search

sveinbjornt / Sloth

Mac app that shows all open files, directories, sockets, pipes and devices in use by all running processes. Nice GUI for lsof.
https://sveinbjorn.org/sloth
BSD 3-Clause "New" or "Revised" License
8.31k stars 158 forks source link

Clipped Process Names #9

Closed the-real-tokai closed 4 years ago

the-real-tokai commented 4 years ago

In some cases I see some process names getting clipped off at seemingly random positions, e.g. 'periodic-wrapper' shows up as 'periodic-wrappe', 'coresymbolicationd' as 'coresymbolicati', 'KernelEventAgent' as 'KernelEventAgen' and so on. It only seems to happen for a handful of processes, everything else seems to show up OK.

The 'Display Mac-friendly process names' option has no effect on the issue. Happens with it "on" and "off".

Version 2.9 (225)

the-real-tokai commented 4 years ago

OK, putting those in a list with a monospaced font the cut off point is actually rather fixed after 15 characters:

KernelEventAgen
coresymbolicati
periodic-wrappe
sveinbjornt commented 4 years ago

Could you tell me what version of macOS you are running?

sveinbjornt commented 4 years ago

This is interesting. Lsof by default concatenates process names to 15 chars, but Sloth actually goes out of its way to look up the full process name in the kernel via PID. It should only fall back on lsof's 15 char name if kernel process lookup fails. For some reason, this is happening on your system. Perhaps these processes existed when lsof was contacting the kernel, but no longer existed when Sloth did?

sveinbjornt commented 4 years ago

Ah, I think I've figured it out. You're running Sloth as root after unlocking. Lsof runs with root privileges, but the subsequent attempt at full kernel proc name lookup does not. This is a tough one to solve without an expensive fork of a privileged tool.

Addendum: Still, can't replicate on Mojave. KernelEventAgent shows up as KernelEventAgent, which is 17 chars.

the-real-tokai commented 4 years ago

Correct, I clicked the "Lock" symbol and elevated it, so I could see the tasks I actually was looking for (they run under a different user). The "KernelEventAgen" is reproducible here.

https://external.binaryriot.org/site-github-com/sloth_kerneleventagen.png

I tested this on a "somewhat" outdated Yosemite box (10.10.5). :)

Running lsof on that box with some +c <w> indeed seems to suggest this sort of silly limitation: lsof: +c 255 > what system provides (15)

sveinbjornt commented 4 years ago

OK, now the problem is clear, I don't really think it's worth fixing. It's too silly and expensive to fork full process name lookup to a privileged forked process, and the issue doesn't seem to affect Mojave or El Capitan. So closing. However, thank you very much for your feedback!