Understanding /proc

This is a great post, recently I have been trying to re-learn and understand linux (specifically) ubuntu using monitoring tools. In my opinion htop and Facebook osquery are the two best available tools for understanding how an operating systems and processes work. The osquery approach of recording all OS data in form relational tables (with PIDs as keys etc.) is very useful.<p><a href="https:&#x2F;&#x2F;hisham.hm&#x2F;htop&#x2F;" rel="nofollow">https:&#x2F;&#x2F;hisham.hm&#x2F;htop&#x2F;</a><p><a href="https:&#x2F;&#x2F;osquery.io&#x2F;" rel="nofollow">https:&#x2F;&#x2F;osquery.io&#x2F;</a><p>The osquery query packs are especially useful: <a href="https:&#x2F;&#x2F;osquery.io&#x2F;docs&#x2F;packs&#x2F;" rel="nofollow">https:&#x2F;&#x2F;osquery.io&#x2F;docs&#x2F;packs&#x2F;</a><p>Here is an incomplete draft about a similar post: <a href="https:&#x2F;&#x2F;github.com&#x2F;AKSHAYUBHAT&#x2F;TopDownGuideToLinux" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;AKSHAYUBHAT&#x2F;TopDownGuideToLinux</a>

Very nice write-up, and a great way to dive deep into an interesting system! But if you plan on maintaining a project like this long term I would recommend using one of the many existing libraries like <a href="https:&#x2F;&#x2F;github.com&#x2F;prometheus&#x2F;procfs" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;prometheus&#x2F;procfs</a> or <a href="http:&#x2F;&#x2F;pythonhosted.org&#x2F;psutil&#x2F;" rel="nofollow">http:&#x2F;&#x2F;pythonhosted.org&#x2F;psutil&#x2F;</a><p>There can be a lot of edge cases, and inevitability things will change in the future. Centralising the work of parsing &#x2F;proc files goes a long way and helps keep things sane for maintenance.

It&#x27;s worth noting that `man proc` has pretty exhaustive, though incomplete, documentation of the various files. It&#x27;s a great read to learn about some of the files available.

I wrote something to do similar parsing of process state recently. It seems nuts to me that you can&#x27;t get this all in one call. The naïve way of `fopen()`ing the files you need has a race condition if the PID is reused between two calls to `fopen()`.<p>Admittedly, probably rare. But why route through calls to `fopen()` and `read()` when you could just provide a function that returns OS-defined structs?

Minor nitpick: calling it a a clone of the Unix &#x27;ps&#x27; wouldn&#x27;t be exactly right, since I understand &#x2F;proc is Linux-specific. On the other hand, how did the Unix &#x27;ps&#x27; or the &#x27;ps&#x27; in other Unix-clones work? Is there an alternative method to expose the process data to userspace instead of using a VFS like procfs?

I wrote a small ps clone as a side project, and &quot;man proc&quot; was invaluable in understanding what everything meant.<p>There was interesting work happening on a proposed newer api though, &quot;task_diag&quot; <a href="https:&#x2F;&#x2F;lwn.net&#x2F;Articles&#x2F;685791&#x2F;" rel="nofollow">https:&#x2F;&#x2F;lwn.net&#x2F;Articles&#x2F;685791&#x2F;</a> <a href="https:&#x2F;&#x2F;criu.org&#x2F;Task-diag" rel="nofollow">https:&#x2F;&#x2F;criu.org&#x2F;Task-diag</a>.

Thank you for writing this. This is a wonderfully insightful post :)

Is there something similar for &#x2F;sys and &#x2F;run?