So i was running this command: sysdig evt.dir=\< and not ( ) , and there were a few results that seemed kind of strange. There are two processes, one named gmain and the other InputThread. They're threads, so they don't show up on top. In htop, when enabling show user threads and kernel threads, I have to take the thread ids from sysdig and correlate them to the htop output. Some of the comm names there are Xorg, libwhisker.so.

In /proc, the ids there are non existent, and ps does not show them as well. Because they're threads, they're supposed to be in /proc/pid/task/tid. If i were to ls /proc, the directories are non existent, but i'm able to cd into /proc/ even though they're not there. And also the one that leaves me puzzled is, if i were to run sysdig and start running firefox, the entire machine hangs.

And so the question is, is this supposed to happen? Is the use of sysdig kernel probes and a running firefox a bad thing? Why do these process ids that i got from sysdig not appear when i do an ls, but a cd into them works? What is gmain, which according to only 2 relevant entries in a google search, is a gnome associated process, but i'm running xfce?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.