Exploring the Linux /proc filesystem
/proc filesystem appears to always exist because it's built at boot time and is removed at shutdown, but it is actually a virtual filesystem that contains a lot of relevant information about your system and its running processes. In this article, I'll take a deep dive into its contents and what value you, as a sysadmin, can glean from it.
Note: I'm accessing files and directories under
/procas a standard user and not as root unless otherwise noted.
If you look at the files under
/proc, you'll see a lot of them (150+), depending on how many processes you have running.
$ ls /proc 1 174 26 2902 4109 531 fb 10 175 2601 2904 41275 546 filesystems 1004 176 2602 2907 41292 547 fs <snip> 166 2589 2889 4000 47452 dma vmstat 167 2594 2898 4005 475 driver zoneinfo 168 2595 29 40986 522 execdomains
The numbered files are directories that correspond to process numbers or process IDs (PIDs). For example, in the first column, there are processes with the numbers 1, 10, 1055, 1057, 1059, and so on. Inside those process-numbered directories, there are more files that have to do with the processes themselves. Below is a listing of the
$ ls /proc/411 ls: cannot read symbolic link /proc/411/cwd: Permission denied ls: cannot read symbolic link /proc/411/root: Permission denied ls: cannot read symbolic link /proc/411/exe: Permission denied arch_status fdinfo numa_maps smaps_rollup attr gid_map oom_adj stack autogroup io oom_score stat auxv latency oom_score_adj statm cgroup limits pagemap status clear_refs loginuid patch_state syscall cmdline map_files personality task comm maps projid_map timers coredump_filter mem root timerslack_ns cpuset mountinfo sched uid_map cwd mounts schedstat wchan environ mountstats sessionid exe net setgroups fd ns smaps
There are a few files in each directory that regular users can't read. To list or open those files, you have to be root.
[ If you'd like to see a practical use of /proc's info, check out: How to clear swap memory in Linux ]
You'll notice that a long listing (
ls -l /proc) reveals that the regular text files have a size of 0. Ordinarily, a zero-sized file means that it contains no content. However, these
/proc files, like the
/proc filesystem itself (
procfs), are virtual. They do contain information or else why would they be there?
For example, display the
cpuinfo file to the screen and you'll see what I mean.
$ cat /proc/cpuinfo processor : 0 vendor_id : GenuineIntel cpu family : 6 model : 142 model name : Intel(R) Core(TM) i5-7360U CPU @ 2.30GHz stepping : 9 cpu MHz : 2303.998 cache size : 4096 KB physical id : 0 siblings : 1 core id : 0 cpu cores : 1 apicid : 0 initial apicid : 0 fpu : yes fpu_exception : yes cpuid level : 22 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx rdtscp lm constant_tsc rep_good nopl xtopology nonstop_tsc eagerfpu pni pclmulqdq monitor ssse3 cx16 pcid sse4_1 sse4_2 x2apic movbe popcnt aes xsave avx rdrand hypervisor lahf_lm abm 3dnowprefetch fsgsbase avx2 invpcid rdseed clflushopt md_clear flush_l1d bogomips : 4607.99 clflush size : 64 cache_alignment : 64 address sizes : 39 bits physical, 48 bits virtual power management:
This file contains information about your CPU(s). Many of the regular text type files contain hardware and system information and you may
cat them as you would any other text file. Remember to ignore that zero file size.
In the next installment of this
/proc filesystem series, I'll explain the information given in the files. You can explore for yourself, too. Most of the files have names that describe the information that they contain. Some files are more valuable than others to the human mind. Not every file has
meminfo-level information in it that's valuable to a sysadmin, but the information is possibly important to developers, hardware manufacturers, or vendor troubleshooting personnel.
[ Need to learn more about Linux system administration? Consider taking a Red Hat system administration course. ]