1.\"-
2.\" Copyright (c) 2007-2009 Robert N. M. Watson
3.\" All rights reserved.
4.\"
5.\" Redistribution and use in source and binary forms, with or without
6.\" modification, are permitted provided that the following conditions
7.\" are met:
8.\" 1. Redistributions of source code must retain the above copyright
9.\" notice, this list of conditions and the following disclaimer.
10.\" 2. Redistributions in binary form must reproduce the above copyright
11.\" notice, this list of conditions and the following disclaimer in the
12.\" documentation and/or other materials provided with the distribution.
13.\"
14.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24.\" SUCH DAMAGE.
25.\"
| 1.\"-
2.\" Copyright (c) 2007-2009 Robert N. M. Watson
3.\" All rights reserved.
4.\"
5.\" Redistribution and use in source and binary forms, with or without
6.\" modification, are permitted provided that the following conditions
7.\" are met:
8.\" 1. Redistributions of source code must retain the above copyright
9.\" notice, this list of conditions and the following disclaimer.
10.\" 2. Redistributions in binary form must reproduce the above copyright
11.\" notice, this list of conditions and the following disclaimer in the
12.\" documentation and/or other materials provided with the distribution.
13.\"
14.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24.\" SUCH DAMAGE.
25.\"
|
72.It Fl s
73Display security credential information for the process.
74.It Fl t
75Display thread information for the process.
76.It Fl v
77Display virtual memory mappings for the process.
78.It Fl x
79Display ELF auxiliary vector for the process.
80.El
81.Pp
82All options generate output in the format of a table, the first field of
83which is the process ID to which the row of information corresponds.
84The
85.Fl h
86flag may be used to suppress table headers.
87.Pp
88The
89.Fl w
90flag may be used to specify a wait interval at which to repeat the printing
91of the requested process information.
92If the
93.Fl w
94flag is not specified, the output will not repeat.
95.Pp
96The
97.Fl C
98flag requests the printing of additional capability information in the file
99descriptor view.
100.Pp
101Some information, such as VM and file descriptor information, is available
102only to the owner of a process or the superuser.
103.Ss Binary Information
104Display the process ID, command, and path to the process binary:
105.Pp
106.Bl -tag -width indent -compact
107.It PID
108process ID
109.It COMM
110command
111.It PATH
112path to process binary (if available)
113.El
114.Ss Command Line Arguments
115Display the process ID, command, and command line arguments:
116.Pp
117.Bl -tag -width indent -compact
118.It PID
119process ID
120.It COMM
121command
122.It ARGS
123command line arguments (if available)
124.El
125.Ss File Descriptors
126Display detailed information about each file descriptor referenced by a
127process, including the process ID, command, file descriptor number, and
128per-file descriptor object information, such as object type and file system
129path.
130By default, the following information will be printed:
131.Pp
132.Bl -tag -width indent -compact
133.It PID
134process ID
135.It COMM
136command
137.It FD
138file descriptor number or cwd/root/jail
139.It T
140file descriptor type
141.It V
142vnode type
143.It FLAGS
144file descriptor flags
145.It REF
146file descriptor reference count
147.It OFFSET
148file descriptor offset
149.It PRO
150network protocol
151.It NAME
152file path or socket addresses (if available)
153.El
154.Pp
155The following file descriptor types may be displayed:
156.Pp
157.Bl -tag -width X -compact
158.It c
159crypto
160.It e
161POSIX semaphore
162.It f
163fifo
164.It h
165shared memory
166.It k
167kqueue
168.It m
169message queue
170.It p
171pipe
172.It s
173socket
174.It t
175pseudo-terminal master
176.It v
177vnode
178.El
179.Pp
180The following vnode types may be displayed:
181.Pp
182.Bl -tag -width X -compact
183.It -
184not a vnode
185.It b
186block device
187.It c
188character device
189.It d
190directory
191.It f
192fifo
193.It l
194symbolic link
195.It r
196regular file
197.It s
198socket
199.It x
200revoked device
201.El
202.Pp
203The following file descriptor flags may be displayed:
204.Pp
205.Bl -tag -width X -compact
206.It r
207read
208.It w
209write
210.It a
211append
212.It s
213async
214.It f
215fsync
216.It n
217non-blocking
218.It d
219direct I/O
220.It l
221lock held
222.It c
223descriptor is a capability
224.El
225.Pp
226If the
227.Fl C
228flag is specified, the vnode type, reference count, and offset fields will be
229omitted, and a new capabilities field will be included listing capabilities,
230as described in
231.Xr cap_new 2 ,
232present for each capability descriptor.
