# Functions
GetProcNS returns the namespace ID of a given namespace and process.
GetAllProcNS return all the namespaces of a given process.
GetMountNSFirstProcesses return mapping between mount NS to its first process (aka, the process with the oldest start time in the mount NS).
GetProcNS returns the namespace ID of a given namespace and process.
GetProcExePath returns the path to the executable of a process given its PID.
GetProcNS returns the namespace ID of a given namespace and process.
GetProcNSDirPath returns the path to the directory containing the namespaces of a process given its PID.
GetProcNSPath returns the path to a specific namespace of a process given its PID and the namespace name.
GetStatPath returns the path to the stat file of a process given its PID.
GetStatusPath returns the path to the status file of a process given its PID.
GetTaskPath returns the path to the task directory of a process given its PID.
GetTaskStatPath returns the path to the stat file of a thread given its PID and TID.
GetTaskStatusPath returns the path to the status file of a thread given its PID and TID.
NewProcStat reads the /proc/<pid>/stat file and parses it into a ProcStat struct.
NewProcStatFields reads the /proc/<pid>/stat file and parses it into a ProcStat struct.
NewProcStatus reads the /proc/<pid>/status file and parses it into a ProcStatus struct.
NewProcStatusFields reads the /proc/<pid>/status file and parses it into a ProcStatus struct.
NewThreadProcStat reads the /proc/<pid>/task/<tid>/stat file and parses it into a ProcStat struct.
NewThreadProcStatFields reads the /proc/<pid>/task/<tid>/stat file and parses it into a ProcStat struct.
NewThreadProcStatus reads the /proc/<pid>/task/<tid>/status file and parses it into a ProcStatus struct.
NewThreadProcStatusFields reads the /proc/<pid>/task/<tid>/status file and parses it into a ProcStatus struct.
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
ReadFile reads the content of a file and returns it as a byte slice.
# Constants
uint64 %016llx cap_user_header_t (u64) // Ambient capability set.
uint64 %016llx cap_user_header_t (u64) // Mask of capabilities bounding set.
uint64 %016llx cap_user_header_t (u64) // Mask of effective capabilities.
uint64 %016llx cap_user_header_t (u64) // Mask of inheritable capabilities.
uint64 %016llx cap_user_header_t (u64) // Mask of permitted capabilities.
bool %llu int // Is the process dumping core? (0 = no, 1 = yes).
uint64 %016llx unsigned long // Mask of CPUs on which this process may run.
string %s char * // Same as previous, but in "list format" (e.g.
uint64 %llu unsigned int // Number of file descriptor slots currently allocated.
(separator is '\t') UidReal uint64 %llu uid_t (unsigned int) // Real UID UidEffective uint64 %llu uid_t (unsigned int) // Effective UID UidSaved uint64 %llu uid_t (unsigned int) // Saved set UID UidFS uint64 %llu uid_t (unsigned int) // Filesystem UID.
[]uint64 %llu gid_t (unsigned int) // Supplementary group list (separator is ' ').
uint64 %8lu long // Size of hugetlb memory portions (kB).
bool %c char // Is the process a kernel thread? (0 = no, 1 = yes).
uint64 %016llx unsigned long // Mask of memory nodes allowed to this process.
string %s char * // Same as previous, but in "list format" (e.g.
string %s char[64] // Name of the process.
uint64 %llu pid_t (int) // NUMA group ID (if available).
bool %d bool // Was the process started with no new privileges? (0 = no, 1 = yes).
uint64 %llu unsigned long // Number of involuntary context switches.
[]uint64 %llu pid_t (int) // Process group ID in each of the PID namespaces of which pid is a member.
[]uint64 %llu pid_t (int) // Thread ID in each of the PID namespaces of which pid is a member.
[]uint64 %llu pid_t (int) // Namespace session ID in each of the PID namespaces of which pid is a member.
[]uint64 %llu pid_t (int) // Thread group ID in each of the PID namespaces of which pid is a member.
uint64 %llu pid_t (int) // Process ID.
uint64 %llu pid_t (int) // Parent Process ID.
uint64 %8llu unsigned long // Size of resident anonymous memory (kB).
uint64 %8llu unsigned long // Size of resident file mappings (kB).
uint64 %8llu unsigned long // Size of shared memory resident (kB).
uint64 %llu int // Seccomp mode of the process.
uint64 %llu int // Number of seccomp filters attached to the process.
uint64 %016llx sigset_t (unsigned long) // Mask of signals that thread is sharing.
uint64 %016llx sigset_t (unsigned long) // Mask of signals being blocked.
uint64 %016llx sigset_t (unsigned long) // Mask of signals being caught.
uint64 %016llx sigset_t (unsigned long) // Mask of signals being ignored.
uint64 %016llx sigset_t (unsigned long) // Mask of signals pending for the thread.
