ls -l /proc/$pid/fdAnswersEvery file, socket and pipe the process has open at this instant, as symlinks you can read.
Not thisNothing about what it wrote to them, or what it opened an hour ago and closed.
What a system keeps · G1 G5 S4
cat /proc/$pid/ioAnswersBytes this process has actually read and written since it started. The kernel counted them because they went through the kernel.
Not thisWhat any of those bytes were. It is a count with the meaning taken off, which is the shape of half these scaffolds.
What a system keeps · G1 G12 S5
journalctl -u my-service -fAnswersWhat the program chose to say about itself, live.
Not thisAnything it decided not to print. An empty journal and a silent daemon are indistinguishable from here.
What a system keeps · G1 S4 G13
journalctl --disk-usage
du -sh /var/log/*AnswersHow much the machine has already kept without being asked. Run it before you claim anything forgets.
Not thisWhere the rest is. Libraries and shells write in places neither of these looks.
What a system keeps · G1 G9 S5
mosquitto_sub -h localhost -t '#' -vAnswersEvery message on the broker, and the retained ones arrive first — which is the persistence people leave switched on by accident.
Not thisNothing that was published before you subscribed and was not retained. Silence here is not evidence.
What a system keeps · G1 G5 G12
stat -c '%y %n' reading.jsonAnswersWhen the file was last written, to the second. This is staleness, and it is the number S8 puts above the reading.
Not thisWhen the measurement was taken. A file written now can hold a value from an hour ago.
What a system keeps · S8 G12 S5
tail -5 ~/.bash_historyAnswersA record nobody asked for, kept by default, of every command typed at this machine.
Not thisWhether it is the only one. This is the example, not the exhaustive list.
What a system keeps · G1 G5
ss -tulpnAnswersEvery socket listening on this machine, with the process holding it. Usually the honest way in: you know something answers and not what.
Not thisAnything about traffic that already happened, or about a process that only makes outbound connections.
What a node can know · G2 G16 S10
sudo tcpdump -i any -n port 1883AnswersWhat actually left the machine, frame by frame, regardless of what any program claims.
Not thisWhat is inside an encrypted payload — and it sees only this host. A capture on the switch is better evidence.
What a node can know · G2 G6 S10
iw dev wlan0 linkAnswersSignal strength in dBm for the link you are on. Every three units is roughly a doubling of power.
Not thisWhat the noise floor is. A reading of −70 means nothing until you know what the room reads with your transmitter off.
What a node can know · S10 G2
sudo iw dev wlan0 set txpower fixed 500AnswersSets transmit power to 5 dBm. This is the whole method for S10 — lower it until the link barely works, then find out where barely stops.
Not thisWhether the signal is undetectable elsewhere. Containment is measured at every place somebody might stand, never at one.
What a node can know · S10 G6
iw dev wlan0 scan | grep -E 'SSID|signal'AnswersEverything else transmitting near you, with its strength. This is the floor your own link has to clear.
Not thisAnything not beaconing. A quiet channel is not an empty one.
What a node can know · S10 G2 G4
sudo batctl n
sudo batctl oAnswersA mesh node's direct neighbours, and the originators it has heard of. G2's whole display is the first of these.
Not thisA map. That is the point of the scaffold — no node has one, and this command does not assemble one either.
What a node can know · G2
ping -c 20 -i 0.2 10.0.0.7AnswersLoss and round-trip time. Unplug a node while it runs and you have watched a partition happen.
Not thisWhich side of a partition you are on. Both sides see the same silence, and neither can tell which is the surviving one.
What a node can know · G16 G2 G6
sudo iw dev wlan0 set type monitor
sudo ip link set wlan0 upAnswersPuts the card into the state where frames not addressed to you can be captured. Nothing in C works without it.
Not thisWhether your adapter can do it at all — that is a property of the silicon. And it is not a licence: consent comes first, out loud.
Sensing people · G4
sudo tcpdump -i wlan0mon -e type mgt subtype probe-reqAnswersProbe requests, with the sending radio's address — the raw material of G4's count.
Not thisPeople. One person may carry three radios and another none, and no correction recovers the number of bodies.
Sensing people · G4 G8
echo "$mac" | cut -c2 | grep -qi "[26ae]" && echo randomisedAnswersReads the locally administered bit out of the second character. Set means the device made the address up.
Not thisWhich device made it up, or whether the same phone made ten. Randomisation is exactly the thing that stops you knowing.
