Exploring the Linux /proc filesystem

The /proc filesystem appears to always exist because it's built at boot time and is removed at shutdown, but it is actually a virtual filesystem that contains a lot of relevant information about your system and its running processes. In this article, I'll take a deep dive into its contents and what value you, as a sysadmin, can glean from it.

Note: I'm accessing files and directories under /proc as a standard user and not as root unless otherwise noted.

If you look at the files under /proc, you'll see a lot of them (150+), depending on how many processes you have running. 

$ ls /proc
1     174    26    2902   4109   531          fb
10    175    2601  2904   41275  546          filesystems
1004  176    2602  2907   41292  547          fs
<snip>
166   2589   2889  4000   47452  dma          vmstat
167   2594   2898  4005   475    driver       zoneinfo
168   2595   29    40986  522    execdomains

The numbered files are directories that correspond to process numbers or process IDs (PIDs). For example, in the first column, there are processes with the numbers 1, 10, 1055, 1057, 1059, and so on. Inside those process-numbered directories, there are more files that have to do with the processes themselves. Below is a listing of the /proc/411 directory.

$ ls /proc/411
ls: cannot read symbolic link /proc/411/cwd: Permission denied
ls: cannot read symbolic link /proc/411/root: Permission denied
ls: cannot read symbolic link /proc/411/exe: Permission denied
arch_status      fdinfo      numa_maps      smaps_rollup
attr             gid_map     oom_adj        stack
autogroup        io          oom_score      stat
auxv             latency     oom_score_adj  statm
cgroup           limits      pagemap        status
clear_refs       loginuid    patch_state    syscall
cmdline          map_files   personality    task
comm             maps        projid_map     timers
coredump_filter  mem         root           timerslack_ns
cpuset           mountinfo   sched          uid_map
cwd              mounts      schedstat      wchan
environ          mountstats  sessionid
exe              net         setgroups
fd               ns          smaps

There are a few files in each directory that regular users can't read. To list or open those files, you have to be root.

[ If you'd like to see a practical use of /proc's info, check out: How to clear swap memory in Linux ]

You'll notice that a long listing (ls -l /proc) reveals that the regular text files have a size of 0. Ordinarily, a zero-sized file means that it contains no content. However, these /proc files, like the /proc filesystem itself (procfs), are virtual. They do contain information or else why would they be there?

For example, display the cpuinfo file to the screen and you'll see what I mean.

$ cat /proc/cpuinfo 
processor	: 0
vendor_id	: GenuineIntel
cpu family	: 6
model		: 142
model name	: Intel(R) Core(TM) i5-7360U CPU @ 2.30GHz
stepping	: 9
cpu MHz		: 2303.998
cache size	: 4096 KB
physical id	: 0
siblings	: 1
core id		: 0
cpu cores	: 1
apicid		: 0
initial apicid	: 0
fpu		: yes
fpu_exception	: yes
cpuid level	: 22
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx rdtscp lm constant_tsc rep_good nopl xtopology nonstop_tsc eagerfpu pni pclmulqdq monitor ssse3 cx16 pcid sse4_1 sse4_2 x2apic movbe popcnt aes xsave avx rdrand hypervisor lahf_lm abm 3dnowprefetch fsgsbase avx2 invpcid rdseed clflushopt md_clear flush_l1d
bogomips	: 4607.99
clflush size	: 64
cache_alignment	: 64
address sizes	: 39 bits physical, 48 bits virtual
power management:

This file contains information about your CPU(s). Many of the regular text type files contain hardware and system information and you may cat them as you would any other text file. Remember to ignore that zero file size.

In the next installment of this /proc filesystem series, I'll explain the information given in the files. You can explore for yourself, too. Most of the files have names that describe the information that they contain. Some files are more valuable than others to the human mind. Not every file has cpuinfo or meminfo-level information in it that's valuable to a sysadmin, but the information is possibly important to developers, hardware manufacturers, or vendor troubleshooting personnel.

[ Need to learn more about Linux system administration? Consider taking a Red Hat system administration course. ]