proc_pid_syscall(5)

๐Ÿ’– proc_pid_syscall โ€” bestie's guide to stalking a syscall ๐Ÿ’–

okay so this is one of those proc files and it's lowkey iconic. it lives at /proc/pid/syscall and it's literally a live feed of whatever syscall your process is doing right now. let's get into it ๐Ÿซถ

(i'm the proc_pid_syscall page btw, from section 5 of the manual โ€” file formats, iykyk โœจ)


โœจ NAME โœจ

/proc/pid/syscall โ€” the currently executed system call ๐Ÿ‘€

like that's it, that's the whole vibe. no notes.


๐ŸŒธ DESCRIPTION ๐ŸŒธ

๐ŸŽ€ the file itself

/proc/pid/syscall (since Linux 2.6.27)

so basically this file spills the tea on the system call your process is running at this exact moment. it shows you:

  • the system call number ๐Ÿ”ข
  • the argument registers ๐Ÿ’…
  • and right after those, the values of the stack pointer and program counter registers ๐ŸŒŸ

and here's the thing โ€” it exposes all six argument registers, even though most system calls are out here using way fewer of them. generous queen behavior honestly ๐Ÿ‘‘

๐Ÿ˜ญ when the process is blocked (but not in a syscall)

plot twist! if the process is blocked but it's not sitting inside a system call? the file hits you with:

  • -1 where the system call number should be ๐Ÿ˜ณ
  • and then just the values of the stack pointer and program counter, nothing else

like it's giving "no syscall here bestie, but here's where we are" ๐Ÿ•ต๏ธ

๐Ÿƒ when the process is not blocked

if the process is not blocked, the file is literally just the string:

running

that's it. that's the whole file. main character energy, minimal words ๐Ÿ’€โœจ

โš ๏ธ important detail alert

this file is only present if the kernel was configured with CONFIG_HAVE_ARCH_TRACEHOOK. no config, no file, no cap ๐Ÿšซ

๐Ÿ” who's allowed in

permission to access this file is governed by a ptrace access mode PTRACE_MODE_ATTACH_FSCREDS check โ€” go see ptrace(2) for the full rundown, i'm not gonna gatekeep the details for you ๐Ÿซถ


๐Ÿ‘‘ SEE ALSO ๐Ÿ‘‘


and that's the page!! go forth and peek at syscalls responsibly, bestie ๐ŸŒˆ๐Ÿฆ‹๐Ÿ’œ

sending you love from the Linux man-pages 6.20 girlies, dated 2026-02-08 โ€” mwah, stay curious, drink water, and don't forget to read proc(5) โญ๐ŸŽ€

๐Ÿ“ฆ where this page comes from
  • arch rolling: man-pages 6.20-1 ยท BSD-2-Clause AND BSD-3-Clause AND BSD-4.3TAHOE AND BSD-4-Clause-UC AND GPL-1.0-or-later AND GPL-2.0-only AND GPL-2.0-or-later AND GPL-3.0-or-later AND LGPL-3.0-linking-exception AND LGPL-3.0-or-later AND LicenseRef-Public-Domain AND LicenseRef-UltraPermissive AND Linux-man-pages-1-para AND Linux-man-pages-copyleft AND Linux-man-pages-copyleft-2-para AND Linux-man-pages-copyleft-var AND MIT AND Spencer-94
  • nixpkgs unstable: man-pages 6.20
  • ๐Ÿ“œ the page's license: GPL-3.0-or-later
  • ๐Ÿ’– girlified by deepseek-ai/DeepSeek-V4.1-Flash on : a language model's rewrite of the original, under its terms