procexp - Going over the
Process Explorer (
procexp) is a utility I've started writing as a simple tool to demonstrate the vast swaths of information accessible by
proc_info (a.k.a system call #336, my favorite). Since then, however, and like its sibling -
jtool - the tool took a life of its own, as more and more features have been added to it, making it not just a full replacement to the default (and crummy)
top(1) utility, but also providing features available nowhere else. It is slowly living up to the golden standard - its Windows namesake - but (deliberately) through a terminal interface (which makes it perfect over SSH as well).
The tool, however, (like most of mine), was built around my own use cases and habits, so - while it's natural for me to use, many people remain unaware of its powerful yet nonintuitive features. This (and the man page, which nobody reads.. :-) aims to rectify that. There's soooo many options to cover, though, I'll just cover the latest ones.
Download Latest VersionHere
Running with a pid or
all argument will produce
grep(1)-friendly output. Running with no arguments will enter interactive mode:
You can resize the terminal window to get more/less output, remove and rearrnage columns, sort, filter.. All the things
top(1) still can't do after 15 years.. '?' is your friend
In interactive mode, will turn your MacBook or iOS device into a signal detector for the current WiFi. Useful :-)
Does not affect the process in any harmful way, and - Couldn't be simpler. Run with a pid and "core" argument, or go to process details screen and hit "c". Full core will be generated in
Listing Mach Ports!
Version 1-ε can list Mach ports and even name them(!) using some nice undocumented functions I've found (Until AAPL ruins this with an entitlement, too..). The "arrows" indicate the unidirectionality (-> send to, <- receive from).
Edit: As of 02/27 procexp shows names in quotes ("") so you can also grep all named ports easily (not all are com.apple).
02/27/2016: And, of course, JCOLOR, which makes it easier to sift out busy ports:
12/10/2016: Stack snapshot works again. This means you can use "procexp all threads" (even with SIP enabled on MacOS :-) to get stack traces of every thread in system. This is especially useful as it now retrieves thread names (helps with kernel threads!). Also tested stable on iOS 10.x.
Process Explorer - PRO!
All the fabulous features of Process Explorer, With GUI, AND remote monitoring - Coming soon!
Q & A
top(1)and wants my code - I would be immensely honored, and happily open source procexp! That would also enable it to work perfectly under SIP, since it could legally obtain entitlements..
proc_info, my favorite system call (#336). Undocumented by AAPL, of course, but wrapped by
<libproc.h>). It has since gotten functionality from
stack_snapshot(#365, my second favorite :-), miscellaneous
sysctl(2)MIBs, sandbox APIs, and the symbolication functions of my
com.apple.system-task-portsand I can't. (To my readers in 17.x.x.x - I'd gladly give you my code if you promise to replace top :-)
You can find a change log in the downloaded tar file, in "WhatsNew.txt".
v0.2 - (Some) color - Scroll list - Show power details - Show memory compression (Mavericks/iOS 7 only) v0.2.1 - Process filtering - Accurate time statistics (user, system, total) - verified against top(1) - (More) color - Process hierarchy (output needs to be improved, but is correct) - Fixed power output for VMs (wherein power sources API doesn't work) v0.2.2 - Also showing swap statistics (from sysctl vm.swapusage) - Also showing local IP communication (IPv4, for now) endpoints (i.e. who's on the other side of that ::1 or 127.0.0.1) - CPU utilization! Also supporting Linux Top's "1" (for each CPU). "I"rix mode coming soon v0.2.3 - ProcExp is now multi (well, dual) threaded! Separate thread implements vm_pressure_monitor (#296) to trace VM pressure - Mavericks/iOS7: shows memory status - Mavericks/iOS7: shows Disk I/O stats (proc_pid_rusage) - Shows task modification statistics (still need to improve and work around pid_for_task(), though) - Fixed process information to display pipes. Still need to show other side of pipe, though - Added handler to catch curses library failures - Added update delay ('U') - Socket information now shows TCP state (A la netstat) v0.2.4 - the birthday edition - stack_snapshot integrated into ProcExp! (basic, but going strong). Shows last RA for thread in 64-bit. 32-bit still choppy - added #FDs to column display (useful!) - handle revoke(2)d FDs as well - preliminary support for deltas - shows colors on increase/decrease of RSIZE, #Threads, increase of time v0.2.5 - 12/03/13 - sysctl KERN_PROCARGS2 now displays full name and args of processes in detailed view - internal refactoring into separate C files for subsystems - Columns now OS-version-sensitive (e.g. disk I/O will only show in 10.9, iOS7 and later) v0.2.6 - 01/19/14 - New options "regions" - e.g. "./procexp.universal $$ regions" - will show memory regions. Will have that in the full screen option as well (as soon as I figure out curses and scrolling..) v0.2.7 - 01/19/14 - Systemwide Network packets (RX/TX) now available; Per-process statistics coming soon v0.2.8 - 01/23/14 - Made network statistics in bytes/sec. - Prompt mode fixed, now case sensitive - New commands: K/R/T: KILL/Resume/Stop highlighted process (note uppercase) v0.2.9 - 02/22/14 - Workqueue information now displayed - FD output improved in CLI mode: bash-3.2# ./procexp.universal all fds | grep tcp WebProcess 11117 FD 23u socket tcp4 10.0.1.107:52246-> 220.127.116.11:443 ESTABLISHED ssh 11066 FD 3u