Ps - command ps auxww and others

This module provides processing for the various outputs of the ps command.

class insights.parsers.ps.ContainerPsAux(context)

Bases: ContainerParser, PsAuxww

Class to parse the command ps aux from the containers.

Sample input data:

USER       PID %CPU %MEM     VSZ    RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.0   19356   1544 ?        Ss   May31   0:01 /sbin/init
root      1821  0.0  0.0       0      0 ?        S    May31   0:25 [kondemand/0]
root      1864  0.0  0.0   18244    668 ?        Ss   May31   0:05 irqbalance --pid=/var/run/irqbalance.pid
user1    20160  0.0  0.0  108472   1896 pts/3    Ss   10:09   0:00 bash
root     20357  0.0  0.0    9120    760 ?        Ss   10:09   0:00 /sbin/dhclient -1 -q -lf /var/lib/dhclient/dhclient-extbr0.leases -pf /var/run/dhclient-extbr0.pid extbr0
qemu     22673  0.8 10.2 1618556 805636 ?        Sl   11:38   1:07 /usr/libexec/qemu-kvm -name rhel7 -S -M rhel6.5.0 -enable-kvm -m 1024 -smp 2,sockets=2,cores=1,threads=1 -uuid 13798ffc-bc1e-d437-4f3f-2e0fa6c923ad
tomcat    3662  1.0  5.7 2311488  58236 ?        Ssl  07:28   0:01 /usr/lib/jvm/jre/bin/java -classpath /usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/commons-daemon.jar -Dcatalina.base=/usr/share/tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/cache/tomcat/temp -Djava.util.logging.config.file=/usr/share/tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager org.apache.catalina.startup.Bootstrap start

Examples

>>> type(container_ps_aux)
<class 'insights.parsers.ps.ContainerPsAux'>
>>> container_ps_aux.container_id
'2869b4e2541c'
>>> container_ps_aux.image
'registry.access.redhat.com/ubi8/nginx-120'
>>> container_ps_aux.number_occurences("bash")
1

class insights.parsers.ps.Ps(*args, **kwargs)

Bases: CommandParser

Template Class to parse ps command output.

Raises:

ParseException -- Raised if the heading line (containing both user_name and command_name) is not found in the input.

data

List of dicts, where the keys in each dict are the column headers and each item in the list represents a process.

Type:

list

running

Set of full command strings for each command including optional path and arguments, in order of listing in the ps output.

Type:

set

cmd_names

Set of just the command names, minus any path or arguments.

Type:

set

services

List of tuples in format (cmd names, user/uid/pid, raw_line) for each command.

Type:

list

pid_info

Dictionary indexed by pid returning dict of process info.

Type:

dict

command_name = 'COMMAND_TEMPLATE'

command_name is the name of the subclass specific command column from the header of ps output, the subclass must override it correspondingly

fuzzy_match(proc)

Are there any commands that contain the given text?

Returns:

True if the word proc appears in the command column.

Return type:

boolean

Note

‘proc’ can match anywhere in the command path, name or arguments.

max_splits = 0

max_splits is the split number for the columns from the ps output, the subclass must override it correspondingly

number_occurences(proc)

Returns the number of occurencies of commands that contain given text

Returns:

The number of occurencies of commands with given text

Return type:

int

Note

‘proc’ can match anywhere in the command path, name or arguments.

parse_content(content)

This method must be implemented by classes based on this class.

running_pids()

Gives the list of process IDs in the order listed.

Returns:

the PIDs from the PID column.

Return type:

list

search(**kwargs)

Search the process list for matching rows based on key-value pairs.

This uses the insights.parsers.keyword_search() function for searching; see its documentation for usage details. If no search parameters are given, no rows are returned.

Returns:

A list of dictionaries of processes that match the given search criteria.

Return type:

