Quote:
Originally Posted by syg00
Every "monitoring" command probably sifts through /proc - that's what it's there for. Certainly "ps" does.
|
syg00 is quite right....
strace -o tlog ps -aef;grep '/proc' tlog
open("/proc/version", O_RDONLY) = 3
open("/proc/stat", O_RDONLY) = 3
open("/proc/self/stat", O_RDONLY) = 3
open("/proc/uptime", O_RDONLY) = 3
open("/proc/sys/kernel/pid_max", O_RDONLY) = 4
open("/proc/meminfo", O_RDONLY) = 4
stat64("/proc/self/task", {st_mode=S_IFDIR|0555, st_size=0, ...}) = 0
open("/proc", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY|O_CLOEXEC) = 5
stat64("/proc/1", {st_mode=S_IFDIR|0555, st_size=0, ...}) = 0
open("/proc/1/stat", O_RDONLY) = 6
open("/proc/1/status", O_RDONLY) = 6
open("/proc/1/cmdline", O_RDONLY) = 6
stat64("/proc/2", {st_mode=S_IFDIR|0555, st_size=0, ...}) = 0
open("/proc/2/stat", O_RDONLY) = 6
open("/proc/2/status", O_RDONLY) = 6
open("/proc/2/cmdline", O_RDONLY) = 6
stat64("/proc/3", {st_mode=S_IFDIR|0555, st_size=0, ...}) = 0
open("/proc/3/stat", O_RDONLY) = 6
open("/proc/3/status", O_RDONLY) = 6
open("/proc/3/cmdline", O_RDONLY) = 6
stat64("/proc/4", {st_mode=S_IFDIR|0555, st_size=0, ...}) = 0
open("/proc/4/stat", O_RDONLY) = 6
open("/proc/4/status", O_RDONLY) = 6
open("/proc/4/cmdline", O_RDONLY) = 6
stat64("/proc/5", {st_mode=S_IFDIR|0555, st_size=0, ...}) = 0
open("/proc/5/stat", O_RDONLY) = 6
open("/proc/5/status", O_RDONLY) = 6
open("/proc/5/cmdline", O_RDONLY) = 6
.
.
.