Read Process Statistics Safely with prtstat

A raw /proc/<pid>/stat line is unreadable at a glance, which is the entire reason prtstat exists. You will finish with a repeatable way to inspect one Linux process, save either a readable report or the command's raw fields, and recognise when a PID has already vanished on you. The examples use prtstat from psmisc 23.7, the version installed on this machine.

Allow about ten minutes. You need a shell and a process ID you are allowed to inspect. The normal examples are unprivileged and read-only: this guide does not stop, reprioritise or otherwise touch a process.

1. Check the installed command

Confirm which binary your shell will run and check its version:

$ command -v prtstat
/usr/bin/prtstat
$ prtstat --version
prtstat (PSmisc) 23.7

The manual gives two forms: prtstat [ -r | --raw ] pid for a report, and prtstat -V or prtstat --version for version information. There is no option for selecting several PIDs at once, so inspect one PID per invocation.

2. Choose a live PID without changing it

For a quick test, ask the shell for its own process ID:

$ printf 'shell PID: %s\n' "$$"
shell PID: 646404

Your number will differ. For a named process, run a read-only listing and pick an exact PID from it:

$ ps -eo pid,comm,args | rg '[s]sh|[n]ginx|[s]ystemd'
      1 systemd         /sbin/init
   2187 sshd            sshd: user@pts/2

• Do not trust a partial name match. Check the command and arguments too. A PID is a short-lived identifier, not a permanent one: a service can exit between the listing and the moment prtstat reads it, and the kernel can later hand the same number to something else entirely.
• Respect ownership. If the process belongs to another account, /proc permissions may block inspection. Try the ordinary command first, and only reach for an elevated shell when your host policy allows it and you genuinely need that process. sudo does not make a stale PID current.

3. Produce the readable report

Pass the PID as the final argument. This reads the process statistics from /proc/<pid>/stat and formats them for a person:

$ prtstat "$$"
Process: bash             State: S (sleeping)
CPU#:  2                 TTY: 0:0        Threads: 1
Process, Group and Session IDs
 Process ID: 646404       Parent ID: 639163
 Group ID: 646404         Session ID: 646404
 T Group ID: -1

Page Faults
 This Process   (minor major):      899         0
 Child Processes (minor major):    1024         0

CPU Times
 This Process (user system guest blkio): 0.00   0.00   0.00
 Child processes (user system guest):     0.01   0.00   0.00

The exact numbers and some labels depend on the process and the moment you read it. Check the command name, state, process ID, parent ID, group and session IDs, page faults, CPU times, memory and scheduling values first. A single report is a snapshot, not a live monitor.

4. Save a report for later comparison

Redirect the readable form to a new file when you need a ticket attachment or a before-and-after comparison:

$ pid="$$"
$ prtstat "$pid" > "prtstat-$pid.txt"
$ test -s "prtstat-$pid.txt" && echo "saved prtstat-$pid.txt"
saved prtstat-646404.txt

The command writes the report to standard output, so shell redirection controls the destination. test -s confirms the file exists and is non-empty; it does not confirm the process stayed the same after the read. If a destination already holds evidence, choose a new name or make a deliberate backup before using >, since redirection truncates an existing file.

There is nothing to undo in prtstat itself. To remove a report you created, check its exact path and contents first, then delete it only once you no longer need it. Keep diagnostic files if they might be part of an incident record.

5. Use raw output when a script needs the fields

Add --raw, or its short form -r, when you need values close to the underlying /proc/<pid>/stat record:

$ prtstat --raw "$$"
         pid: 646404           comm: bash
       state: S               ppid: 639163
        pgrp: 646404        session: 646404
       tty_nr: 0              tpgid: -1
        flags: 400000          minflt: 925
       cminflt: 1131           majflt: 0
       cmajflt: 0              utime: 0
        stime: 0              cutime: 1
        cstime: 0           priority: 20

Raw mode is still formatted text, just easier to diff in a terminal or preserve in a diagnostic file. Do not treat the spacing as a stable machine-readable interface unless your own parser deliberately handles it: the process can change between two invocations, and counters can climb while it runs.

Check the exit code as well as the output:

$ if prtstat --raw "$pid" > "raw-$pid.txt"; then
>     echo "prtstat succeeded"
> else
>     echo "prtstat could not read PID $pid" >&2
> fi
prtstat succeeded

6. Handle a missing or changing PID

A process may exit before the command opens its proc entry:

$ prtstat 99999999
Process with pid 99999999 does not exist.

That is a failed inspection, not evidence the process was healthy or unhealthy. Check the original service or application logs, get a fresh PID, and run the command again. Investigating something short-lived? Capture the PID and report from the same supervising script as close together as you can manage, while accepting that a race always remains possible.

Even a successful report has limits. It does not freeze the process, sample it repeatedly, explain why it is blocked, or prove a service is actually functioning. Use a purpose-built monitor, tracing tool or service diagnostic for those questions instead, and keep prtstat as the quick snapshot of what the kernel reported for one PID at one moment.