Hi All,

I need to monitor the changes in the procfs, in particular in /proc/net/tcp file. I tried inotify but it doesn't work with proc as it is not a regular file system. I need to catch the changes almost instantly. Any ideas?

Best,
Chris

Well, this is the programming forum, so you came to the right place.

Perl might be your best bet. Suck in the whole file (/proc/net/tcp) as though it were a regular file. Knock yourself out analyzing it. Then sleep for a second or five and do it all again.

Hope this helps.

Ahhhh - you sure this is really the way you want to do this ???.

Conceptually, the contents of a procfs "file" don't exist until you (userland) query it. The data is exposed in response to the query.
It doesn't "change" until you look.

Classic "observer effect" ...

Fine. That's all krizzz wants. Or am I missing your point?

I was mainly responding to this bit.
Your solution will work depending on the frequency I guess.

krizzz? Does this work for you?

Thank you for your answers and sorry for my delayed response. Yes, I know that I can't really monitor it in the real time. Let me give you some more details so you know what the actual problem is. I need to monitor the system sockets. In particular I have to discover the event of the new socket creation as immediately as possible. This is my goal. The problem is I have to do it from the user space with no kernel mods/patches/etc. involved whatsoever. I can't even use the hooks (similar to those that rootkits use) to "patch kernel" on fly and "replace" standard system calls to monitor the particular system call. I've gone through ptrace already but stumbled at the signaling issues which are pain to deal with when tracing multiple forks/vforks and all other flavors of sys_clone. Even strace doesn't deal with them correctly. So, if you have any other ideas they will be appreciated.

Thanks
Chris

I don't think there's any magic bullet here. Just loop without sleeping, but nice() your user process down so you don't drag down everyone else.

This solution is sleezy and messy, and I don't like it. But I don't think there's any magic bullet.

Thank you, I actually added a usleep() to ease down the polling intensity and the implementation seems just good enough for what I'm doing. BTW, could you think of any implementation involving stock kernel modules? I looked at kernel debugging and relayfs.

Kernel stuff? Outta my league here. Anyone else?