From a373b56cb7c63acb406d5fd7643a91daf36d89a8 Mon Sep 17 00:00:00 2001
From: wwwutz personal clanker <Awwwutz@eldersoftheinternet.molgen.mpg.de>
Date: Thu, 22 Oct 2026 09:25:44 +0200
Subject: [PATCH] forensics: add /proc/PID/maps and /proc/PID/syscall

Measured as root on busy hosts (1300-1650 processes): runtime
0.3-0.9s, log size grows 2-3x (e.g. elcattivo 8 MB -> 22 MB per
run), mostly from maps. Reading maps does not cause NFS traffic,
paths are resolved from the dentry cache.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 forensics/forensics | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/forensics/forensics b/forensics/forensics
index 1bdaab9c..629d1548 100755
--- a/forensics/forensics
+++ b/forensics/forensics
@@ -152,6 +152,18 @@ if ( opendir( my $dh, '.' ) ) {
             close M;
         }
 
+        # syscall
+        if ( open M, '<', "$pid/syscall" ) {
+            print map {"${C}syscall $_"} <M>;
+            close M;
+        }
+
+        # maps
+        if ( open M, '<', "$pid/maps" ) {
+            print map {"${C}maps $_"} <M>;
+            close M;
+        }
+
         # too expensive : 3.8s vs. 0.1s
         # smaps_rollup
         #if ( open M, '<', "$pid/smaps_rollup" ) {