233.Ss Signal Disposition Information
234Display signal pending and disposition for a process:
235.Pp
236.Bl -tag -width ident -compact
237.It PID
238process ID
239.It COMM
240command
241.It SIG
242signal name
243.It FLAGS
244process signal disposition details, three symbols
245.Bl -tag -width X -compact
246.It P
247if signal is pending in the global process queue, - otherwise
248.It I
249if signal delivery disposition is SIGIGN, - otherwise
250.It C
251if signal delivery is to catch it, - otherwise
252.El
253.El
254.Pp
255If
256.Fl n
257switch is given, the signal numbers are shown instead of signal names.
258.Ss Thread Signal Information
259Display signal pending and blocked for a process threads:
260.Pp
261.Bl -tag -width ident -compact
262.It PID
263process ID
264.It COMM
265command
266.It TID
267thread ID
268.It SIG
269signal name
270.It FLAGS
271thread signal delivery status, two symbols
272.Bl -tag -width X -compact
273.It P
274if signal is pending for the thread, - otherwise
275.It B
276if signal is blocked in the thread signal mask, - if not blocked
277.El
278.El
279.Pp
280The
281.Fl n
282switch has the same effect as for the
283.Fl i
284switch, the signals numbers are shown instead of signal names.
285.Ss Kernel Thread Stacks
286Display kernel thread stacks for a process, allowing further interpretation
287of thread wait channels.
288If the
289.Fl k
290flag is repeated, function offsets, not just function names, are printed.
291.Pp
292This feature requires
293.Cd "options STACK"
294or
295.Cd "options DDB"
296to be compiled into the kernel.
297.Pp
298.Bl -tag -width indent -compact
299.It PID
300process ID
301.It TID
302thread ID
303.It COMM
304command
305.It TDNAME
306thread name
307.It KSTACK
308kernel thread call stack
309.El
310.Ss Security Credentials
311Display process credential information:
312.Pp
313.Bl -tag -width indent -compact
314.It PID
315process ID
316.It COMM
317command
318.It EUID
319effective user ID
320.It RUID
321real user ID
322.It SVUID
323saved user ID
324.It EGID
325effective group ID
326.It RGID
327real group ID
328.It SVGID
329saved group ID
330.It FLAGS
331credential flags
332.It GROUPS
333group set
334.El
335.Pp
336The following credential flags may be displayed:
337.Pp
338.Bl -tag -width X -compact
339.It C
340capability mode
341.El
342.Ss Thread Information
343Display per-thread information, including process ID, per-thread ID, name,
344CPU, and execution state:
345.Pp
346.Bl -tag -width indent -compact
347.It PID
348process ID
349.It TID
350thread ID
351.It COMM
352command
353.It TDNAME
354thread name
355.It CPU
356current or most recent CPU run on
357.It PRI
358thread priority
359.It STATE
360thread state
361.It WCHAN
362thread wait channel
363.El
364.Ss Virtual Memory Mappings
365Display process virtual memory mappings, including addresses, mapping
366meta-data, and mapped object information:
367.Pp
368.Bl -tag -width indent -compact
369.It PID
370process ID
371.It START
372starting address of mapping
373.It END
374ending address of mapping
375.It PRT
376protection flags
377.It RES
378resident pages
379.It PRES
380private resident pages
381.It REF
382reference count
383.It SHD
384shadow page count
385.It FL
386mapping flags
387.It TP
388VM object type
389.El
390.Pp
391The following protection flags may be displayed:
392.Pp
393.Bl -tag -width X -compact
394.It r
395read
396.It w
397write
398.It x
399execute
400.El
401.Pp
402The following VM object types may be displayed:
403.Pp
404.Bl -tag -width XX -compact
405.It --
406none
407.It dd
408dead
409.It df
410default
411.It dv
412device
413.It ph
414physical
415.It sw
416swap
417.It vn
418vnode
419.El
420.Pp
421The following mapping flags may be displayed:
422.Pp
423.Bl -tag -width X -compact
424.It C
425copy-on-write
426.It N
427needs copy
428.It S
429one or more superpage mappings are used
430.El
431.Sh EXIT STATUS
432.Ex -std
433.Sh SEE ALSO
434.Xr fstat 1 ,
435.Xr ps 1 ,
436.Xr sockstat 1 ,
437.Xr cap_enter 2 ,
438.Xr cap_new 2 ,
439.Xr ddb 4 ,
440.Xr stack 9
441.Sh AUTHORS
442.An Robert N M Watson
443.Sh BUGS
444Some field values may include spaces, which limits the extent to which the
445output of
446.Nm
447may be mechanically parsed.
