How does the pstack command work? - system

I am curious to find how does the pstack command prints the stack trace of all the threads running under the PID?
It has to be someway different than the way gdb does since the process runs inside the gdb environment, but pstack is executed after the execution of the process.

It's the same general idea as gdb. pstack uses ptrace, which allows an external process to attach to a known pid and print out the information (stack is known via the current registers).
If you want to know exactly how it's done, look for information about ptrace.
Also, processes don't really run "inside the gdb". You can attach gdb to a running process without much trouble by running gdb executable pid.

pstack print similar output as cat /proc/"pid"/tasks/*/stack so it most likely that it read the procfs rather than using the ptrace.

Related

Obtaining Process Details

In general is there any way to get the details of the process (the process to which my program is translated to by the OS before execution). Is it possible to output the contents of the data structures (PCB for example) while my program is executing as a process?
I recommend running the program in linux .. you can then use readlf and objdump to get lot of information about the process(like its address space, dynamically linked libraries from glibc Ex:printf(), its symbol table etc)...
u can also see cat /proc/process's pid folder in linux, there to you can get a variety of information about the running process.
Ofcourse you can use a debugger to get the process's state as it is executing

Different behaviour under valgrind vs normal execution?

I have a program witch is a xmpp client that connect to a server.
I use gloox library to do that.
When I run the program, it runs ok and connects to the server.
But when I run it under valgrind, the program never sends
<iq id='uid:4efa1893:327b23c6' type='set' from='user#server/ressource' xmlns='jabber:client'><session xmlns='urn:ietf:params:xml:ns:xmpp-session'/></iq>
to the server.
Had anybody experience such problem?
Are there any parameter I specially need to run valgrind with to make sure that it is the same environement as a normal program execution?
The very first question is: did Valgrind report any errors in the execution of your program?
If your program is well-defined, and Valgrind didn't report any errors in it, then the program is supposed to behave exactly the same way under Valgrind as without it (only slower); no special settings required.
It is somewhat more likely that Valgrind did report some errors, and if so, your program is likely not well-defined, in which case your question is mute -- your program doesn't work the same because it is not well-defined (i.e. depends on undefined behavior).

Linux process activities

Is there possibility to show what's going on under specified process in Linux?
For example, i run SQL query -> select evil_function();
and notice that process under Linux uses all cpu.
So is there something with what I can see whats going on under this process?
What I want is to see what queries is running under this process.
Thanks!
strace will tell you what system calls the process is making.
To see what called routines are taking the most CPU, you need to run a profiling tool, and make sure the executable of the process you in compiled correctly (sometimes it needs to be instrumented during compilation for profiling, sometimes it just needs to be compiled with debug symbols, or not stripped of them after compilation).
You might want to look at oprofile, valgrind, gprof and for starters on free tools - there are also commercial products available.
Here are a few links:
http://www.pixelbeat.org/programming/profiling/
http://en.wikipedia.org/wiki/List_of_performance_analysis_tools
You are mixing a whole bunch of things.
If you are talking about MySQL do:
show processlist;
For info specifically about linux processes, you can strace the process to get a list of system function that it calls. Unless you are experienced with linux this will be useless to you.
If the process is paused then you can find out what function it is stopped on, but that's probably not what you want, since you say the process is running.
There are also various tools that can give you info on what parts of the disk the process is reading, and how much memory it's allocating.
And finally you can use gdb to break into the process and single step your way through it to see exactly what it's doing. This will also likely be useless to you since an SQL server does a LOT of things - far to many to understand by this method.

gdb command file scripting: wait for breakpoint supported?

Im debugging quite a complex program with lots of queues, each having a relatively short timeout period set.
I cannot debug reliable in gdb's 'manual' command line mode, because timeouts are triggered when I type commands to slowly.
I don't like the idea of extending all the queue's timeouts, as this would make things really messy. (This sounds like the design itself is arguable, I know...)
I'd really like to use the gdb 'scripting' feature, but I haven't found a good tutorial for this.
Could anyone tell me if this is possible in a gdb "command file" script:
init some things (easy)
set a breakpoint
run programm
have the next command in script executed once the breakpoint is hit
So basically my question is: can I wait for a breakpoint inside a gdb command file script?
Answering my own question: I had success using hooks. My command file looks like this:
[initialization code]
define hook-stop
[commands to be executed at breakpoint]
end
set breakpoint pending on
b my_breakpoint_function
r

How would I go about taking a snapshot of a process to preserve its state for future investigation? Is this possible?

Whether this is possible I don't know, but it would mighty useful!
I have a process that fails periodically (running in Windows 2000). I then have just one chance to react to it before having to restart it and painfully wait for it to fail again. I didn't write the process so don't have the source to debug. The failure is seemingly random.
With a snapshot of the process I could repeatedly and quickly test reactions to the failure.
I had thought of running inside a VM but this isn't possible in this instance.
EDIT:
#Jon Cage asked:
When you say a snapshot, you mean capturing a process when it's about to fail (including memory, program state etc. etc.) ...and then replaying it's final few seconds repeatedly to see what effect it has on some other component?
This is exactly what I mean!
I think minidump is what you are looking for.
You can also used Userdump:
The User Mode Process Dumper
(userdump) dumps any running Win32
processes memory image (including
system processes such as csrss.exe,
winlogon.exe, services.exe, etc) on
the fly, without attaching a debugger,
or terminating target processes.
Generated dump file can be analyzed or
debugged by using the standard
debugging tools.
This article shows you how to use it.
My best bet is to start the process in a debugger (OllyDbg being my preferred tool).
The process will pause on an exception, and you can try to figure out what happened shortly before that.
This needs some understanding of assembler and does not allow to create a snapshot of the process for later analysis. You would need to write your own debugger for that - it should be theoretically possible.