- grep /proc/*/maps for " (deleted)" (needs root)

- exclude irrelevancies like paths starting with "/memfd:" (I have lots of other similar exclusions) with grep -v

- extract the pid from the filename part of grep's output with sed

- for each pid, generate readable output from /proc/$pid/cmdline (which is NUL separated) with tr, xargs, bash printf

- show the pid, cmdline, file path

With this tool, this pipe chain is now just:

    doas psc -o "process.pid,process.cmdline,file.path" \
      'file.path.endsWith(" (deleted)") && !file.path.startsWith("/memfd:") && !...' \
      | sed -e 1d -e 's/   */ /g'*

> I ran benchmarks on current code in the datadog-agent which reads the relevant data from procfs as described at the beginning of this post. I then implemented benchmarks for capturing the same data with bpf. The performance results were a major improvement.

> On a linux system with around 250 Procs it took the procfs implemention 5.45 ms vs 75.6 us for bpf (bpf is ~72x faster). On a linux system with around 10,000 Procs it took the procfs implemention ~296us vs 3ms for bpf (bpf is ~100x faster).

[1] https://www.grant.pizza/blog/bpf-iter/

  # Find processes connected to a specific port
  psc 'socket.dstPort == uint(443)'

  # Filter by PID range
  psc 'process.pid > 1000 && process.pid < 2000'

    ps aux | grep nginx | grep root | grep -v grep

    ps -u root -C nginx

    psc 'process.name == "nginx" && process.user == "root"'

Is there a trade off here?