Report: Processes
A process is a running instance of an executable. More specifically, it is an entry in a Linux kernel data structure consisting of the program instruction set and dependent code, along with data read in from a file, network socket, or other input, and a set of one or more threads that execute instructions on the data.
Report Data: Processes
Following are the processes running at the time the memory snapshot was taken of the centos 6 - 2.6.32-696.28.1.el6.x86_64 image from the samples gallery (requires authentication).
The following table describes each column of the reported data.
Column | Description | Notes |
---|---|---|
Pid | The process ID | |
Ppid | The parent process's process ID | Identifies the process from which this process was spawned |
Comm | ||
Real/Suid/Effective | ||
Arg | Command line submitted to the executable at start time | Can be found via cat .proc/{pid}/cmdline for each process |
Cwd | Current working directory of the process | Can be found via sudo ls -l /proc/{pid}/cwd for each process |
Details | [This is a link to process details described below] |
Report Data: Process Detail
Following is a sample of the process detail for each process from the
list above at the time the memory snapshot was taken of the
centos 6 - 2.6.32-696.28.1.el6.x86_64
image from the samples gallery (requires authentication).
Details
Environment Variables
Page Tables (userland only)
Column | Description | Notes |
---|---|---|
Addr | ||
Size | ||
Offset | ||
Flags | ||
Name |
Forensic Hints
The same set of processes can be obtained from a running Linux
system via the ps -e
command; any difference between the set
(a) read from usermode and (b) derived from memory inspection should be
investigated, as discussed here.