procfs

/proc/net/tcp gives me a local address, port, and inode number for a socket (0.0.0.0:5432 and 9289, for example). I'd like to find the PID for a specific process, given the above information. It's possible to open every numbered folder in /proc, and then check symlinks for matching socket/inode numbers with a shell command like "$ sudo ls -l /proc/*/fd/ 2>/dev/null | grep socket". However, this seems more computationally expensive than necessary, since <5% of the processes on any given system have open TCP sockets. What's the most efficient way to find the PID which has opened a given socket?

According proc manual, one can monitor for mount point changes in linux system by opening "/proc/mounts", and adding the file descriptor to read fd_set in select() call. Following piece of code works on Ubuntu 9.04, and not in Ubuntu 10.04 (with 2.6.32 linux kernel): int mfd = open("/proc/mounts", O_RDONLY, 0); fd_set rfds; struct timeval tv; int rv; FD_ZERO(&rfds); FD_SET(mfd, &rfds); tv.tv_sec = 5; tv.tv_usec = 0; int changes = 0; while ((rv = select(mfd+1, &rfds, NULL, NULL, &tv)) >= 0) { if (FD_ISSET(mfd, &rfds)) { fprintf(stdout, "Mount points changed. %d.\n", changes++); } FD_ZERO(&rfds)

I would like to know the possible values of st column in /proc/net/tcp . I think the st column equates to STATE column from netstat(8) or ss(8) . I have managed to identify three codes: sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode 0: 0100007F:08A0 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 7321 1 ffff81002f449980 3000 0 0 2 -1 1: 00000000:006F 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 6656 1 ffff81003a30c080 3000 0 0 2 -1 2: 00000000:0272 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 6733 1

Has anybody succeeded in mmap'ing a /proc/pid/mem file with Linux kernel 2.6? I am getting an ENODEV (No such device) error. My call looks like this: char * map = mmap(NULL, PAGE_SIZE, PROT_READ, MAP_SHARED, mem_fd, offset); And I have verified by looking at the /proc/pid/maps file while debugging that, when execution reaches this call, offset has the value of the top of the stack minus PAGE_SIZE. I have also verified with ptrace that mmap is setting errno to ENODEV. ephemient See proc_mem_operations in /usr/src/linux/fs/proc/base.c : /proc/.../mem does not support mmap . 来源： https:/

I'm creating a plugin for Munin to monitor stats of named processes. One of the sources of information would be /proc/[pid]/io . But I have a hard time finding out what the difference is between rchar / wchar and read_bytes / written_bytes . They are not the same, as they provide different values. What do they represent? While the proc manpage is woefully behind (and so are most manpages/documentation on anything not relating to cookie-cutter user-space development), this stuff is fortunately documented completely in the Linux kernel source under Documentation/filesystems/proc.txt . Here are

I would like to get a list of open files in a process on os x (10.9.1). In Linux I was able to get this from /proc/PID/fd . However I'm not sure how to get the same on OS X. I found that the procfs is not present on the OS X (by default. possible implementations present, but I do not want to go that way). So how do I get (natively) the list of open files in a process on OS X. One way is lsof . is there any other support available? please let me know where I can get more info on this. Thanks. At least on OSX 10.10 (Yosemite, didn't check on Mavericks), you can get the list of open files by