pargs - Man Page

pargs [-l] [-a|--args] [-e|--env] [-x|--auxv] [pid | core]...

Examine a target process or process core file and print arguments, environment variables and values, or the process auxiliary vector. For live processes, arguments and environment variables are read from process memory and reflect the current state, including any modifications made at runtime (e.g., via setenv(3) or by overwriting argv). This is in contrast to /proc/pid/cmdline and /proc/pid/environ, which are static snapshots captured at process start. The pauxv command is equivalent to running pargs(1) with the -x option. The penv command is equivalent to running pargs(1) with the -e option.

-l

Display the arguments as a single command line. The command line is printed in a manner suitable for interpretation by /bin/sh.

-a,  --args

Print process arguments (default). For live processes, arguments are read from process memory and reflect the current values.

-e,  --env

Print process environment variables and values. For live processes, the environment is read from process memory via the environ symbol and reflects runtime changes made with setenv(3) or putenv(3).

-x,  --auxv

Print the process auxiliary vector as contained in /proc/pid/auxv.

pid

Process ID list. A /proc/pid path may also be used, allowing shell expansions like /proc/* to target all processes on the system.

core

Process core file, as produced by systemd-coredump(8), or an Ubuntu/Debian apport .crash file. For systemd core files, the file does not need to exist on disk; if it has been removed, the corresponding systemd journal entry will be used instead. See Notes below.

0 on success, non-zero if an error occurs (such as no such process, permission denied, or invalid option).

/proc/pid/*

Process information and control files.

When a core file has been removed by systemd-tmpfiles(8) or by storage limits configured in coredump.conf(5), the systemd-coredump(8) journal entry for the crash may still be available. In this case, the path to the deleted core file can be passed as the core operand even though the file no longer exists on disk, and process metadata will be retrieved from the journal entry instead. Use coredumpctl(1) to obtain the path of a missing core file, e.g., coredumpctl list <name> -F COREDUMP_FILENAME.

Ubuntu/Debian apport .crash files are also supported. These files use Debian control syntax with base64-encoded gzip core dumps. Text fields (such as ProcCmdline, ProcEnviron, and ExecutablePath) are mapped to COREDUMP_* fields, and the core dump is extracted on first access.

pauxv(1), penv(1), coredumpctl(1), proc(5)

pauxv(1), penv(1), ptree(1).