Table of Contents
The Nature of `/proc`
The /proc directory is a special part of the Linux filesystem that does not store regular files on disk. Instead, it is a virtual filesystem that the kernel fills with information at runtime. When you look inside /proc, you are seeing a live view of how the system is currently running.
The technical name for this virtual filesystem is procfs. It exists only while the system is running and is created by the kernel in memory. If you reboot, the contents of /proc are regenerated fresh by the kernel, not loaded from any disk.
Important: Files in /proc are not real files on disk. They are kernel interfaces that show live system information and sometimes accept settings. Their contents can change from one moment to the next.
You can explore /proc with ordinary commands such as ls, cat, and less. From your perspective as a user, it behaves like a directory full of files. Internally, the kernel generates the content when you read those files.
Process Information in `/proc`
One of the main purposes of /proc is to show information about running processes. For every process on the system, there is a subdirectory inside /proc whose name is the process ID, or PID. For example, a process with PID 1234 will have a directory /proc/1234.
Inside such a directory you will find many files that describe that specific process. Common examples include:
/proc/<PID>/cmdline which shows the command line that started the process,
/proc/<PID>/cwd which is a link to the process current working directory,
/proc/<PID>/exe which is a link to the executable file of the process,
/proc/<PID>/fd which contains file descriptors that the process currently has open,
/proc/<PID>/status which summarizes details like the process state, user, and memory usage.
These entries give tools like ps, top, and htop the data they display. When you run such tools, they mostly read information from /proc instead of directly from the kernel using special system calls.
Because /proc reflects the live state of the system, data inside /proc/<PID> directories disappears as soon as the process ends. If a process is very short lived, its directory can appear and vanish quickly.
System-Wide Information in `/proc`
Besides the per process directories, /proc contains many files and subdirectories that expose information about the whole system. These are often plain text files that you can read with cat or less.
Some of the more commonly used ones include:
/proc/cpuinfo which describes the system processors, including model and features,
/proc/meminfo which shows memory usage statistics,
/proc/uptime which tells you how long the system has been running,
/proc/partitions which lists disk partitions known to the kernel,
/proc/interrupts which gives counts of hardware interrupts per device,
/proc/swaps which lists active swap areas on the system.
Tools that report hardware information or resource usage often read directly from these files. For example, memory monitor programs derive their data from /proc/meminfo.
You can also find subdirectories that group related system information. For example, /proc/net holds networking related kernel data, and /proc/sys contains files that represent configurable kernel parameters.
Accessing `/proc` as a Regular User
You do not need special tools to work with /proc. Because it is part of the filesystem, you can use familiar commands and patterns. For example, you can change into the directory with:
cd /proc
and list its contents with:
ls /proc
You will immediately see many numeric directories for processes and a large set of named entries. Many of these can be read by any user. However, some information, especially about processes owned by other users or security sensitive data, is protected by file permissions. If you try to read such a file without permission, the kernel returns an error just as with normal files.
It is important to remember that the content of /proc is generated on access. If you run a command that repeatedly reads the same /proc file, the output can vary from one read to the next. As a simple example, /proc/uptime increases each time you view it, because the system keeps running while you read.
Configuring the Kernel with `/proc`
Although much of /proc is read only status information, some entries can be written to in order to adjust running kernel settings. This is especially true for files inside /proc/sys. For example, some networking parameters and system limits are exposed there as tunable values.
When you write a new value into one of these writable files, the kernel updates its internal setting immediately. No reboot is needed because you are interacting with the running kernel itself.
Important: Writing to /proc can change kernel behavior instantly. As a beginner, you should avoid modifying /proc entries unless you are following trusted instructions and understand the effect. Incorrect values can reduce performance or cause serious system problems.
Tools used for kernel tuning often make changes by writing to files under /proc/sys. There are also mechanisms to apply such changes automatically at boot, rather than typing them manually each time.
`/proc` and System Utilities
Many command line tools that report performance and status are simple front ends around /proc. For example, utilities that show CPU usage, memory statistics, or network statistics often read from the relevant /proc files, parse the text, then present it in a more readable form.
This structure allows Linux to offer a uniform interface to internal kernel data. Both humans and programs can access it using common file operations. Scripts can also read from /proc, which makes it a convenient way to gather system information in automated tasks.
Although you will not usually work with /proc in everyday desktop tasks, learning that /proc is the live interface between the running kernel and user space will help you understand how many system tools operate behind the scenes.