Linux Sessions for Monitoring and Reviewing Linux Workloads
summary
Defines a Linux session as the group of processes created by the setsid system call and shows how to record who what when and where by capturing UTC timestamps plus the kernel boot ID and event write times. Demonstrates using ps -ajxf | awk to link four related sessions and explains tmux/screen reparenting to init. Points out two surprises: UID namespace mismatch in containers and shared-login tools like amazon-ssm-agent and kubectl that hide individual users, so capture container image identity, namespace and pod names.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:15Linux Workload Model
- 2:48User Identity
- 4:03Kubernetes
- 6:15PS
- 6:54Awk
- 7:43PS Output
- 9:09Special Sessions
- 10:08Tmux and Screen
- 10:47Special Session Features
- 11:04Classifications
- 13:34Summary
related talks
47mMinimum Viable Linux
33mLinux Container Internals
23mLife of a Container
43mLinux Container Performance Analysis
39mContainers are Linux - but what does it mean?
51mLinux Systems Performance - Architecture
26mContainers: Your Ally in Improving Security
26mExploring Container Mechanisms Through the Story of a Syscall