448.Pp
449The display of open file or memory mapping pathnames is implemented using the
450kernel's name cache.
451If a file system does not use the name cache, or the path to a file is not in
452the cache, a path will not be displayed.
453.Pp
454.Nm
455currently supports extracting data only from a live kernel, and not from
456kernel crash dumps.
| 74.It Fl s
75Display security credential information for the process.
76.It Fl t
77Display thread information for the process.
78.It Fl v
79Display virtual memory mappings for the process.
80.It Fl x
81Display ELF auxiliary vector for the process.
82.El
83.Pp
84All options generate output in the format of a table, the first field of
85which is the process ID to which the row of information corresponds.
86The
87.Fl h
88flag may be used to suppress table headers.
89.Pp
90The
91.Fl w
92flag may be used to specify a wait interval at which to repeat the printing
93of the requested process information.
94If the
95.Fl w
96flag is not specified, the output will not repeat.
97.Pp
98The
99.Fl C
100flag requests the printing of additional capability information in the file
101descriptor view.
102.Pp
103Some information, such as VM and file descriptor information, is available
104only to the owner of a process or the superuser.
105.Ss Binary Information
106Display the process ID, command, and path to the process binary:
107.Pp
108.Bl -tag -width indent -compact
109.It PID
110process ID
111.It COMM
112command
113.It PATH
114path to process binary (if available)
115.El
116.Ss Command Line Arguments
117Display the process ID, command, and command line arguments:
118.Pp
119.Bl -tag -width indent -compact
120.It PID
121process ID
122.It COMM
123command
124.It ARGS
125command line arguments (if available)
126.El
127.Ss File Descriptors
128Display detailed information about each file descriptor referenced by a
129process, including the process ID, command, file descriptor number, and
130per-file descriptor object information, such as object type and file system
131path.
132By default, the following information will be printed:
133.Pp
134.Bl -tag -width indent -compact
135.It PID
136process ID
137.It COMM
138command
139.It FD
140file descriptor number or cwd/root/jail
141.It T
142file descriptor type
143.It V
144vnode type
145.It FLAGS
146file descriptor flags
147.It REF
148file descriptor reference count
149.It OFFSET
150file descriptor offset
151.It PRO
152network protocol
153.It NAME
154file path or socket addresses (if available)
155.El
156.Pp
157The following file descriptor types may be displayed:
158.Pp
159.Bl -tag -width X -compact
160.It c
161crypto
162.It e
163POSIX semaphore
164.It f
165fifo
166.It h
167shared memory
168.It k
169kqueue
170.It m
171message queue
172.It p
173pipe
174.It s
175socket
176.It t
177pseudo-terminal master
178.It v
179vnode
180.El
181.Pp
182The following vnode types may be displayed:
183.Pp
184.Bl -tag -width X -compact
185.It -
186not a vnode
187.It b
188block device
189.It c
190character device
191.It d
192directory
193.It f
194fifo
195.It l
196symbolic link
197.It r
198regular file
199.It s
200socket
201.It x
202revoked device
203.El
204.Pp
205The following file descriptor flags may be displayed:
206.Pp
207.Bl -tag -width X -compact
208.It r
209read
210.It w
211write
212.It a
213append
214.It s
215async
216.It f
217fsync
218.It n
219non-blocking
220.It d
221direct I/O
222.It l
223lock held
224.It c
225descriptor is a capability
226.El
227.Pp
228If the
229.Fl C
230flag is specified, the vnode type, reference count, and offset fields will be
231omitted, and a new capabilities field will be included listing capabilities,
232as described in
233.Xr cap_new 2 ,
234present for each capability descriptor.
235.Ss Signal Disposition Information
236Display signal pending and disposition for a process:
237.Pp
238.Bl -tag -width ident -compact
239.It PID
240process ID
241.It COMM
242command
243.It SIG
244signal name
245.It FLAGS
246process signal disposition details, three symbols
247.Bl -tag -width X -compact
248.It P
249if signal is pending in the global process queue, - otherwise
250.It I
251if signal delivery disposition is SIGIGN, - otherwise
252.It C
253if signal delivery is to catch it, - otherwise
254.El
255.El
256.Pp
257If
258.Fl n
259switch is given, the signal numbers are shown instead of signal names.