Sensing people · G4
arecord -lAnswersWhich capture devices the system actually has, with the card and device numbers the rest of your commands need.
Not thisWhether the gain is under your control. Automatic gain will flatten the differences you are working with.
Sensing people · G7 S6
arecord -d 5 -f S16_LE -r 16000 room.wav
sox room.wav -n statAnswersFive seconds of the room and its RMS amplitude. Take this with nobody speaking — it is the threshold G7 has to clear.
Not thisWhether speech is present. A level is a level; deciding it was a voice is the next problem and a harder one.
Sensing people · G7 S6
sudo lsof /dev/snd/*AnswersWhich processes have the microphone open right now. This is how a visitor checks G7's claim rather than believing it.
Not thisWhat they are doing with it. Having it open and transcribing are the same to this command.
Sensing people · G7 S6
systemctl status my-serviceAnswersThe main PID, whether it is running, and the last few lines it printed. The service manager knows because it is the parent.
Not thisAnything the program did not print. This is still the daemon's own account, formatted.
The interface is the machine · S4 G3 G10
systemctl cat my-serviceAnswersThe unit file entire — the command, the user, the working directory, the restart policy. The whole contract, on one screen.
Not thisWhat the program does. It tells you the conditions of running, never the behaviour.
The interface is the machine · S4 G3
pid=$(systemctl show -p MainPID --value my-service)AnswersThe number every /proc command below needs, without reading it off a status page by eye.
Not thisNothing on its own — but note that this one step is cooperative. The kernel's record is honest; getting the PID still means asking politely.
The interface is the machine · S4 G10
tr '\0' ' ' < /proc/$pid/cmdlineAnswersExactly how the process was started, arguments and all. Where a config disagrees with behaviour, look here first.
Not thisWhat it read after starting. A flag is not a configuration file.
The interface is the machine · S4 G3
ls -l /proc/$pid/cwdAnswersThe directory its relative paths resolve against. A path that works by hand and fails under systemd fails for this reason alone.
Not thisWhich paths it actually uses. It tells you the origin, not the destinations.
The interface is the machine · S4 G3
sudo strace -p $pid -e trace=read,writeAnswersEvery read and write as it happens, from outside, without the program's cooperation. The closest thing here to watching.
Not thisWork that never becomes a system call. Computation inside the process is invisible to it, and it slows the thing down while you watch.
The interface is the machine · S4 G10 G13
gpioinfo
pinctrl get 17AnswersWhich pins exist, which are claimed, by what, and what state each is in — the board's own account of its edges.
Not thisWhat is wired to them. Nothing in software knows what is on the other end of a pin.
The interface is the machine · S1 S3 G15
i2cdetect -y 1AnswersEvery address answering on the bus. Your converter or current monitor is either here or it is not wired correctly.
Not thisWhich chip is at an address. It is a knock and a reply, not an introduction.
The object's own body · S3 S9 S7
vcgencmd measure_volts core
vcgencmd measure_tempAnswersThe board's own readings of its supply and its temperature — a device measuring itself, which is S9's whole premise.
Not thisConsumption. Voltage is not power, and the meter is inside the thing it measures either way.
The object's own body · S9
gpioset gpiochip0 17=1
gpioget gpiochip0 27AnswersDrive a pin high and read one back, by hand, with no program in between. The fastest way to find out whether it is wiring or code.
Not thisWhether a pin can drive your load. It cannot — that is what the transistor and the flyback diode are for.
The object's own body · S2 S7 S12
lsblk -o NAME,SIZE,MOUNTPOINT,MODELAnswersEvery non-volatile store attached, which is where a previous owner persists whether or not anybody meant them to.
Not thisWhat is on it. And a card that has been unmounted is not a card that has been cleared.
The object's own body · S11
sudo shred -vn1 /dev/sda
syncAnswersOverwrites a block device once and reports progress. It is the closest thing to an erase you can show somebody happening.
Not thisThat the data is gone. Flash remaps blocks underneath you, so this cannot promise what it looks like it promises — which is exactly S11's design problem.
The object's own body · S11
udevadm monitor --udevAnswersEvery device appearing and disappearing, live. A USB port is a port in the same sense a network port is.
Not thisWhat arrived. It names a device node, not an intention.
The object's own body · S11 S12 G15
Nothing here matches that. Try plainer words — old, listening, leaving, pin, erase.