Linux /proc and Process Debugging

Low-level Linux process inspection with /proc, syscall tracing, profilers, debuggers, and core dumps.

View
StandardDetailedCompact
Export
Copy the compact sheet, download it, or print it.
Download
`D` dense toggle · `C` copy all

/proc Process Filesystem

Use /proc for low-level process inspection.

Read process command line

Print the null-separated command line from /proc.

bashANYproccmdline
bash
tr "\0" " " < /proc/1234/cmdline; echo
Notes

Print the null-separated command line from /proc.

Read process environment

Inspect environment variables of a process when permitted.

bashANYprocenvironment
bash
tr "\0" "
" < /proc/1234/environ | head
Notes

Inspect environment variables of a process when permitted.

List open descriptors via /proc

Inspect file descriptors directly from procfs.

bashANYprocfd
bash
ls -l /proc/1234/fd | head
Notes

Inspect file descriptors directly from procfs.

Show resource limits

Display RLIMIT values for a process.

bashANYproclimits
bash
cat /proc/1234/limits
Notes

Display RLIMIT values for a process.

Show memory map via /proc

Inspect mapped memory regions and permissions.

bashANYprocmapsmemory
bash
head -40 /proc/1234/maps
Notes

Inspect mapped memory regions and permissions.

Show detailed memory map

Inspect detailed per-region memory accounting.

bashANYprocsmapsmemory
bash
head -80 /proc/1234/smaps
Notes

Inspect detailed per-region memory accounting.

Show kernel stack for PID

Inspect a sleeping task kernel stack when permitted.

bashANYprocstack
bash
sudo cat /proc/1234/stack
Notes

Inspect a sleeping task kernel stack when permitted.

Show scheduler details

Inspect scheduling statistics and vruntime data.

bashANYprocscheduler
bash
cat /proc/1234/sched | head -40
Notes

Inspect scheduling statistics and vruntime data.

Tracing System Calls and Libraries

Trace syscalls, signals, and shared-library calls.

Trace a command with strace

Trace syscalls made by a new command.

bashANYstracesyscalls
bash
strace -o trace.log ./program
Notes

Trace syscalls made by a new command.

Attach strace to a running PID

Attach to a live process and trace syscalls.

bashANYstraceattach
bash
sudo strace -p 1234
Notes

Attach to a live process and trace syscalls.

Trace child processes too

Write one trace file per process and follow forks.

bashANYstraceforks
bash
strace -ff -o trace ./server
Notes

Write one trace file per process and follow forks.

Trace network syscalls

Focus on network-related system calls only.

bashANYstracenetwork
bash
strace -e trace=network -p 1234
Notes

Focus on network-related system calls only.

Trace file syscalls

Focus on file and pathname operations.

bashANYstracefiles
bash
strace -e trace=file -p 1234
Notes

Focus on file and pathname operations.

Trace library calls

Trace dynamic library calls if ltrace is installed.

bashANYltracelibraries
bash
ltrace -o ltrace.log ./program
Notes

Trace dynamic library calls if ltrace is installed.

Profile hot code paths

Sample hot functions on the system in real time.

bashANYperfprofiling
bash
sudo perf top
Notes

Sample hot functions on the system in real time.

Record perf samples for PID

Collect CPU samples for one PID over time.

bashANYperfprofiling
bash
sudo perf record -p 1234 -- sleep 30
Notes

Collect CPU samples for one PID over time.

Inspect recorded samples

Analyze a perf recording interactively.

bashANYperfprofiling
bash
sudo perf report
Notes

Analyze a perf recording interactively.

Debuggers and Core Dumps

Attach debuggers and work with core files.

Attach gdb to PID

Attach a debugger to a running process.

bashANYgdbattach
bash
gdb -p 1234
Notes

Attach a debugger to a running process.

Batch backtrace with gdb

Collect all-thread backtraces from a live process.

bashANYgdbbacktrace
bash
gdb -batch -ex "thread apply all bt" -p 1234
Notes

Collect all-thread backtraces from a live process.

List captured core dumps

List core dumps managed by systemd-coredump.

bashANYcoredumpctlcore-dumps
bash
coredumpctl list
Notes

List core dumps managed by systemd-coredump.

Open latest core in gdb

Load the newest core dump for a PID into gdb.

bashANYcoredumpctlgdb
bash
coredumpctl gdb 1234
Notes

Load the newest core dump for a PID into gdb.

Enable core dumps in shell

Allow the shell to generate core dumps.

bashANYcore-dumpulimit
bash
ulimit -c unlimited
Notes

Allow the shell to generate core dumps.

Recommended next

No recommendations yet.