260.Ss Thread Signal Information
261Display signal pending and blocked for a process threads:
262.Pp
263.Bl -tag -width ident -compact
264.It PID
265process ID
266.It COMM
267command
268.It TID
269thread ID
270.It SIG
271signal name
272.It FLAGS
273thread signal delivery status, two symbols
274.Bl -tag -width X -compact
275.It P
276if signal is pending for the thread, - otherwise
277.It B
278if signal is blocked in the thread signal mask, - if not blocked
279.El
280.El
281.Pp
282The
283.Fl n
284switch has the same effect as for the
285.Fl i
286switch, the signals numbers are shown instead of signal names.
287.Ss Kernel Thread Stacks
288Display kernel thread stacks for a process, allowing further interpretation
289of thread wait channels.
290If the
291.Fl k
292flag is repeated, function offsets, not just function names, are printed.
293.Pp
294This feature requires
295.Cd "options STACK"
296or
297.Cd "options DDB"
298to be compiled into the kernel.
299.Pp
300.Bl -tag -width indent -compact
301.It PID
302process ID
303.It TID
304thread ID
305.It COMM
306command
307.It TDNAME
308thread name
309.It KSTACK
310kernel thread call stack
311.El
312.Ss Security Credentials
313Display process credential information:
314.Pp
315.Bl -tag -width indent -compact
316.It PID
317process ID
318.It COMM
319command
320.It EUID
321effective user ID
322.It RUID
323real user ID
324.It SVUID
325saved user ID
326.It EGID
327effective group ID
328.It RGID
329real group ID
330.It SVGID
331saved group ID
332.It FLAGS
333credential flags
334.It GROUPS
335group set
336.El
337.Pp
338The following credential flags may be displayed:
339.Pp
340.Bl -tag -width X -compact
341.It C
342capability mode
343.El
344.Ss Thread Information
345Display per-thread information, including process ID, per-thread ID, name,
346CPU, and execution state:
347.Pp
348.Bl -tag -width indent -compact
349.It PID
350process ID
351.It TID
352thread ID
353.It COMM
354command
355.It TDNAME
356thread name
357.It CPU
358current or most recent CPU run on
359.It PRI
360thread priority
361.It STATE
362thread state
363.It WCHAN
364thread wait channel
365.El
366.Ss Virtual Memory Mappings
367Display process virtual memory mappings, including addresses, mapping
368meta-data, and mapped object information:
369.Pp
370.Bl -tag -width indent -compact
371.It PID
372process ID
373.It START
374starting address of mapping
375.It END
376ending address of mapping
377.It PRT
378protection flags
379.It RES
380resident pages
381.It PRES
382private resident pages
383.It REF
384reference count
385.It SHD
386shadow page count
387.It FL
388mapping flags
389.It TP
390VM object type
391.El
392.Pp
393The following protection flags may be displayed:
394.Pp
395.Bl -tag -width X -compact
396.It r
397read
398.It w
399write
400.It x
401execute
402.El
403.Pp
404The following VM object types may be displayed:
405.Pp
406.Bl -tag -width XX -compact
407.It --
408none
409.It dd
410dead
411.It df
412default
413.It dv
414device
415.It ph
416physical
417.It sw
418swap
419.It vn
420vnode
421.El
422.Pp
423The following mapping flags may be displayed:
424.Pp
425.Bl -tag -width X -compact
426.It C
427copy-on-write
428.It N
429needs copy
430.It S
431one or more superpage mappings are used
432.El
433.Sh EXIT STATUS
434.Ex -std
435.Sh SEE ALSO
436.Xr fstat 1 ,
437.Xr ps 1 ,
438.Xr sockstat 1 ,
439.Xr cap_enter 2 ,
440.Xr cap_new 2 ,
441.Xr ddb 4 ,
442.Xr stack 9
443.Sh AUTHORS
444.An Robert N M Watson
445.Sh BUGS
446Some field values may include spaces, which limits the extent to which the
447output of
448.Nm
449may be mechanically parsed.
450.Pp
451The display of open file or memory mapping pathnames is implemented using the
452kernel's name cache.
453If a file system does not use the name cache, or the path to a file is not in
454the cache, a path will not be displayed.
455.Pp
456.Nm
457currently supports extracting data only from a live kernel, and not from
458kernel crash dumps.
|