I started with ps and top because those are the obvious ones, then remembered /proc and that's where things got interesting.
Structure your answer by grouping commands into categories: process overview, resource usage, system calls, and open files/network. For each command, briefly state what it does and what specific insight it provides about the process's behavior or health. Emphasize a systematic troubleshooting approach, starting with high-level inspection and drilling down as needed.
Pro tip: Mention that you'd first check the process state and resource usage with `ps` and `top` to identify anomalies, then use `strace` and `lsof` for deeper investigation, but always consider the performance impact of these tools in production.
Use `ps -p <PID> -o pid,ppid,user,%cpu,%mem,stat,start,time,cmd` to see the process's basic attributes, resource usage, and state. This helps you quickly assess if the process is running, sleeping, zombie, etc., and its resource consumption.
Use `top -p <PID>` or `htop -p <PID>` to observe CPU and memory usage in real-time, and identify threads with `top -H -p <PID>`. This reveals if the process is CPU-bound, memory-leaking, or has thread-level issues.
Use `lsof -p <PID>` to list all open files, sockets, and pipes, which can indicate file descriptor leaks or network activity. For network specifics, `netstat -tulpn | grep <PID>` or `ss -tulpn | grep <PID>` shows listening ports and connections.
Use `strace -p <PID>` to attach and trace system calls, which helps diagnose hangs, errors, or unexpected behavior. For a snapshot, `strace -p <PID> -c` gives a summary of syscall counts and time.
Use `pmap -x <PID>` to view memory mappings, and `gdb -p <PID>` to attach a debugger for stack traces (if symbols available). For Java processes, `jstack <PID>` provides thread dumps.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.