Fields from /proc/<pid>/[task/<tid>/]status file:.
string %s char * // Speculation indirect branch mitigation state.
string %s char * // Speculation flaw mitigation state.
uint64 %lu unsigned long address below which program command line is placed.
uint64 %lu unsigned long address above which program command line is placed.
uint64 %lu unsigned long bitmap of blocked signals.
int64 %ld u64 guest time of the process's children.
uint64 %lu unsigned long number of major faults (all childs).
uint64 %lu unsigned long number of minor faults (all childs).
always 0 (not maintained).
string %s char[64] the name of the task - up to 64 + 2 for ().
int64 %ld u64 kernel mode jiffies (all childs).
int64 %ld u64 user mode jiffies (all childs).
uint64 %llu u64 time spent waiting for block IO.
byte %c char // State of the process (leftmost char of the field).
uint64 %lu unsigned long address below which program text can run.
uint64 %lu unsigned long address below which program data+bss is placed.
uint64 %lu unsigned long address below which program environment is placed.
uint64 %lu unsigned long address above which program environment is placed.
int32 %d int the thread's exit_code in the form reported by the waitpid system call.
int32 %d int signal to be sent to parent when we die.
uint32 %u unsigned int process flags.
uint64 %lu u64 guest time of the process.
always 0 (obsolete).
uint64 %lu unsigned long current value of instruction pointer.
uint64 %lu unsigned long current value of stack pointer.
No description provided by the author
uint64 %lu unsigned long number of major faults.
No description provided by the author
uint64 %lu unsigned long number of minor faults.
int32 %ld int process nice value.
always 0 (not maintained).
int32 %ld int number of threads in this process.
int32 %d pid_t (int) process group id.
int32 %d pid_t (int) process id.
uint32 %u unsigned int scheduling policy.
int32 %d pid_t (int) parent process id.
int32 %ld int process priority.
uint32 %d unsigned int current CPU.
greater than average size (~95) calculated from ~1.4k stat files.
int64 %ld unsigned long resident set memory size.
uint64 %lu unsigned long current limit in bytes on the rss.
uint32 %u unsigned int realtime priority.
int32 %d pid_t (int) session id.
uint64 %lu unsigned long bitmap of catched signals.
uint64 %lu unsigned long bitmap of ignored signals.
uint64 %lu unsigned long bitmap of pending signals.
uint64 %lu unsigned long address above which program heap can be expanded with brk().
uint64 %lu unsigned long address above which program text can run.
uint64 %lu unsigned long address above which program data+bss is placed.
uint64 %lu unsigned long address of the start of the main process stack.
uint64 %llu unsigned long long time the process started after system boot (in clock ticks).
byte %c char process state.
uint64 %lu u64 kernel mode jiffies (clock ticks).
int32 %d int foreground process group id of the controlling terminal.
int32 %d int controlling terminal.
No description provided by the author
No description provided by the author
greater than average size (~1290) calculated from ~700 status files.
uint64 %lu u64 user mode jiffies (clock ticks).
uint64 %lu unsigned long virtual memory size.
uint64 %lu unsigned long address of the syscall where process is in sleep mode.
uint64 %llu pid_t (int) // Thread group ID.
bool %d bool // Is transparent huge pages enabled? (0 = no, 1 = yes).
uint64 %llu int // Number of threads in process containing this thread.
uint64 %llu pid_t (int) // PID of process tracing this process.
Fields from /proc/<pid>/[task/<tid>/]status file:.
int32 %#04o int // Process umask, expressed in octal with a leading zero.
uint64 %#lx unsigned long // Untag mask.
uint64 %8llu unsigned long // Size of data segment (kB).
uint64 %8llu unsigned long // Size of text segment (kB).
uint64 %8llu unsigned long // Peak resident set size ("high water mark") (kB).
uint64 %8llu unsigned long // Locked memory size (kB).
uint64 %8llu unsigned long // Shared library code size (kB).
uint64 %8llu unsigned long // Peak virtual memory size (kB).
uint64 %8llu s64 // Pinned memory size (guaranteed never to be swapped out) (kB).
uint64 %8llu unsigned long // Page table entries size (kB).
uint64 %8llu unsigned long // Resident set size (kB).
uint64 %8llu unsigned long // Total program size (kB).
uint64 %8llu unsigned long // Size of stack segment (kB).
uint64 %8llu unsigned long // Swap size (kB).
uint64 %llu unsigned long // Number of voluntary context switches.
# Structs
https://elixir.bootlin.com/linux/v6.13/source/include/linux/ns_common.h#L12 struct ns_common inum member is unsigned int.
ProcStat represents the minimal required fields of the /proc stat file.
ProcStatus represents the minimal required fields of the /proc status file.