Crate proc_tree 

proc-tree

Linux process tree: snapshot, incremental maintenance via fork/exec events, ancestry chain queries, and PID reuse detection.

Quick Start

use proc_tree::{ProcessStore, ProcessInfo, ProcEvent};
use proc_tree::{snapshot, resolve, handle_events, build_chain_string};

// Implement your own storage (or use a provided example)

let store = MyStore;

// Seed from /proc
snapshot(&store).expect("failed to read /proc");

// Resolve a PID
if let Some(info) = resolve(&store, 1) {
    println!("PID 1: cmd={}, user={}", info.cmd(), info.user());
}

// Build ancestry chain
let s = build_chain_string(&store, 1234);
println!("Chain: {}", s);

// Handle events (returns ExitedProcess handles)
let exited = handle_events(&store, &[
    ProcEvent::Fork { child_pid: 200, parent_pid: 100, timestamp_ns: 0 },
]);
// Caller decides when to remove exited processes
for ep in exited {
    ep.remove(&store);
}

PID Reuse Detection

When a process exits and its PID is reused by a new process, cached data becomes stale. ProcessStore implementations should compare start_time_ns with the current /proc value to detect reuse.

Structs

DefaultStore

Process tree store backed by HashMap<Mutex> with optional TTL eviction.

ExitedProcess

An exited process awaiting explicit removal from the store.

ProcessInfo

Process info for a single PID.

ProcessLink

A single entry in a process ancestry chain.

Enums

ProcEvent

A process lifecycle event. Decoupled from any specific event source (proc-connector, audit, etc.) so users can adapt their own events.

Traits

ProcessStore

Trait for process tree storage.

Functions

build_chain_links

Build a chain of ProcessLink from the process tree.

build_chain_string

Build a chain string from the process tree.

children

Get direct children of a PID.

descendants

Get all descendants of a PID (BFS traversal).

display

Render a pstree-style display starting from the given root PID.

find_by_cmd

Find all PIDs whose cmd matches the given string.

find_by_user

Find all PIDs whose user matches the given string.

handle_event

Handle a single process lifecycle event.

handle_events

Handle a batch of process lifecycle events.

is_descendant

Check if pid is a descendant of any process whose cmd == target_cmd.

parse_proc_entry

Parse /proc/{pid}/status, /proc/{pid}/comm, and /proc/{pid}/cmdline into a ProcessInfo.

read_proc_comm

Read the command name for a PID from /proc/{pid}/comm.

read_proc_start_time_ns

Read the process start time in nanoseconds from /proc/{pid}/stat.

resolve

Resolve a PID to its process info.

siblings

Get siblings of a PID (processes with the same parent).

snapshot

Snapshot all running processes from /proc.

tree_len

Get the number of entries in the store.

uid_to_username

Convert a UID to a username by looking up /etc/passwd.