Linux /proc and Process Debugging

Linux Processes•Permalink

Low-level Linux process inspection with /proc, syscall tracing, profilers, debuggers, and core dumps.

View

Standard Detailed Compact

Export

Copy the compact sheet, download it, or print it.

Download

`D` dense toggle · `C` copy all

/proc Process Filesystem

Use /proc for low-level process inspection.

Read process command line

Print the null-separated command line from /proc.

↗#

bashANYproccmdline

bash

tr "\0" " " < /proc/1234/cmdline; echo

Print the null-separated command line from /proc.

Read process environment

Inspect environment variables of a process when permitted.

↗#

bashANYprocenvironment

bash

tr "\0" "
" < /proc/1234/environ | head

Inspect environment variables of a process when permitted.

List open descriptors via /proc

Inspect file descriptors directly from procfs.

↗#

bashANYprocfd

bash

ls -l /proc/1234/fd | head

Inspect file descriptors directly from procfs.

Show resource limits

Display RLIMIT values for a process.

↗#

bashANYproclimits

bash

cat /proc/1234/limits

Display RLIMIT values for a process.

Show memory map via /proc

Inspect mapped memory regions and permissions.

↗#

bashANYprocmapsmemory

bash

head -40 /proc/1234/maps

Inspect mapped memory regions and permissions.

Show detailed memory map

Inspect detailed per-region memory accounting.

↗#

bashANYprocsmapsmemory

bash

head -80 /proc/1234/smaps

Inspect detailed per-region memory accounting.

Show kernel stack for PID

Inspect a sleeping task kernel stack when permitted.

↗#

bashANYprocstack

bash

sudo cat /proc/1234/stack

Inspect a sleeping task kernel stack when permitted.

Show scheduler details

Inspect scheduling statistics and vruntime data.

↗#

bashANYprocscheduler

bash

cat /proc/1234/sched | head -40

Inspect scheduling statistics and vruntime data.

Tracing System Calls and Libraries

Trace syscalls, signals, and shared-library calls.

Trace a command with strace

Trace syscalls made by a new command.

↗#

bashANYstracesyscalls

bash

strace -o trace.log ./program

Trace syscalls made by a new command.

Attach strace to a running PID

Attach to a live process and trace syscalls.

↗#

bashANYstraceattach

bash

sudo strace -p 1234

Attach to a live process and trace syscalls.

Trace child processes too

Write one trace file per process and follow forks.

↗#

bashANYstraceforks

bash

strace -ff -o trace ./server

Write one trace file per process and follow forks.

Trace network syscalls

Focus on network-related system calls only.

↗#

bashANYstracenetwork

bash

strace -e trace=network -p 1234

Focus on network-related system calls only.

Trace file syscalls

Focus on file and pathname operations.

↗#

bashANYstracefiles

bash

strace -e trace=file -p 1234

Focus on file and pathname operations.

Trace library calls

Trace dynamic library calls if ltrace is installed.

↗#

bashANYltracelibraries

bash

ltrace -o ltrace.log ./program

Trace dynamic library calls if ltrace is installed.

Profile hot code paths

Sample hot functions on the system in real time.

↗#

bashANYperfprofiling

bash

sudo perf top

Sample hot functions on the system in real time.

Record perf samples for PID

Collect CPU samples for one PID over time.

↗#

bashANYperfprofiling

bash

sudo perf record -p 1234 -- sleep 30

Collect CPU samples for one PID over time.

Inspect recorded samples

Analyze a perf recording interactively.

↗#

bashANYperfprofiling

bash

sudo perf report

Analyze a perf recording interactively.

Debuggers and Core Dumps

Attach debuggers and work with core files.

Attach gdb to PID

Attach a debugger to a running process.

↗#

bashANYgdbattach

bash

gdb -p 1234

Attach a debugger to a running process.

Batch backtrace with gdb

Collect all-thread backtraces from a live process.

↗#

bashANYgdbbacktrace

bash

gdb -batch -ex "thread apply all bt" -p 1234

Collect all-thread backtraces from a live process.

List captured core dumps

List core dumps managed by systemd-coredump.

↗#

bashANYcoredumpctlcore-dumps

bash

coredumpctl list

List core dumps managed by systemd-coredump.

Open latest core in gdb

Load the newest core dump for a PID into gdb.

↗#

bashANYcoredumpctlgdb

bash

coredumpctl gdb 1234

Load the newest core dump for a PID into gdb.

Enable core dumps in shell

Allow the shell to generate core dumps.

↗#

bashANYcore-dumpulimit

bash

ulimit -c unlimited

Allow the shell to generate core dumps.

More in Linux Processes

Linux systemd and Service Processes

systemd-oriented process inspection, signaling, cgroup views, transient units, and service troubleshooting.

Linux Signals and Job Control

Linux signals, process groups, shell job control, and safe batch-termination patterns.

Linux Process Monitoring

Interactive and sampled monitoring for Linux processes, threads, memory, sockets, and scheduler behavior.

Linux Processes Cheat Sheet

Comprehensive Linux process inspection, control, scheduling, and backgrounding workflows.

Recommended next

No recommendations yet.

Browse all sheets →