Re: Basic ps Tips

Joerg Mertens <joerg-mertens@t-online.de> wrote:

Rene Kita <mail@rkta.de> wrote:

Joerg Mertens <joerg-mertens@t-online.de> wrote:

[...]

The error message also is printed, when you run ps with a valid
flag plus some string, like `ps -a xyz´, so it seems to be independent
of the `-C´-option.  Maybe it has to do with parsing of the old-style
flags vs. the dashed ones.

 
You got me curious and I got my debugger out for my morning coffee.
 
The error message comes from a function kvm_openfiles, which is called
after the flag parsing is done. From a quick glance, this function takes
what looks like three file names. If the second one is NULL, it will
default to /dev/mem. Trying to open /dev/mem it will error out - which
could be due to me being on a VPS.
 
While the man page mentions kvm(3) in the SEE ALSO section, there is no
mentioning nor explanation what additional arguments can be passed to
ps.

 
As I understand it, `ps´ can not only be used to examine the processes
of your currently running system, but also those of another system
represented by an image file.  Normally you would use the `N´ option
plus a filename to tell ps to do this, but the original way seems to
have been to just add the filename to the commandline as an additional
argument.
 
Now when you call `ps xy´, the argument xy is interpreted as a string
of old style options which can be written without dashes.  Some
people still write `ps aux´ for example to look at their processes.

Guilty. :-)

But when you write `ps a xy´ (or `ps -a xy´), xy is interpreted as
a "kernel image to be examined" (see the first argument to
kvm_openfiles(3)), which leads to the `permission denied´ error.
 
To get back to the `-C´ option - it is there for compatibility
reasons with old scripts.  You can find the relevant commit message
under http://cvsweb.openbsd.org/src/bin/ps/ps.c when you search for the
string `-C´.

That's what I thought. I was just surprised that it's not documented.
But the man page seems to be silent about all old style things. Looks
like it's by design.