6

How can I see the raw memory data used by an application ? Like , suppose I have a file name something.sh . Now I run the command ./something.sh , and then I want see all the data its accessing in ram and all the files its accessing in my filesystem,network data or connection its using.May be the hex dump of the memory used by this application. Can I do that in ubuntu ?

Gilles 'SO- stop being evil'
  • 829,060
Tamim Addari
  • 223

4 Answers4

6

How can I see the raw memory data used by an application...

Once you have obtained the process' PID (using ps(1) or pidof(8) for instance), you may access the data in its virtual address space using /proc/PID/maps and /proc/PID/mem. Gilles wrote a very detailled answer about that here.

... and all the files its accessing in my filesystem, network data or connections

lsof can do just that. netstat may be more appropriate for network-related descriptors. For instance :

$ netstat -tln    # TCP connections, listening, don't resolve names.
$ netstat -uln    # UDP endpoints, listening, don't resolve names.
$ netstat -tuan   # TCP and UDP, all sorts, don't resolve names.
$ lsof -p PID     # "Files" opened by process PID.

Note: netstat's -p switch will allow you to print the process associated with each line (at least, your processes). To select a specific process, you can simply use grep:

$ netstat -tlnp | grep skype    # TCP, listening, don't resolve (Skype).

For more information about these tools: netstat(8) and lsof(8). See also: proc(5) (and the tools mentionned in other answers).

Community
  • 1
John WH Smith
  • 15,880
4

Partial answer:

You can see the files it accesses in real-time by using 

strace something.sh

Specifically, it shows you every system call made by the process.

Adam.at.Epsilon
  • 191
4

You can get this information through the virtual /proc file-system (under Linux only).

Try to run this command when the process is running (replace the <pid> by the PID of the observed process):

grep 'VmSize' /proc/<pid>/status

Beware, you have to have read access to the process to get these information (you cannot access it if you do not own it) !

If you want to know all the information given by /proc/<pid>/status, just do:

cat /proc/self/status
heemayl
  • 56,300
perror
  • 3,239
  • 7
  • 33
  • 45
2

If you are just interested in minimal information, try in terminal, type sudo gnome-system-monitor. Click on processes.

KimPhilby
  • 21