socket tcp4 10.0.1.107:51869-> 18.104.22.168:443 ESTABLISHED v0.3 - 03/20/14 - Adapts display to screen width v0.3.2 - 06/13/14 - Works on Yosemite, DP1 - Stack Snapshot fixed, AND auto symbolicates kernel! e.g. #Threads: 2/1 (Process has no workqueues) TID USER KERNEL 0x4da4f 0x7fff9198c8ae _stack_snapshot2 + 0x21a 0x10000318b _unix_syscall64 + 0x262 0x100003ab4 _hndl_unix_scall64 + 0x16 0x10000a41b 0x10000bc4a 0x10000cd77 0x100001464 0x1 0x4da59 0x7fff9198c8ae _machine_switch_context + 0x16f 0x10000c191 _preemption_enabled + 0xbaa 0x7fff91cb4844 _thread_block_reason + 0xaf 0x7fff91cb47c1 _mach_vm_pressure_monitor + 0x4b 0x7fff91cb2a11 _vm_pressure_monitor + 0x2e _unix_syscall64 + 0x262 _hndl_unix_scall64 + 0x16 v0.3.4 - 11/25/14 - Integrates with iOS's MobileGestalt (displays iOS name and version. Also - try 'G' from main screen) - Updated system event sockets to display OS X 10.10/iOS 8 KEV_* classes and subclasses v0.4 - 3/30/15 - It's been a while - Added 'F' to freeze screen updates. This is especially useful if you're sorting by CPU or state, which would cause re-sorting frequently. Simply press 'F' to freeze table updates, and 'F' to unfreeze. - Now works with OS X 10.10/iOS 8 (shows compressed memory. Still working on ledgers) v0.5 - 4/13/15 - London - WiFi! - Used direct ioctl()s to get WiFi details with RSSI - so you now have a built-in WiFi Signal detector :-) (on iOS, this requires the wlan.authentication entitlement, which I self-signed) v0.55 - 4/25/15 - Delhi - MemoryStatus and some other changes - ' ' and 'b' now flip through process list faster (forward - space, backward - b. Just like less(1)) - procexp now only shows columns whose details require root access if you're running it as root. - uses csops() (#169) to show code signing status of a process. Great to find unsigned/malware-suspect processes - Uses the memorystatus_control() syscall (#440) to obtain memorystatus snapshot and display memory status priority of each process in 'MS' column. In OS X, it's rather boring (most procs are 18 or 0). In iOS, the gamut of processes is more populated. Also in iOS, will only be displayed if you're root. - fixed a bug with 8 processors (*blush*) - I never tested on a MacBook Pro .. v0.56 - 6/27/15 Fixed thread dumps on iOS. Also have thread symbolication for user mode! (well, at least what AAPL hasn't redacted...) Initial support for xnu-32xx (iOS 9/OS X 10.11) Still @TODO: Thermal info v0.6 - 8/1/15 - Bug fixes - Can now dump core of a selected process (press 'C' when inspecting the process) v0.62 - 9/20/15 Bug Fixes - MOVE COLUMNS! Press SHIFT + Left or right to move an entire column!!! - Note: requires TERM to be set correctly (works great with TERM=xterm, misinterprets as '1' key if TERM=screen) - Separated DISK to "DSK R" and "DSK W". - Move/sort now correctly only reaches to edge of screen. As you readjust screen width, you can move further/less - Loads of fixes: - Fixed abort which was caused by rusage - CPU usage now shows per-cpu without messing up display - CPU %-age is accurate (apparently more so than top!) - Colorless mode (toggle with 'c') is now truly colorless and dull. Just like the real top :-) - Selecting processes now works well with active filters - Fixed memory leak - Curses bugs resolved v0.99 - Special Edition for MacSysAdmin.se. A couple more features, and I'll get to 1.0. (hey, if Linus Torvalds can arbitrarily declare version numbers, so can I! :-) - More accurate statistics (up to two decimal points when in MB, GB) - Fixed bug due to com.apple.network.statistics change in 10.10 that eluded me.. - Perspectives - Detecting power assertions v0.999 - lots of tiny bug fixes, used my own task_for_pid workaround - The Mickel Bug: UIDs on AD machines (where UID > 65536!) no longer crash ProcExp - Print out warning if can't get task ports (Thanks for #$%#$%ing processor_set_tasks, AAPL..) - Displays Containers (for iOS and OS X App Store Apps) v1.0.0-ε - Displaying Mach Ports! 02/27/16 - fixed some ports which were erroneously resolved because they were "U" and not "M" in launchd output. - Output port names with quotes, so as to procexp ... ports | grep \" - "all" now includes ports v1.0.0-ε2 03/16/16 - thread stack trace now shows offset from nearest symbol also in user mode - regions shows SHM , just like vmmap (this one's for you, elist) 04/02/16 - WAY more responsive: pressing
or any other unassigned key will autorefresh 07/31/16 - Default sort now CPU - Core dumps now correctly mark protection flags - new "Binary" option (to dump decrypted/protected) 09/20/16 - Disabled stack_snapshot on Sierra/iOS10 until I can get ...config working v1.0.0-ε3 12/05/16 - Fixed double free bug - stack_snapshot no longer needed - have micro_stackshot working and integrated 1/24/17 (Harbin) - Stop signal to processes on 'T' from main menu - monitor now responds to knotes and will auto freeze processes matching criteria - Got all KEV codes in 5/14/17 (Sydney) - now SIP-compliant without entitlements :-) - uses task_name_for_pid whenever possible. AAPL - if you are reading this, Will you PLEASE enable obtaining mach_port_names from a task already, so "procexp ports" works with SIP? 10/25/17 (Punta Cana - It's been a while, but this is the 1.0!) - A few bug fixes - Kqueue information is now the extended variant, telling you what kqueue blocks on and what event filter mask - Procexp now accepts process name as argument. Geez. How did I not have this till now? - procexp ports works again on iOS 11 and MacOS 13. - procexp ports also recognizes all the host special ports! You can grep HSP and '<-' in procexp all to find owners -----------