Skip to main content
emisar

Process forensics

v0.1.4

Deep per-process diagnostics for "why is this process stuck / slow / leaking?" — strace (HIGH RISK; slows the target), pid memory maps, per-thread state, /proc walking, gdb backtrace, full lsof, syscall summary. Read-only — but strace and gdb attach via ptrace and WILL slow the target.

7 allowed by default 3 need approval by default
Pack ID
process-forensics
Vendor
emisar
OS
linux
Actions
10

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install process-forensics --hash sha256:4b54b7c5d75dd5c74c08c2ef6bb0f13c77c26eda44336d7d11c825d70e346d37

Actions 10 total

View on GitHub
  • forensics.gdb_backtrace exec high

    gdb -ex "thread apply all bt"

    Attaches gdb to one PID and dumps native stack for every thread, then detaches. The target is briefly stopped during the dump.

    View source on GitHub
  • forensics.pid_io exec low

    /proc/PID/io

    Show cumulative read/write byte counts for one PID. Use to identify IO hogs.

    View source on GitHub
  • forensics.pid_maps exec low

    /proc/PID/maps

    Show memory map for one PID. Use to see loaded libraries + heap/stack ranges.

    View source on GitHub
  • forensics.pid_open_files exec low

    lsof -p <pid>

    List all open files (regular, sockets, pipes) for one PID. Richer than /proc/PID/fd alone.

    View source on GitHub
  • forensics.pid_smaps_summary exec low

    /proc/PID/smaps_rollup

    Show aggregated memory stats — Rss, Pss, Shared, Private. Better than RSS for diagnosing memory pressure.

    View source on GitHub
  • forensics.pid_status exec low

    /proc/PID/status

    Show full /proc/PID/status — uid/gid, capability set, signal state, oom score.

    View source on GitHub
  • forensics.pid_syscall exec low

    /proc/PID/syscall

    Show current syscall (or "running" if user-space). Snapshot of where the kernel is for one thread.

    View source on GitHub
  • forensics.pid_threads_state exec low

    Per-thread state for one PID

    Tabulates each thread's state (R/S/D/Z) from /proc/PID/task/*/status.

    View source on GitHub
  • forensics.strace_pid_short exec high

    strace -p <pid> (5 seconds)

    Attach strace to one PID for 5 seconds. Slows the target process significantly while attached. Detaches automatically.

    View source on GitHub
  • forensics.strace_summary exec high

    strace -c -p <pid> (5 seconds)

    Attach strace in counting mode for 5 seconds — outputs a syscall-frequency table. Slows target less than -y mode but still significant.

    View source on GitHub
← Back to registry
Pack reference Publish your own →