What is that Process Doing?
summary
Uses concrete system tools and concrete commands to answer the title: the proc filesystem reveals every open file via /proc/PID/fd (including a deleted file whose contents can still be copied) and shows mapped shared libraries in /proc/PID/maps; strace -p attaches to a running process or runs one and prints interpreted system calls (use -f to follow children, filter by syscall classes like file); perf samples via CPU counters to produce accurate callgraph profiles with only a few percent overhead; tshark inspects network traffic.
AI-written summary · about
chapters (11)
- 0:00Start
- 9:34Problem: The process is writing (or reading) some files. Where are they?
- 11:11proc/: File Progress Problem: It's working on some file how far has it gotten?
- 13:00proc/: Reviving Dead Files Problem: It's using some file which is now deleted. What's in there?
- 21:42Traces system calls: Files: stat64 open read write...
- 29:42strace: A stuck process Problem: it seems not to be doing anything
- 31:48strace: Finding config file Problem: it's not finding the config file you expected
- 32:15config file finding the config
- 35:51strace digest strace CMD ARGS... strace -p PID
- 42:46Fantastic profiler In cahoots with kernel and CPU
- 44:33Inside: gdb Debugger, a subject in itself Today just one class of tricks
related talks
45mStrace: Monitoring The Kernel-User-Space Conversation
23mSecuring Your Software Delivery Chain with Process Auditing
01h 31mUnderstanding Linux with Strace
54mContainers unplugged: Linux namespaces
01h 00mInvestigating C++ Applications in Production on Linux and Windows
54mStrace - Swiss Army Knife to Trace, Analyze, RT Debug
47mDive into BPF performance tools using python
38mA Profile of Performance Profiling With pprof