Table of Contents
What `/proc` Is
/proc is a virtual filesystem that exposes information about the running system and processes as if it were a set of files and directories.
Key characteristics:
- It is not stored on disk; it is created by the kernel in memory.
- Contents change dynamically as the system runs.
- Many “files” in
/procare generated on demand when you read them. - You cannot usually edit these files like normal text files (some are read-only, some are special write interfaces to the kernel).
On most systems, /proc is mounted as a proc filesystem:
mount | grep " on /proc "Structure of `/proc`
Per-process directories
For every running process, there is a directory in /proc named with its PID (process ID):
/proc/1– information about process with PID 1/proc/1234– information about process 1234
Inside each PID directory, you’ll find files and subdirectories describing that specific process. Some useful ones:
/proc/<pid>/cmdline– the command and arguments used to start the process
(reading it can show you how a program was launched)./proc/<pid>/cwd– a symlink to the process’s current working directory./proc/<pid>/exe– a symlink to the executable file being run./proc/<pid>/fd/– a directory containing symlinks for all file descriptors the process has open (files, sockets, pipes, etc.)./proc/<pid>/status– human-readable summary: UID, GID, memory usage, state, etc./proc/<pid>/environ– the environment variables for that process (asVAR=valueentries separated by null bytes)./proc/<pid>/maps– memory mappings for the process (useful for debugging, shows loaded libraries and regions of memory)./proc/<pid>/stat– a single line with many numeric fields about the process (less friendly for humans, more for tools).
This per-process tree lets you inspect what’s going on with any process without root in many cases (unless the process is owned by another user, in which case access may be restricted).
System-wide information in `/proc`
Besides per-PID directories, /proc contains many system-level pseudo-files.
Common ones you might use as a beginner:
/proc/cpuinfo
Information about CPUs: model, cores, cache sizes, flags/features.
Example:
cat /proc/cpuinfo/proc/meminfo
Current memory and swap usage details: total RAM, free, buffers, cache./proc/uptime
Two numbers: system uptime (seconds since boot) and idle time (sum of all CPU idle time)./proc/partitions
List of disk partitions detected by the kernel./proc/mounts(or/proc/self/mounts)
All currently mounted filesystems (similar tomountoutput)./proc/interrupts
Hardware interrupt usage by CPU (primarily for debugging and performance analysis)./proc/version
Kernel version and basic build info (also available viauname -randuname -a)./proc/cmdline
The command line used to boot the kernel (kernel parameters from the bootloader).
These files are often read-only from the user’s perspective. Tools like free, top, uptime, and lsblk often use this data internally rather than querying hardware directly.
Kernel and System Settings in `/proc/sys`
The /proc/sys subtree exposes tunable kernel parameters. Many can be:
- Viewed by reading the file.
- Temporarily changed by writing a value to the file (often requires
sudo).
Parameters are grouped in directories by subsystem. Examples:
/proc/sys/net/– networking settings/proc/sys/kernel/– general kernel behavior/proc/sys/vm/– virtual memory settings/proc/sys/fs/– filesystem-related settings
Individual examples (for illustration; do not change them on a production system without understanding them):
/proc/sys/kernel/hostname– current system hostname./proc/sys/kernel/pid_max– maximum PID value the kernel uses./proc/sys/vm/swappiness– tendency to move data from RAM to swap.
You can view a setting with:
cat /proc/sys/kernel/hostname
Many of these correspond to sysctl keys. For example:
/proc/sys/net/ipv4/ip_forward⇔net.ipv4.ip_forward/proc/sys/vm/swappiness⇔vm.swappiness
Changing via file (temporary until reboot):
# Example: temporarily change swappiness (requires root)
echo 10 | sudo tee /proc/sys/vm/swappiness
Changing via sysctl (also temporary unless configured in a sysctl config file):
sudo sysctl vm.swappiness=10Working With `/proc` Safely
Viewing `/proc` entries
You generally use the same tools as for normal text files:
cat /proc/meminfoless /proc/cpuinfohead /proc/uptime
Some caveats:
- Many files in
/procdo not have a traditional size;ls -lmay show0bytes or some small number even though reading them produces more data. - Some files can be large or continuous;
lessis often safer thancatto avoid huge dumps. - Some entries might block or behave strangely if used incorrectly; stick to well-documented files.
Permissions and security
- You typically can read only what the permissions allow and what your user owns.
- Access to
/proc/<pid>for processes owned by other users is restricted; this is a security feature. - Writing to
/proc/sys/*or other writable entries usually requires root and can affect system behavior immediately.
For learning purposes on a personal system or virtual machine, you can:
- Explore
/procwithlsandless. - Compare the output of commands like
freeoruptimewith the contents of/proc/meminfoand/proc/uptime.
Why `/proc` Matters
For a beginner, the main ideas to take away:
/procis where the kernel shows you what it knows about the system and processes.- Many standard tools get their information by reading
/proc. /proc/sysis a central place for runtime kernel configuration (usually viasysctlin practice).- It is a virtual filesystem: data is about the current state of the system, not stored permanently.