list

Examples

>>> ps.search(COMMAND__contains='bash') == [
...    {'%MEM': '0.0', 'TTY': 'pts/3', 'VSZ': '108472', 'ARGS': '', 'PID': '20160', '%CPU': '0.0',
...     'START': '10:09', 'COMMAND': '/bin/bash', 'USER': 'user1', 'STAT': 'Ss', 'TIME': '0:00',
...     'COMMAND_NAME': 'bash', 'RSS': '1896'},
...    {'%MEM': '0.0', 'TTY': '?', 'VSZ': '9120', 'ARGS': '', 'PID': '20457', '%CPU': '0.0',
...     'START': '10:09', 'COMMAND': '/bin/bash', 'USER': 'root', 'STAT': 'Ss', 'TIME': '0:00',
...     'COMMAND_NAME': 'bash', 'RSS': '832'}
... ]
True
>>> ps.search(USER='root', COMMAND__contains='bash') == [
...    {'%MEM': '0.0', 'TTY': '?', 'VSZ': '9120', 'ARGS': '', 'PID': '20457', '%CPU': '0.0',
...     'START': '10:09', 'COMMAND': '/bin/bash', 'USER': 'root', 'STAT': 'Ss', 'TIME': '0:00',
...     'COMMAND_NAME': 'bash', 'RSS': '832'}
... ]
True
>>> ps.search(TTY='pts/3') == [
...    {'%MEM': '0.0', 'TTY': 'pts/3', 'VSZ': '108472', 'ARGS': '', 'PID': '20160', '%CPU': '0.0',
...     'START': '10:09', 'COMMAND': '/bin/bash', 'USER': 'user1', 'STAT': 'Ss', 'TIME': '0:00',
...     'COMMAND_NAME': 'bash', 'RSS': '1896'}
... ]
True
>>> ps.search(STAT__contains='Z') == [
...    {'%MEM': '0.0', 'TTY': '?', 'VSZ': '0', 'ARGS': '', 'PID': '1821', '%CPU': '0.0',
...     'START': 'May31', 'COMMAND': '[kondemand/0]', 'USER': 'root', 'STAT': 'Z', 'TIME': '0:29',
...     'COMMAND_NAME': '[kondemand/0]', 'RSS': '0'}
... ]
True

user_name = 'USER_TEMPLATE'

user_name is the name of the subclass specificuser_name column from the header of ps output, the subclass must override it correspondingly

users(proc)

Searches for all users running a given command. If the user column is not present then returns an empty dict.

Returns:

each username as a key to a list of PIDs (as strings) that are running the given process. {} if neither USER nor UID is found or proc is not found.

Return type:

dict

Note

‘proc’ must match the entire command and arguments.

class insights.parsers.ps.PsAlxwww(*args, **kwargs)

Bases: Ps

Class to parse the command ps alxwww. See method and attribute details in the Ps parser.

Sample input data:

F   UID   PID  PPID PRI  NI    VSZ   RSS WCHAN  STAT TTY        TIME COMMAND
4     0     1     0  20   0 128292  6928 ep_pol Ss   ?          0:02 /usr/lib/systemd/systemd --switched-root --system --deserialize 22
1     0     2     0  20   0      0     0 kthrea S    ?          0:00 [kthreadd]
1     0     3     2  20   0      0     0 smpboo S    ?          0:00 [ksoftirqd/0]
5     0     4     2  20   0      0     0 worker S    ?          0:00 [kworker/0:0]
1     0     5     2   0 -20      0     0 worker S<   ?          0:00 [kworker/0:0H]
1     0     6     2  20   0      0     0 worker S    ?          0:00 [kworker/u4:0]
1     0     7     2 -100  -      0     0 smpboo S    ?          0:00 [migration/0]
1     0     8     2  20   0      0     0 rcu_gp S    ?          0:00 [rcu_bh]

Examples

>>> type(ps_alxwww)
<class 'insights.parsers.ps.PsAlxwww'>
>>> 'systemd' in ps_alxwww.cmd_names
True
>>> '/usr/lib/systemd/systemd --switched-root --system --deserialize 22' in ps_alxwww.running
True
>>> ps_alxwww.search(COMMAND_NAME__contains='systemd') == [{
...     'F': '4', 'UID': '0', 'PID': '1', 'PPID': '0', 'PRI': '20', 'NI': '0', 'VSZ': '128292', 'RSS': '6928',
...     'WCHAN': 'ep_pol', 'STAT': 'Ss', 'TTY': '?', 'TIME': '0:02',
...     'COMMAND': '/usr/lib/systemd/systemd --switched-root --system --deserialize 22',
...     'COMMAND_NAME': 'systemd', 'ARGS': '--switched-root --system --deserialize 22'
... }]
True

command_name = 'COMMAND'

command_name is the name of the subclass specific command column from the header of ps output, the subclass must override it correspondingly

max_splits = 12

max_splits is the split number for the columns from the ps output, the subclass must override it correspondingly

user_name = 'UID'

user_name is the name of the subclass specificuser_name column from the header of ps output, the subclass must override it correspondingly

class insights.parsers.ps.PsAux(*args, **kwargs)

Bases: PsAuxww

class insights.parsers.ps.PsAuxcww(*args, **kwargs)

Bases: PsAuxww

class insights.parsers.ps.PsAuxww(*args, **kwargs)

