This pattern repeats infinitly:

select(9, [8], [], NULL, {0, 500000})   = 0 (Timeout)
socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 4
ioctl(4, SIOCGIFADDR, {ifr_name="eth1", ifr_addr={AF_INET,
inet_addr("10.6.6.200")}}) = 0
close(4)                                = 0
poll([{fd=3, events=POLLIN}], 1, 0)     = 0 (Timeout)
open("/proc/net/dev", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or
directory)
getsockopt(3, SOL_PACKET, PACKET_STATISTICS, {packets=12, drops=0}, [8]) = 0
read(7, 0xbfcfa0d4, 72)                 = -1 EAGAIN (Resource temporarily
unavailable)
time(NULL)                              = 1275858715


Two questsions:

1. Why it tries to open /proc/net/dev constantly? It should mark that it
doesn't work and use only SOL_PACKET interface.

2. Why it is using both select and poll? And why for select it is using so
small timeout as 500ms ? It constantly wakes up my CPU.

Regards.

I can't repro darkstat using "/proc/net/dev" at all in the current version,
and I don't see the string in any historic one.

darkstat's own code doesn't open /proc/net/dev, and it only calls select
(not poll) - something else is doing those things, possibly libpcap.

The 500ms delay is because of how Linux libpcap worked pre-2009 (the
timeouts are much longer on e.g. FreeBSD) - this should probably be
revisited.