FORKSTAT

Section: Maintenance Commands (8)
Updated: 8 February 2023
Index Return to Main Contents
 

NAME

forkstat - a tool to show process fork/exec/exit activity

 

SYNOPSIS

forkstat [options]

 

DESCRIPTION

Forkstat is a program that logs process fork(), exec(), exit(), coredump and process name change activity. It is useful for monitoring system behaviour and to track down rogue processes that are spawning off processes and potentially abusing the system.

Note that forkstat uses the Linux netlink connector to gather process activity and this may miss events if the system is overly busy. Netlink connector also requires root privilege.

Forkstat will display several columns of process related information:
TitleDescription
TimeWhen the fork/exec/exit event occurred.
EventType of event.
PIDProcess or thread ID.
InfoParent or child if a fork, or process exit(2) value.
Duration On exit, the duration the command ran for in seconds.
Process The process name. The name will be in [ ] brackets if it is a kernel thread.
 

OPTIONS

forkstat options are as follow:
-c
use the process 16 character comm field for the process name rather than command line information.
-d
strip off the directory path from the process name.
-D seconds
specify duration in seconds to run forkstat.
-e
specify events to trace as a comma separated list. By default the fork, exec and exit events are traced. Available events are:
EventDescription
forkforks
execexecs
exitexits
corecore dumps
commprocess name changes in comm field
cloneclone (normally on thread creation)
ptrceptrace attach or detach
uiduid/gid events
sidsid events
allall the events above
-E
enable all events, equivalent to -e all
-g
show glyph annotations of events, useful for easier identification of different events.
-h
show brief help summary.
-l
set stdout to line-buffered mode.
-p pgrpid
only show processes that match the process group id pgrpid
-r
run with real time FIFO scheduling with maximum priority to keep up with high volumes of process events.
-s
show short process name information.
-S
show event statistics.
-q
run quietly and enable the -S option.
-x
show extra process related information: user ID and TTY of the process.
-X
equivalent to options -E -g -r -S -x, all events, glyphs, real time FIFO scheduling, statistics and extra process information.
 

EXAMPLES

Show process activity with short process names and directory base path stripped off:

forkstat -s -d

Trace forks and core dumps only:

forkstat -e fork,core

Trace all events and print statistics at end:

forkstat -e all -S

Trace all events for 10 minutes:

forkstat -E -D 600

Trace clones for 1 minute:

forkstat -e clone -D 60
 

SEE ALSO

vmstat(8)  

AUTHOR

forkstat was written by Colin Ian King <colin.i.king@gmail.com>. Thanks also for contributions from Philipp Gesang.

This manual page was written by Colin Ian King <colin.i.king@gmail.com>, for the Ubuntu project (but may be used by others).  

COPYRIGHT

Copyright © 2014-2021 Canonical Ltd, Copyright © 2021-2023 Colin Ian King.
This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.


 

Index

NAME
SYNOPSIS
DESCRIPTION
OPTIONS
EXAMPLES
SEE ALSO
AUTHOR
COPYRIGHT

This document was created by man2html, using the manual pages.
Time: 08:21:18 GMT, March 29, 2024