process監控的問題與替代方法

在監控某一process時，常用
watch -n1 ps -p $(pidof 'process name' ) -o comm,pid,vss,rsz,pcpu,pri,cstime,cutime,utime
或者
while :; do date; ps -p $(pidof 'process name') -o comm,pid,vss.rsz,pcpu,pri,cstime,cutime,utime ;sleep 1; done
while :; do date; ps -oe comm,pid,vss,rsz,pcpu,pri,cstime,cutime,utime | grep 'process name' ;sleep 1; done
或者
for pidd in $(pidof 'process name')
do
top -n 1 -S -b -p $pidd >> $LOG
ps -p $pidd -o comm,cmd,user,group >> $LOG
done

但會發現pcpu(欄位%CPU)不會變,跟top指令比較，TOP確會變
於是修改指令如下，即可：
while :; do date; top -n 1 -S -b | grep vmware-vmx;sleep 1; done

[AIX]
ps -p 442584 -o args,pid,vsz,pcpu
ps -ef -o args,pid,vsz,pcpu

#!/usr/bin/ksh
if [ "$1" = "" ] ; then
echo "you need to entery the [pid] what you want to lookup."
echo "shell>./mon.sh [pid]"
exit 0;
else
# while :; do date >> ~/mon.log;ps -ef -o comm,pid,pcpu,vsz | grep $1 >> ~/mon.log ; sleep 5; done
while :; do date >> ~/mon.log;ps -efl | grep $1 >> ~/mon.log ; sleep 5; done
fi

[結果]
F S UID PID PPID C PRI NI ADDR SZ WCHAN STIME TTY TIME CMD
200003 A root 1 0 0 60 20 d8039000 756 Nov 24 - 0:21 /etc/init
240001 A root 98420 1 0 60 20 d0138400 496 * Nov 24 - 11:37 /usr/sbin/syncd 60
40401 A root 102602 1 0 60 20 e803f400 828 10a09d8 Nov 24 - 0:00 /usr/lib/errdemon

TIME
(all flags) The total execution time for the process.
TTY
(all flags) The controlling workstation for the process:
-
The process is not associated with a workstation.
?
Unknown.
Number
The TTY number. For example, the entry 2 indicates TTY2.
UID
(-f, -l, and l flags) The user ID of the process owner. The login name is printed under the -f flag.
WCHAN
(-l flag) The event for which the process or kernel thread is waiting or sleeping. For a kernel thread, this field is
blank if the kernel thread is running. For a process, the wait channel is defined as the wait channel of the sleeping
kernel thread if only one kernel thread is sleeping; otherwise STIME
(-f and u flags) The starting time of the process. The LANG environment variables control the appearance of this
field.
SZ
(-l and l flags) The size in 1KB units of the core image of the
NI
(-l and l flags) The nice value; used in calculating priority for the sched other policy.
PID
(all flags) The process ID of the process.
PGIN
(v flag) The number of disk I/Os resulting from references by the process to pages not loaded in core.
PPID
(-f, l, and -l flags) The process ID of the parent process.
PRI
(-l and l flags) The priority of the process or kernel thread; higher numbers mean lower priority.
S
(-l and l flags) The state of the process or kernel thread :(見man ps)
F
(-l and l flags) Some of the more important F field flags (hexadecimal and additive) associated with processes and
threads are shown in the following table:(見man ps)
CMD
(-f, -l, and l flags) Contains the command name. Under the -f flag, ps tries to determine the current command name and
arguments both of which may be changed asynchronously by the process. These are then displayed. Failing this, the
command name as it would appear without the option -f, is written in square brackets.

ADDR
(-l and l flags) Contains the segment number of the process stack, if normal; if a kernel process, the address of the
preprocess data area.
C
(-f, l, and -l flags) CPU utilization of process or thread, incremented each time the system clock ticks and the
process or thread is found to be running. The value is decayed by the scheduler by dividing it by 2 once per second.
For the sched_other policy, CPU utilization is used in determining process scheduling priority. Large values indicate
a CPU intensive process and result in lower process priority whereas small values indicate an I/O intensive process
and result in a more favorable priority.