
votes
1
answer
64
views
Are reads of /proc/pid/environ atomic in Linux 6.x (e.g: 6.1.99)?
When a process execs, looking at kernel code for environ_read(), it seems that if the mm_struct doesn't yet exist / is null or the env_end member of that mm_struct is null, environ_read() will return ...
- 109
1
vote
1
answer
143
views
Unexpected behavior of 'some' PSI CPU metric
I am trying to understand the meaning of the "some" row of the Linux PSI metric for CPU. The Linux documentation (https://github.com/torvalds/linux/blob/master/Documentation/accounting/psi....
- 21
1
vote
1
answer
144
views
/proc/pid exists but does pid not found in ps
I am seeing a very odd behavior.
/proc/1154/cmdline exists, and kill -0 1154 succeeds,
but ps -ef | grep 1154 and ls /proc | grep 1154 do not show anything.
1154 was a postgres process in the middle ...
0
votes
1
answer
152
views
Examine procfs for scratch-based container
I'm developing an application that I'm shipping as a Docker image. My application consists of a single executable file that links just against libc and libcrypto. I'm thinking about making my image ...
- 961
2
votes
0
answers
146
views
Am I right that /proc/PID/status capabilities are always shown in the user namespace of PID?
I always assumed that /proc/[PID]/status shows capabilities that PID has in the user namesapce of the process that opens /proc/[PID]/status, not in the user namespace of PID, but it seems that I was ...
- 21
0
votes
1
answer
175
views
Interpretation of "measured in pages" for /proc/[pid]/statm
The man page for the proc file system says that memory usage for /proc/[pid]/statm and others is "measured in pages". I'm not sure what this means when multiple page sizes are used.
Let's ...
- 13
1
vote
1
answer
159
views
Difference between ulimit -a and /proc/$PID/limits
In Linux, there are user limits for accessing system resources.
Shell built-in command ulimit can be used to see user limits for the current user.
ulimit -a # soft limits
ulimit -a -H # hard ...
- 323
0
votes
1
answer
65
views
Adjust Ephemeral Port Range in Yocto
I'm currently trying to build a Linux image with Yocto Kirkstone. The final image will include an application that requires the ephemeral port range for ip4 to be edited a certain way.
Is there a way ...
- 103
2
votes
1
answer
499
views
Permission Denied When Accessing Symbol Link in /proc/<pid>
I am encountering a "Permission denied" error when trying to access the symbol link of an nginx worker process which running under the adg user.
Similar question: Owner can't read /proc/$...
- 23
0
votes
2
answers
96
views
What other channels besides /proc are there to obtain process information？
We know that process information can be obtained from the /proc directory, such as being able to see the PID of all processes, etc.
And many user commands, such as top, ps, and so on, essentially ...
- 1
0
votes
1
answer
179
views
Running command 'cat /proc/<pid>/stat | cut -d" " -f29' to get stack pointer , is always showing stack pointer as zero
Iam trying to get the stack pointer of some thread using the /proc//stat, whenever i run the command,cat /proc/<pid>/stat | cut -d" " -f29 i end up getting zero, but when i run sudo ...
0
votes
1
answer
181
views
Why the access to /proc/[pid]/ns needs to generate symlinks?
The directories of the form /proc/[pid]/ns get populated each time they are accessed. That is, each time they are accessed the kernel produces a symlink to somewhere in the namespace filesystem (not ...
0
votes
0
answers
55
views
Grant one process access to proc of another process?
I'd like a monitoring daemon to be able to access /proc/<PID>/smaps_rollup of another process to be able to report swap usage of that process.
I found information that access to that file is &...
- 1,238
0
votes
1
answer
113
views
Why that the process' comm value is from last 15 characters of process name but the thread's comm value is from top 15 characters?
I'm developing on Android 11 device. I am confused that the process' comm value is from last 15 characters of process name but the thread's comm value is from top 15 characters. Does any man page ...
- 3
3
votes
1
answer
428
views
Thread Name: Is /proc/pid/comm always identical to the Name: line of /proc/pid/status and the second field of /proc/pid/stat?
A Linux thread or forked process may change its name and/or its commandline as visible by ps or in the /proc filesystem.
When using the python-setproctitle package, the same change occurs on /proc/pid/...
- 754
1
vote
1
answer
130
views
Count the total processes spawned using /proc/loadavg
In a Red Hat Linux 8 operating system, I examined the output of cat /proc/loadavg and obtained "5.20 5.78 8.04 16/1596 1954863".
After 4 minutes, I rechecked the /proc/loadavg output and ...
- 11
0
votes
1
answer
128
views
Discrepancy between values in htop and /proc/meminfo
From the author of htops answer
https://stackoverflow.com/questions/41224738/how-to-calculate-system-memory-usage-from-proc-meminfo-like-htop/41251290#41251290
I got to know that the total memory in ...
- 103
2
votes
1
answer
799
views
SElinux denies to access file in /proc
My audit plugin process needs to be able to iterate through /proc and read /proc/pid/stat files, but SElinux refuses this.
Process context of my plugin:
ps auxZ | grep -i myplugin
system_u:system_r:...
- 371
9
votes
2
answers
619
views
ps -o pid,ppid,stat,exe -e | grep deleted has "(deleted)" appended to the executable path
ps -o pid,ppid,stat,exe -e | grep deleted
generates output like this:
1777 1346 Sl /usr/bin/python3.10 (deleted)
1778 1346 Sl /usr/bin/python3.10 (deleted)
1825 1327 Ss /usr/...