Bases: Ps

Class PsAuxww parses the output of the ps auxww command. A small sample of the output of this command looks like:

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.0  19356  1544 ?        Ss   May31   0:01 /usr/lib/systemd/systemd --switched-root --system --deserialize 22
root      1661  0.0  0.0 126252  1392 ?        Ss   May31   0:04 /usr/sbin/crond -n
root      1691  0.0  0.0  42688   172 ?        Ss   May31   0:00 /usr/sbin/rpc.mountd
root      1821  0.0  0.0      0     0 ?        Z    May31   0:29 [kondemand/0]
root      1864  0.0  0.0  18244   668 ?        Ss   May31   0:05 /usr/sbin/irqbalance --foreground
user1    20160  0.0  0.0 108472  1896 pts/3    Ss   10:09   0:00 /bin/bash
root     20357  0.0  0.0   9120   832 ?        Ss   10:09   0:00 /usr/sbin/dhclient enp0s25
root     20457  0.0  0.0   9120   832 ?        Ss   10:09   0:00 /bin/bash

PsAuxww attempts to read the output of ps auxwww, ps aux, and ps auxcww commands from archives.

Examples

>>> type(ps_auxww)
<class 'insights.parsers.ps.PsAuxww'>
>>> ps_auxww.running == set([
...     '/bin/bash', '/usr/sbin/rpc.mountd', '/usr/lib/systemd/systemd --switched-root --system --deserialize 22',
...     '/usr/sbin/irqbalance --foreground', '/usr/sbin/dhclient enp0s25', '[kondemand/0]', '/usr/sbin/crond -n'
... ])
True
>>> ps_auxww.cpu_usage('[kondemand/0]')
'0.0'
>>> ps_auxww.users('/bin/bash') == {'root': ['20457'], 'user1': ['20160']}
True
>>> ps_auxww.fuzzy_match('dhclient')
True
>>> sum(int(p['VSZ']) for p in ps_auxww)
333252

command_name = 'COMMAND'

command_name is the name of the subclass specific command column from the header of ps output, the subclass must override it correspondingly

cpu_usage(proc)

Searches for the first command matching proc and returns its CPU usage as a string.

Returns:

the %CPU column corresponding to proc in command or None if proc is not found.

Return type:

str

Note

‘proc’ must match the entire command and arguments.

max_splits = 10

max_splits is the split number for the columns from the ps output, the subclass must override it correspondingly

user_name = 'USER'

user_name is the name of the subclass specificuser_name column from the header of ps output, the subclass must override it correspondingly

class insights.parsers.ps.PsEf(*args, **kwargs)

Bases: Ps

Class PsEf parses the output of the ps -ef command. A small sample of the output of this command looks like:

UID         PID   PPID  C STIME TTY          TIME CMD
root          1      0  0 03:53 ?        00:00:06 /usr/lib/systemd/systemd --system --deserialize 15
root          2      0  0 03:53 ?        00:00:00 [kthreadd]
root       1803      1  5 03:54 ?        00:55:22 /usr/bin/openshift start master --config=/etc/origin/master/master-config.yaml --loglevel
root       1969      1  3 03:54 ?        00:33:51 /usr/bin/openshift start node --config=/etc/origin/node/node-config.yaml --loglevel=2
root       1995      1  0 03:54 ?        00:02:06 /usr/libexec/docker/rhel-push-plugin
root       2078   1969  0 03:54 ?        00:00:00 journalctl -k -f
root       7201      1  0 03:59 ?        00:00:00 /usr/bin/python /usr/libexec/rhsmd
root     111434      1  0 22:32 ?        00:00:00 nginx: master process /usr/sbin/nginx -c /etc/nginx/nginx.conf
nginx    111435 111434  0 22:32 ?        00:00:00 nginx: worker process

PsEf attempts to read the output of ps -ef commands from archives.

Examples

>>> type(ps_ef)
<class 'insights.parsers.ps.PsEf'>
>>> ps_ef.parent_pid("111435")
['111434', 'nginx: master process /usr/sbin/nginx -c /etc/nginx/nginx.conf']
>>> ps_ef.users('nginx: worker process')
{'nginx': ['111435']}
>>> ps_ef.fuzzy_match('kthreadd')
True

command_name = 'CMD'

command_name is the name of the subclass specific command column from the header of ps output, the subclass must override it correspondingly

max_splits = 7

max_splits is the split number for the columns from the ps output, the subclass must override it correspondingly

parent_pid(pid)

Search for the parent pid of command matching pid and returns the parent pid.

Returns:

First one is the parent pid corresponding to pid in command and second one is parent command name. None if proc is not found.

