how to investigate what a process is doing?

Question

I know this can be checked from /proc/PID directory,

but don't know how to,

can any one show me the way?

Answer 1

If you are looking for monitoring the system calls being made by a process, look into using strace.

Answer 2

I rely on the strace command. But it only tells what system calls the process is making. It could be enough though...

It is possible to bind a running process to strace at runtime.

Obviously, gdb can also be used.

Answer 3

what type of information are you looking for ? The pseudo-directories under /proc/pid should be pretty much self explanatory. It really depends what your looking for. For general mem and cpu usage a tool like top is probably better since it updates the stats for a configured interval

Answer 4

Usually strace is the answer to this question. The simplest method is to run a command using strace directly, for example:

wichert@fog:~$ strace ls
execve("/bin/ls", ["ls"], [/* 16 vars */]) = 0
brk(0)                                  = 0x9fa8000
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f0a000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)

This does not work for already running processes such as PHP. Luckily you can also attach strace to an existing process using the -p parameter. For example:

wichert@fog:~$ strace -p 3761
Process 3761 attached - interrupt to quit
select(16, [5 7 8], NULL, [5 7 8], {0, 580000}) = 0 (Timeout)
alarm(0)                                = 62
rt_sigprocmask(SIG_BLOCK, [ALRM], [], 8) = 0
rt_sigaction(SIGALRM, {SIG_DFL}, {0x809a270, [], 0}, 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0

For daemons which spawn other processes you may need to use the -f parameter as well.

Besides the always useful strace you may also want to look at ltrace. ltrace is similar to strace, but it shows library calls instead of system calls. An example:

[one;~]-6> ltrace ls
__libc_start_main(0x804e5f0, 1, 0xbfdb7254, 0x8059a10, 0x8059a00 <unfinished ...>
setlocale(6, "")                                                                                 = "LC_CTYPE=en_GB.UTF-8;LC_NUMERIC="...
bindtextdomain("coreutils", "/usr/share/locale")                                                 = "/usr/share/locale"
textdomain("coreutils")                                                                          = "coreutils"
__cxa_atexit(0x8051860, 0, 0, 0xb7f65ff4, 0xbfdb71b8)                                            = 0
isatty(1)                                                                                        = 1
getenv("QUOTING_STYLE")                                                                          = NULL

Please note that you will also see a fair amount of internal libc calls as well, so the output could be more verbose than you expect.