/PROC/{PID} content parsing

• /proc/pid/cmdline

The command that originally started the process.

• /proc/pid/cwd

A Symlink to the current working directory of the process.

• /proc/pid/environ

Contains the names and values of the environment variables that affect the process.

• /proc/pid/exe

A symlink to the original executable file, if it still exists (a process could continue running after its original EXECUTABL E has been deleted or replaced).

• /proc/pid/fd

A directory containing a symbolic link for each open file descriptor.

• /proc/pid/fdinfo

A directory containing entries which describe the position and flags for each open file descriptor.

• /proc/pid/io

This file contains IO statistics for each running process

-rchar  I/O counter: chars read

The number of bytes which this task has caused to be read from storage. This is simply the sum of bytes which this process passed to read() and pread(). It includes things like tty IO and it is unaffected by whether or not actual physical disk IO was required (the read might have been satisfied from pagecache)

   - wchar I/O counter: chars written

The number of bytes which this task has caused, or shall cause to be written to disk. Similar caveats apply here as with rchar.

   - syscr I/O counter: read syscalls

Attempt to count the number of read I/O operations, i.e. syscalls like read() and pread().

   - syscw I/O counter: write syscalls

Attempt to count the number of write I/O operations, i.e. syscalls like write() and pwrite().

   - read_bytes I/O counter: bytes read

Attempt to count the number of bytes which this process really did cause to be fetched from the storage layer. Done at the submit_bio() level, so it is accurate for block-backed filesystems. <please add status regarding NFS and CIFS at a later time>     

   - write_bytes I/O counter: bytes written

Attempt to count the number of bytes which this process caused to be sent to the storage layer. This is done at page-dirtying time.

   - cancelled_write_bytes The big inaccuracy here is truncate.

If a process writes 1MB to a file and then deletes the file, it will in fact perform no writeout. But it will have been accounted as having caused 1MB of write. In other words: The number of bytes which this process caused to not happen, by truncating pagecache. A task can cause "negative" IO too. If this task truncates some dirty pagecache, some IO which another task has been accounted for (in its write_bytes) will not be happening. We _could_ just subtract that from the truncating task‘s write_bytes, but there is information loss in doing that.

• /proc/pid/limits
• /proc/pid/maps

A text file containing information about mapped files and blocks (like heap and stack).

• /proc/pid/mem

A binary image representing the process's virtual memory, can only is accessed by a ptrace ' ing process.

• /proc/pid/mountinfo
• /proc/pid/mounts
• /proc/pid/mountstats
• /proc/pid/root

Symlink to the root path as seen by the process. For most processes this would be a link to/unless the process is running in a chroot jail.

• /proc/pid/status

Contains basic information about a process including it run state and memory usage.

• /proc/pid/task

A directory containing hard links to any of the tasks that are been started by this (i.e.: the parent) process.

References:

1, Https://en.wikipedia.org/wiki/Procfs#Linux

2, Kernel sourcecode:./documentation/filesystems/proc.txt

/PROC/{PID} content parsing