Return type:

list

user_name = 'UID'

user_name is the name of the subclass specificuser_name column from the header of ps output, the subclass must override it correspondingly

class insights.parsers.ps.PsEo(*args, **kwargs)

Bases: Ps

Warning

This class is deprecated and will be removed from 3.6.0. Please use the insights.parsers.ps.PsEoCmd instead.

Class to parse the command ps -eo pid,ppid,comm,nlwp

Sample input data:

  PID  PPID COMMAND       NLWP
    1     0 systemd         1
    2     0 kthreadd        1
    3     2 ksoftirqd/0     1
 2416     1 auditd          1
 2419  2416 audispd         1
 2421  2419 sedispatch      1
 2892     1 NetworkManager  1
 3172  2892 dhclient        1
 3871     1 master          1
 3886  3871 qmgr            1
13724  3871 pickup          1
15663     2 kworker/0:1     1
16998     2 kworker/0:3     1
17259     2 kworker/0:0     1
18294  3357 sshd            1

Examples

>>> type(ps_eo)
<class 'insights.parsers.ps.PsEo'>
>>> ps_eo.pid_info['1'] == {'PID': '1', 'PPID': '0', 'COMMAND': 'systemd', 'COMMAND_NAME': 'systemd', 'ARGS': '', 'NLWP': '1'}
True
>>> ps_eo.children('2') == [
...     {'PID': '3', 'PPID': '2', 'COMMAND': 'ksoftirqd/0', 'COMMAND_NAME': 'ksoftirqd/0', 'ARGS': '', 'NLWP': '1'},
...     {'PID': '15663', 'PPID': '2', 'COMMAND': 'kworker/0:1', 'COMMAND_NAME': 'kworker/0:1', 'ARGS': '', 'NLWP': '1'},
...     {'PID': '16998', 'PPID': '2', 'COMMAND': 'kworker/0:3', 'COMMAND_NAME': 'kworker/0:3', 'ARGS': '', 'NLWP': '1'},
...     {'PID': '17259', 'PPID': '2', 'COMMAND': 'kworker/0:0', 'COMMAND_NAME': 'kworker/0:0', 'ARGS': '', 'NLWP': '1'}
... ]
True

children(ppid)

list: Returns a list of dict for all rows with ppid as parent PID

command_name = 'COMMAND'

command_name is the name of the subclass specific command column from the header of ps output, the subclass must override it correspondingly

max_splits = 3

max_splits is the split number for the columns from the ps output, the subclass must override it correspondingly

user_name = 'PID'

user_name is the name of the subclass specificuser_name column from the header of ps output, the subclass must override it correspondingly

class insights.parsers.ps.PsEoCmd(*args, **kwargs)

Bases: Ps

Class to parse the command ps -ewwo pid,ppid,nlwp,args where the datasource ps_eo_cmd trims off all args leaving only the full path to the command.

Sample output from the ps -ewwo pid,ppid,nlwp,args command:

PID  PPID NLWP COMMAND
  1     0    1 /usr/lib/systemd/systemd --switched-root --system --deserialize 31
  2     0    1 [kthreadd]
 11     2    1 /usr/bin/python3 /home/user1/python_app.py
 12     2    1 [kworker/u16:0-kcryptd/253:0]

Sample data after trimming by the datasource:

PID  PPID NLWP COMMAND
  1     0    1 /usr/lib/systemd/systemd
  2     0    1 [kthreadd]
 11     2    1 /usr/bin/python3
 12     2    1 [kworker/u16:0-kcryptd/253:0]

Examples

>>> type(ps_eo_cmd)
<class 'insights.parsers.ps.PsEoCmd'>
>>> ps_eo_cmd.running_pids() == ['1', '2', '11', '12']
True
>>> ps_eo_cmd.search(COMMAND__contains='python3') == [
...     {'PID': '11', 'PPID': '2', 'NLWP': '1', 'COMMAND': '/usr/bin/python3',
...      'COMMAND_NAME': 'python3', 'ARGS': ''}
... ]
True

children(ppid)

list: Returns a list of dict for all rows with ppid as parent PID

command_name = 'COMMAND'

command_name is the name of the subclass specific command column from the header of ps output, the subclass must override it correspondingly

max_splits = 3

max_splits is the split number for the columns from the ps output, the subclass must override it correspondingly

user_name = 'PID'

user_name is the name of the subclass specificuser_name column from the header of ps output, the subclass must override it correspondingly

insights.parsers.ps.are_present(tags, line)

bool: Returns True if all tags are present in line.