Table of Contents
Understanding `/sys`
/sys is a special, virtual filesystem that exposes information about your hardware and certain kernel features. It is usually mounted as a sysfs filesystem and is managed directly by the kernel.
Unlike normal directories, files in /sys do not live on disk. They are created and updated by the kernel in real time. Reading them queries the kernel; writing to some of them can change kernel behavior or hardware settings.
This chapter focuses on what makes /sys unique and how to safely explore it as a beginner.
Key characteristics of `/sys`
- Virtual / in‑memory: No actual files on disk; everything is generated by the kernel on demand.
- Kernel‑centric: It exposes the kernel’s view of devices, drivers, power management, and other subsystems.
- Mostly read‑only for normal users: Many entries are readable by all; only some are writable, typically requiring
root. - Highly structured: Organized by concepts like devices, buses, classes, firmware, power, etc.
- System‑critical: You can break things if you randomly write to
/sysasroot. Reading is safe; writing requires caution.
Common top‑level areas in `/sys`
Here are some of the most important subdirectories you’ll see under /sys and what they represent. Names and exact structure can vary slightly between systems, but the concepts are consistent.
`/sys/devices`
Represents actual hardware devices as the kernel sees them: PCI devices, USB devices, CPU cores, memory blocks, and more.
Examples of things you might see inside:
- CPU topology and characteristics
- Disk controllers and attached drives
- USB controllers and their attached devices
You’ll often use /sys/devices indirectly via symbolic links from other directories (like /sys/class).
`/sys/class`
Groups devices by type (class), not by physical location. Devices that belong to the same functional class are listed together here, even if they are attached via different hardware buses.
Common subdirectories include:
/sys/class/net— Network interfaces (eth0,wlan0,lo, etc.)/sys/class/block— Block devices (disks, partitions)/sys/class/input— Input devices (keyboards, mice, touchpads)/sys/class/tty— Terminal devices
Each entry here usually points (via a symlink) back to the corresponding device in /sys/devices.
`/sys/bus`
Groups devices based on the bus or connection type used to communicate with them.
Examples:
/sys/bus/pci— PCI / PCIe devices (graphics cards, network cards, etc.)/sys/bus/usb— USB devices/sys/bus/platform— Platform devices (often embedded or SoC devices)
Each bus directory contains lists of devices and drivers associated with that bus.
`/sys/block`
Lists block devices, such as hard drives, SSDs, and sometimes partitions.
You’ll see names like:
sda,sdb— SCSI/SATA disks (and NVMe compat layers on some systems)nvme0n1— NVMe drivesloop0,loop1— Loopback block devices
Inside each block device directory, you can view attributes like size, queue settings, and sometimes performance tuning options.
`/sys/firmware`
Exposes interfaces to firmware‑related features and configuration, such as:
- ACPI information (power, sleep states, thermal zones)
- EFI/UEFI variables (on UEFI systems)
- Other platform‑specific firmware controls
Modifying some of these values can affect power behavior, boot options, and more, so it should be handled with care.
`/sys/power`
Controls and reports system‑wide power management information. Common entries include:
state— Supported system sleep states (e.g.,freeze,standby,mem,disk)wake_lock,wake_unlock(on some kernels)- Various tuning knobs related to suspend, hibernation, and power saving
Regular users typically only read these files; writing is usually reserved for root and can immediately change power behavior.
`/sys/kernel`
Contains tunable parameters and information about different kernel subsystems.
Common parts include:
/sys/kernel/debug(if enabled) — Debugging information/sys/kernel/mm— Memory management settings/sys/kernel/uevent_helperand others — Legacy or special interfaces
Many of these settings are used for debugging or advanced tuning.
Typical use cases for `/sys` (for beginners)
Even as a beginner, you can safely inspect /sys to better understand your system. Here are a few practical, read‑only examples.
Checking CPU information
CPU cores are usually visible under /sys/devices/system/cpu:
ls /sys/devices/system/cpu
cat /sys/devices/system/cpu/cpu0/online
You might see directories like cpu0, cpu1, etc. Inside each, you can find attributes describing that core.
Inspecting network interfaces
Network interfaces appear under /sys/class/net:
ls /sys/class/net
cat /sys/class/net/eth0/operstate
cat /sys/class/net/eth0/address
Replace eth0 with the actual interface name on your system (such as enp3s0, wlan0, etc.).
Viewing disk device attributes
Block devices are listed in /sys/block:
ls /sys/block
cat /sys/block/sda/size
cat /sys/block/sda/queue/rotational
The size value is in 512‑byte sectors; multiply it by $512$ to get the size in bytes.
Exploring input devices
Input devices such as keyboards and mice show up under /sys/class/input:
ls /sys/class/input
ls -l /sys/class/input/event0
These are often mapped to /dev/input/event* devices.
Reading vs writing in `/sys`
- Reading: Generally safe. Reading a file in
/sysusually just returns a simple text value or a small set of options. - Writing: Potentially dangerous if you don’t know exactly what you’re doing. Writing incorrect values can:
- Disable devices
- Change power states
- Affect performance or system stability
- In rare cases, cause data loss or crashes
Always:
- Read the current value first.
- Research any attribute before attempting to change it.
- Avoid experimenting as
rooton a system you care about.
Relationship of `/sys` to other virtual filesystems
/sys is part of a family of virtual kernel interfaces:
/proc— Process and kernel runtime information./sys— Kernel’s view of devices, buses, drivers, and many tunables.
They complement each other: /proc is more process‑ and system‑info‑oriented, while /sys is more device‑ and subsystem‑oriented, with more structured and fine‑grained control.
Summary
/sysis a virtual filesystem (usuallysysfs) that exposes the kernel’s internal view of devices, buses, drivers, and various kernel and power management settings.- It is organized into conceptual groupings like
/sys/devices,/sys/class,/sys/bus,/sys/block,/sys/firmware,/sys/power, and/sys/kernel. - Reading values in
/sysis a useful, safe way to learn about your hardware and kernel behavior. - Writing to
/sysis powerful and should only be done deliberately, usually by advanced users or tools, due to the risk of affecting system behavior or stability.