- 213
2
votes
1
answer
599
views
How can I locate the stacks of child tasks (threads) using /proc/<pid>/maps?
PURPOSE:
I am theorising as to how one would go about creating a pointer scanner in a Linux environment.
DISCLAIMER:
My findings have been tested on Debian Bookworm (current stable) and a Gentoo ...
- 21
1
vote
1
answer
1k
views
How do I determine the PID of the shell running a given pts/tty?
There are many ways to obtain the PTS associated with a given process - such as using the tty command or resolving /proc/self/fd/0 (assuming it's open and not redirected) - but what about the inverse? ...
- 1,339
4
votes
1
answer
1k
views
Why isn't access to /proc/pid/mem a security vulnerability?
I've played around a bit with /proc/pid/mem and /proc/pid/maps. I wrote a simple c program that just periodically reads from a variable (whose address is written to stdout), and I was able to change ...
- 49
1
vote
1
answer
842
views
Who mounts /proc and /sys in GNU/Linux systems?
If you build a custom GNU/Linux system for an embedded device, do you need to execute
mount -t proc proc /proc
mount -t sysfs sysfs /sys
somewhere in init process or is this done automatically by the ...
- 159
0
votes
1
answer
330
views
sudo cannot ls root owned files in /proc
I am on Debian 12 and I am trying to write a script to identify processes with certain inodes (from /proc/net/raw and /proc/net/packet).
My original grep command is this (to get only the pid itself):
...
user432564
0
votes
1
answer
117
views
Memory total shown on Linux on 8GB memory PC is only 7038920 kB
Why linux /proc/meminfo show:" 1 MemTotal: 7038920 kB " (proc most likely is to mean Kibibyte) in a PC of 8 GB memory RAM, although its Kibibyte is 7812500 ?
user575072
0
votes
0
answers
196
views
Running an application that requires read access to /proc
I'm trying to run an application that requires access to /proc in order to find the gnome-shell process and its environment variables. My guess is that this application used to work but default ...
- 177
8
votes
2
answers
2k
views
Should the use of /etc/mtab now be considered deprecated?
I'm curious about the file or symlink /etc/mtab. I believe this is a legacy mechanism. On every modern linux I've used this is a symbolic link to /proc/mounts and if mtab were to be a regular file on ...
- 21.1k
1
vote
0
answers
125
views
How would you assign read-only permissions to run ls -l /proc/{pid}/fd for processes you don't own using SELinux in Android
I am developing an application on Android as a non-root user.
However, I need read access to all the /proc/{pid}/fd files so as to check the inode numbers from the symlink under fd.
How do I do that ...
6
votes
1
answer
730
views
"Others" cannot read 'smaps_rollup' file with -r--r--r-- permission under /proc/PID/. Why?
I'm trying to read two specific files, namely status and smaps_rollup for all the processes under /proc. All process directories have dr-xr-xr-x permission and I'm able to enter every one of these ...
- 352
3
votes
1
answer
175
views
zathura and ownership of files in /proc/PID
Yesterday, while writing an answer to How to get full path names of all opened pdf files (in zathura) - like rofi does, I noticed something weird about the ownership of files the /proc/PID/ directory ...
- 84.9k
1
vote
1
answer
441
views
Accessing /proc from foreign chroot
I am trying to set up a foreign chroot environment with QEMU, mostly as described at https://www.hellion.org.uk/blog/posts/foreign-chroots-with-schroot-and-qemu/.
The host system is Ubuntu x86_64 (on ...
- 1,565
2
votes
0
answers
458
views
How can I find out what changes the value in /proc/sys/kernel/sysrq?
For some reason the value stored in the /proc/sys/kernel/sysrq file on my system changes to 16. It happens quite frequently, like once-twice an hour but in a random moment of time.
As I understand, I ...
- 21
1
vote
0
answers
173
views
Why is there more `time_wait` displayed in `sockstat` than it actually is?
Why is there more time_wait displayed in /proc/net/sockstat than it actually is? And how to fix it?
[root@node09 ~]# netstat -ant | grep TIME_WAIT | wc -l
28
[root@node09 ~]# netstat -ant|awk '/^tcp/ ...
- 11
0
votes
1
answer
584
views
How Do Logs Get From "Kernel Ring Buffer" to "/proc/kmgs" and "/dev/kmsg"?
I can not get any reliable information about how do kernel logs get from Kernel Ring Buffer to /proc/kmgs and /dev/kmsg. Is there any source I could have possbily missed or does perhaps anyone know ...
6
votes
2
answers
4k
views
What does the SPID abbreviation stand for?
The ps command with the -T flag outputs the SPID column, which is also called TID(Thread ID). But what does SPID stand for?
The ps source code doesn't seem to know why this name is either:
trace("...
- 61
0
votes
1
answer
404
views
Output text file contents (/proc/interrupts) as they change [duplicate]
Is there some command I can use to monitor changes in /proc/interrupt?
For example, using head -4 I can see that the file is changing, but only if I run head again and again:
> head -4 /proc/...
0
votes
1
answer
238
views
Setting file contexts on /proc files
I want to restrict access to files in /proc as much as possible using SELinux. When I try to chcon a directory in /proc, it fails:
$ chcon -t staff_proc_t /proc/acpi
chcon: failed to change context of ...
- 1,101