Page 1176
| state %c | One character from the string RSDZT where R is running, S is sleeping in an interruptible wait, D is sleeping in an uninterruptible wait or swapping, Z is zombie, and T is traced or stopped (on a signal). |
| ppid %d | The PID of the parent. |
| pgrp %d | The process group ID of the process. |
| session %d | The session ID of the process. |
| tty %d | The tty the process uses. |
| tpgid %d | The process group ID of the process that currently owns the tty that the process is connected to. |
| flags %u | The flags of the process. Currently, every flag has the math bit set because crt0.s checks for math emulation, so this is not included in the output. This is probably a bug because not every process is a compiled C program. The math bit should be a decimal 4, and the traced bit is decimal 10. |
| minflt %u | The number of minor faults the process has made, those that have not required loading a memory page from disk. |
| cminflt %u | The number of minor faults that the process and its children have made. |
| majflt %u | The number of major faults the process has made, those that have required loading a memory page from disk. |
| cmajflt %u | The number of major faults that the process and its children have made. |
| utime %d | The number of jiffies that this process has been scheduled in user mode. |
| stime %d | The number of jiffies that this process has been scheduled in kernel mode. |
| cutime %d | The number of jiffies that this process and its children have been scheduled in user mode. |
| cstime %d | The number of jiffies that this process and its children have been scheduled in kernel mode. |
| counter %d | The current maximum size in jiffies of the process's next timeslice, or what is currently left of its current timeslice if it is the currently running process. |
| priority %d | The standard nice value, plus fifteen. The value is never negative in the kernel. |
| timeout %u | The time in jiffies of the process's next time-out. |
| itrealvalue %u | The time (in jiffies) before the next SIGALRM is sent to the process due to an interval timer. |
| starttime %d | Time the process started in jiffies after system boot. |
| vsize %u | Virtual memory size. |
| rss %u | Resident set size: Number of pages the process has in real memory, minus 3 for administrative purposes. This is just the pages that count toward text, data, or stack space. This does not include pages that have not been demand-loaded in or that are swapped out. |
| rlim %u | Current limit in bytes on the rss of the process (usually 2,147,483,647). |
| startcode %u | The address above which program text can run. |
| endcode %u | The address below which program text can run. |
| startstack %u | The address of the start of the stack. |
| kstkesp %u | The current value of esp (32-bit stack pointer), as found in the kernel stack page for the process. |
| kstkeip %u | The current EIP (32-bit instruction pointer). |
| signal %d | The bitmap of pending signals (usually0). |
| blocked %d | The bitmap of blocked signals (usually 0, 2 for shells). |
Page 1177
sigignore %d The bitmap of ignored signals.
sigcatch %d The bitmap of catched signals.
wchan %u This is the "channel" in which the process is waiting. This is the address of
a system call and can be looked up in a name list if you need a textual name.
(If you have an up-to-date /etc/psdatabase, then try
ps -l to see the WCHAN field in action.)
| |
| cpuinfo | This is a collection of CPU and system architecture dependent items; for each supported architecture is a different list. The only two common entries are cpu, which is the CPU currently in use, and BogoMIPS, a system constant that is calculated during kernel initialization. |
| devices | Text listing of major numbers and device groups. This can be used by MAKEDEV scripts for consistency with the kernel. |
| dma | This is a list of the registered ISA DMA (direct memory access) channels in use. |
| filesystems | A text listing of the filesystems that were compiled into the kernel. Incidentally, this is used by mount(1) to cycle through different filesystems when none is specified. |
| interrupts | This is used to record the number of interrupts per each IRQ on (at least) the i386 architecture. Very easy to read formatting done in ASCII. |
| ioports | This is a list of currently registered input-output port regions that are in use. |
| kcore | This file represents the physical memory of the system and is stored in the core file format. With this pseudo-file and an unstripped kernel (/usr/src/linux/tools/zSystem) binary, GDB can be used to examine the current state of any kernel data structures. |
| The total length of the file is the size of physical memory (RAM) plus 4KB. | |
| kmsg | This file can be used instead of the syslog(2) system call to log kernel messages. A process must have superuser privileges to read this file, and only one process should read this file. This file should not be read if a syslog process is running that uses the syslog(2) system call facility to log kernel messages. |
| Information in this file is retrieved with the dmesg(8) program. | |
| ksyms | This holds the kernel exported symbol definitions used by the modules(X) tools to dynamically link and bind loadable modules. |
| loadavg | The load average numbers give the number of jobs in the run queue averaged over 1, 5, and 15 minutes. They are the same as the load average numbers given by uptime(1) and other programs. |
| malloc | This file is only present if CONFIGDEBUGMALLOC was defined during compilation. |
| meminfo | This is used by free(1) to report the amount of free and used memory (both physical and swap) on the system as well as the shared memory and buffers used by the kernel. |
| It is in the same format as free(1) except in bytes rather than KB. | |
| modules | A text list of the modules that have been loaded by the system. |
| net | Various net pseudo-files, all of which give the status of some part of the networking layer. These files contain ASCII structures and are therefore readable with cat. However, the standard netstat(8) suite provides much cleaner access to these files. |
| arp | This holds an ASCII readable dump of the kernel ARP table used for address resolutions. It will show both dynamically learned and pre-programmed ARP entries. The format is |
IP address HW type Flags HW address 10.11.100.129 0x1 0x6 00:20:8A:00:0C:5A 10.11.100.5 0x1 0x2 00:C0:EA:00:00:4E 44.131.10.6 0x3 0x2 GW4PTS | |
| IP address is the IPv4 address of the machine. The HW type is the hardware type of the address from RFC 826. The flags are the internal flags of the ARP structure (as defined in /usr/include/linux/if_arp.h) and the HW address is the physical layer mapping for that IP address if it is known. |