Forensics

Somebody hands you a machine and tells you what they think is wrong. There is no trace, because you did not start these processes — on a real machine you would not have one either. Everything you need is in /proc, which is the point.

• The disk is full and nothing is using it/proc and observability · 5 min

  df says the filesystem is nearly full. du over the whole tree accounts for a fraction of it. Somebody deleted a large log file an hour ago and the space never came back.

• Two hundred processes and none of them runningProcesses · 5 min

  A supervisor forks a worker per job. The machine is idle, the jobs finished long ago, and the process table keeps growing. Killing them does nothing.

• It works on small filesDescriptors · 7 min

  A job reads its child's output and has run for six hours. It normally takes ten seconds. Both processes are there; neither is using any CPU. It works fine on smaller inputs.