Standard userland utilities like ps, netstat, and top create a false sense of security and observability. Built for simpler times, they are easily blindsided by modern abstractions like containers and capabilities, or outright tricked by argument overwriting and linker hijacking. Furthermore, the “do one thing and do it well” philosophy forces engineers to combine fragmented tool outputs using vague criteria, burying critical insights in noise.

This talk strips away user-space abstractions to demonstrate how to audit, debug, and verify running workloads by querying raw kernel structures directly inside /proc. This approach is invaluable for uncovering malware or anomalies, or for debugging minimalist containers with no native tooling installed. Aivars will explore the most vital /proc files, what they reveal, and how to link them together through inodes and memory addresses to extract the kernel’s absolute truth.