all writing

Building minitop: a Linux /proc process monitor

2026-03-11

How I built a tiny top-like monitor in C using /proc, CPU tick deltas, and RSS parsing.

Linux · C · systems · observability

I built minitop as a tiny top-like monitor for Linux. The goal was simple: read the kernel's process metadata directly from /proc and print the hottest processes by CPU usage every second.

Core idea

For each refresh cycle, I collect:

  • Total CPU ticks from /proc/stat
  • Per-process ticks (utime + stime) from /proc/<pid>/stat
  • Process memory (RSS) from /proc/<pid>/status (VmRSS)

Then I compute CPU percentage from tick deltas between two samples.

unsigned long long delta_total = total_now - prev_total;
unsigned long long delta_proc  = proc_now  - proc_prev;

cpu_percent = delta_total ? (100.0 * delta_proc / delta_total) : 0.0;

Reading total CPU ticks

I parse the first cpu line in /proc/stat and sum all fields I need.

int read_total_cpu_ticks(unsigned long long *total) {
  FILE *f = fopen("/proc/stat", "r");
  if (!f) return -1;

  char line[512];
  if (!fgets(line, sizeof(line), f)) {
    fclose(f);
    return -1;
  }
  fclose(f);

  unsigned long long user, nice, system, idle, iowait, irq, softirq, steal;
  if (sscanf(line, "cpu %llu %llu %llu %llu %llu %llu %llu %llu",
             &user, &nice, &system, &idle, &iowait, &irq, &softirq, &steal) < 4) {
    return -1;
  }

  *total = user + nice + system + idle + iowait + irq + softirq + steal;
  return 0;
}

Scanning /proc safely

I walk /proc and only keep numeric directory names (PIDs). For each PID:

  • Read process name from /proc/<pid>/stat
  • Read RSS from /proc/<pid>/status
  • Read process ticks from /proc/<pid>/stat

After computing CPU%, I sort descending and print top rows.

qsort(procs, count, sizeof(ProcInfo), cmp_cpu_desc);
for (int i = 0; i < count && i < 15; i++) {
  printf("%-7d %7.2f %12ld  %s\n",
         procs[i].pid, procs[i].cpu_percent, procs[i].rss_kb, procs[i].name);
}

Why this project matters

minitop forced me to understand how Linux exposes process/accounting data and how tools derive metrics from raw counters, not from "magic APIs".