Process X-Ray > Documentation > Main Window

 Process X-Ray Main Window

Process X-Ray’s main window is where you will spend most of your time. It is divided into three main ares: controls, process list, and process details. We cover each of these below.

Controls

At the top of the main window is the controls section. It consists of four check boxes, two buttons, and a counter. These controls do the following:

• Auto scroll - When this box is checked, the process list will automatically scroll to each newly added process. You probably want to keep this checked until you want to investigate a process or set of process in detail. During investigation, you should uncheck this box.

• Arguments - When this box is checked, the process details section (and a details window) will show a list of arguments passed to each program.

• Environment - When this box is checked, the process details section (and a details window) will show the environment variables passed to a program.

• UTC - When this box is checked, timestamps in the details section (and a details window) will be displayed in Coordinated Universal Time (UTC). If this box is unchecked, this information is displayed in your local timezone.

• Blank line - Clicking this button will insert a blank line in the process list. This is useful when conducting investigation. For example, you might want to insert a line, perform some action (e.g., launching a program), and then insert a second blank line. Then all the processes between the blank lines represent the activity that happened when you performed that action.

• Clear table - Clicking this button will clear the process list table. This can be useful when conducting an investigation.

• Counter - the number on the far right shows the number of processes (and blank lines) in the process list. When this number hits 5000, the least recently active 2000 processes are cleared from the list. That is, the process list will contain the most recently active 3000 processes. Here and “activity” consists of process’s initial fork(), any exec(), and its final exit().

Process List

In the middle of the window is the list of processes. Four pieces of information for each process is described on each line. These pieces of information are displayed below. Clicking on a process line will display additional details about the process in the details section at the bottom. Double clicking on a process line will open a new window containing the process’s details.

The four columns for each process are:

• PID - The Process ID for the process.

• PPID - The Parent’s Process ID. Each process (with the exception of the first process) is started by another process known as its parent process.

• Event - The most recent activity by the process. It will be either FORK, EXEC, or exit. An “exit” means the process is done. FORK means it is still running the same program as its parent process. EXEC means it is running a new program.

• Program - The name of the program the process is currently running (or last program if if the process has exited). On the Mac (and other UNIX-derived systems), a program can run several different programs during its life. The list of these programs are displayed in the details section.

Details

Clicking on a row in the process list displays additional details known about the process. The details can be quite voluminous, especially if the “Arguments” and “Environment” controls are checked, so scroll through section see the additional details.

Double clicking on a row in the process list brings up a new window containing the same details. For information about these details, see Details Window.