Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
A process is a running instance of an executable. More specifically, it is an entry in a Linux kernel data structure consisting of the program instruction set and dependent code, along with data read in from a file, network socket, or other input, and a set of one or more threads that execute instructions on the data.
Report Data: Processes
Following are the processes running at the time the memory snapshot was taken of the centos 6 - 2.6.32-696.28.1.el6.x86_64 image from the samples gallery (requires authentication).
The following table describes each column of the reported data.
| Column | Description | Notes |
|---|---|---|
| Pid | The process ID | |
| Ppid | The parent process's process ID | Identifies the process from which this process was spawned |
| Comm | ||
| Real/Suid/Effective | ||
| Arg | Command line submitted to the executable at start time | Can be found via cat .proc/{pid}/cmdline for each process |
| Cwd | Current working directory of the process | Can be found via sudo ls -l /proc/{pid}/cwd for each process |
| Details | [This is a link to process details described below] |
Report Data: Process Detail
Following is a sample of the process detail for each process from the
list above at the time the memory snapshot was taken of the
centos 6 - 2.6.32-696.28.1.el6.x86_64
image from the samples gallery (requires authentication).
Details
Environment Variables
Page Tables (userland only)
| Column | Description | Notes |
|---|---|---|
| Addr | ||
| Size | ||
| Offset | ||
| Flags | ||
| Name |
Forensic Hints
The same set of processes can be obtained from a running Linux
system via the ps -e command; any difference between the set
(a) read from usermode and (b) derived from memory inspection should be
investigated, as discussed here.