Re: more fun with procfs (netfilter)

[Alexander Viro]

On Tue, 20 Nov 2001, Rusty Russell wrote:

> In message <[e-mail]> you wri
> te:
> > Reason: netfilter procfs files try to fit entire records into the user
> > buffer.  Do a read shorter than record size and you've got zero.  And
> > read() returning 0 means you-know-what...
> 
> Yes.  Don't do this.
> 
> Hope that helps,

That's nice, but...

% awk '/ESTABLISHED/{print $5}' /proc/net/ip_conntrack| wc -l
26
% grep ESTABLISHED /proc/net/ip_conntrack| wc -l
56
%

- IOW, awk (both gawk and mawk) loses everything past the first 4Kb.
And yes, it's a real-world example (there was more than $5 and it was
followed by sed(1), but that doesn't affect the result - lost lines).

So the list of "don't do this" is a bit longer than just reading it
from shell.