linux · medium

Track a Running Process — What Is PID 1234 Doing?

How to investigate one running process: resolve the name to a PID, look per-thread with top -H, find what it's blocked in via /proc/PID/wchan and strace -p, list held files/sockets with lsof, and attach gdb -p for every thread's live stack.

🔑 Key line

Track a PID: pgrep/ps → PID; top -H -p (per-thread); /proc/PID/wchan + strace -p (the syscall it's in); lsof -p (what it holds); gdb -p → thread apply all bt (live stacks).

The code

# Name -> PID
pgrep -f myapp        # match the command line
ps -ef | grep myapp   # full command + parent PID

# Overview, PER THREAD (not just the process)
top -H -p $(pgrep myapp)   # -H = show individual threads
cat /proc/1234/status      # VmRSS, Threads, State (R/S/D/Z)

# What is it doing right now?
cat /proc/1234/wchan       # kernel function it's sleeping in
strace -p 1234 -f          # live syscall trace

# What does it hold? Then grab the live stack
lsof -p 1234               # open files + sockets
sudo gdb -p 1234           # then: thread apply all bt

What this lesson walks through

01Find the PID, then look per-thread
02What syscall is it stuck on?
03What files & sockets does it hold?
04Grab every thread's live stack

Name → PID, then look per-thread: top -H -p PID shows the ONE hot thread, not a blurred process average.

See it animated — step by step, at your own pace

Unlock the full interactive walkthrough of Track a Running Process — What Is PID 1234 Doing? and 100+ animated C++ interview lessons.

Start free →Already a member? Log in →