Repository navigation
[DNM] macos: read the command line of each process - #28
Draft
LalitMaganti wants to merge 1 commit into
Draft
LalitMaganti wants to merge 1 commit into
LalitMaganti wants to merge 1 commit into
Conversation
This was referenced Sep 16, 2026
LalitMaganti
added this pull request to stack #32
September 16, 2026 12:57
LalitMaganti
force-pushed
the
macos-record-2
branch
from
September 16, 2026 13:04
b01d61e to
08effa6
Compare
LalitMaganti
force-pushed
the
macos-record-2
branch
from
September 16, 2026 13:10
08effa6 to
453baed
Compare
LalitMaganti
force-pushed
the
macos-record-2
branch
from
September 16, 2026 13:17
453baed to
ec345c7
Compare
LalitMaganti
force-pushed
the
macos-record-2
branch
from
September 16, 2026 13:19
ec345c7 to
72c6b51
Compare
LalitMaganti
force-pushed
the
macos-record-2
branch
from
September 16, 2026 13:22
72c6b51 to
a7b5948
Compare
LalitMaganti
force-pushed
the
macos-record-2
branch
from
September 16, 2026 13:25
a7b5948 to
724b04a
Compare
The kernel trace does not carry command lines, so each execution's arguments are read from the process itself, as soon as its execution appears in the trace. Two things make that unreliable on their own. A read can land while the new image is still being set up, which fails, so it is retried. And a pid can already have been reused by another process, whose command line would otherwise be attached to this one, so the process must not have started later than the execution. Anything still unread is named after its program, and how many is reported.
LalitMaganti
force-pushed
the
macos-record-2
branch
from
September 16, 2026 13:31
724b04a to
724f154
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prototype for #2, step 2 of 6, on top of #34.
The kernel trace does not carry command lines, so each execution's arguments are read from the process itself as soon as its execution appears. A read can land while the new image is still being set up, so it is retried; and a pid can already have been reused, so the process must not have started later than the execution it is claimed for. Anything still unread is named after its program, and how many is reported.