getrusage¶

Intro¶

getrusage - get resource usage

Description¶

The getrusage() system call returns information about usage of system resources and accounting information of the current process or one of its children. This information can be used to determine from which parts of the program the time was spent or to estimate the current capacity of the process to perform operations.

The who argument should be set to RUSAGE_SELF to return information about the current process, or RUSAGE_CHILDREN to return information about the process's children. The usage argument points to a structure, rusage, which upon the system call's return, is filled with the specified usage information.

Arguments¶

who:int[KU] - The who argument describes which process the usage information is requested for. Must be set to RUSAGE_SELF or RUSAGE_CHILDREN.
usage:struct rusage*[K] - The usage argument is a pointer to a struct rusage, which upon the system call's return, is filled with the specified usage information.

Available Tags¶

K - Originated from kernel-space.
U - Originated from user space (for example, pointer to user space memory used to get it)

Hooks¶

do_getrusage¶

Type¶

Kprobes

Purpose¶

To observe the system call arguments and return values of getrusage for a given process.

Example Use Case¶

getrusage can be used to get resource usage information from a specific process, such as the CPU usage or the size of used memory. This information can be used to create performance profiles for a running program.

Issues¶

When using the RUSAGE_CHILDREN flag, the information returned can be inconsistent when dealing with processes that exit until all exited processes are reaped.

getpid - gets the process id of the calling process
wait4 - waits on a process or group of processes

This document was automatically generated by OpenAI and needs review. It might not be accurate and might contain errors. The authors of Tracee recommend that the user reads the "events.go" source file to understand the events and their arguments better.