What is /proc in Linux (for beginners)

What is /proc

There is a directory named /proc on Linux. The files in this directory are virtual, for the Linux kernel to provide internal information; there is no file entity anywhere, like files on an SSD.

Example of files in /proc

An example is as follows. The ls command is executed with -F option, directories and symbolic links are respectively shown with / and @ at the tail.
$ ls -F /proc/
1/      73669/     crypto          irq/         modules       sys/
3674/   73681/     devices         kallsyms     mounts@       sysrq-trigger
3675/   73687/     diskstats       kcore        mtrr          sysvipc/
38/     91/        dma             keys         net@          thread-self@
4771/   92/        driver/         key-users    pagetypeinfo  timer_list
4777/   acpi/      dynamic_debug/  kmsg         partitions    tty/
4778/   asound/    execdomains     kpagecgroup  pressure/     uptime
61/     buddyinfo  fb              kpagecount   schedstat     version
72/     bus/       filesystems     kpageflags   self@         vmallocinfo
73/     cgroups    fs/             loadavg      slabinfo      vmstat
73632/  cmdline    interrupts      locks        softirqs      zoneinfo
73638/  consoles   iomem           meminfo      stat
73639/  cpuinfo    ioports         misc         swaps
As you can see at first glance, there are directories with only numbers (e.g. 1/, 3674/, etc.) and other files and directories (e.g. acpi/, buddyinfo, etc.). Numeric directories contain information on processes with process numbers of that value in the form of files under that directory. Other files and directories (files included in) contain information about the entire system.

Directories for process

Now, as an example, let's run the sleep command and start the process. The process is started with process ID 73717.
$ sleep 3600 &
[1] 73717
Let's look at the /proc information about this process.
$ ls -F /proc/73717/
arch_status         fd/                net/           setgroups
attr/               fdinfo/            ns/            smaps
autogroup           gid_map            numa_maps      smaps_rollup
auxv                io                 oom_adj        stack
cgroup              ksm_merging_pages  oom_score      stat
clear_refs          ksm_stat           oom_score_adj  statm
cmdline             limits             pagemap        status
comm                loginuid           patch_state    syscall
coredump_filter     map_files/         personality    task/
cpu_resctrl_groups  maps               projid_map     timens_offsets
cpuset              mem                root@          timers
cwd@                mountinfo          sched          timerslack_ns
environ             mounts             schedstat      uid_map
exe@                mountstats         sessionid      wchan
There are many different files and directories, but I will list here two that I often use.

exe

Here is a link to the executable of the process. You can see that the executable of the process is /usr/bin/sleep.
 $ ls -l /proc/73717/exe
lrwxrwxrwx 1 foo foo 0 Mar 19 11:06 /proc/73717/exe -> /usr/bin/sleep

fd

It contains a symbolic link to the file that the process is opening. The file name of the symbolic link is the descriptor number. In this case, we see that three files for standard I/O are open.
$ ls -l /proc/73717/fd
total 0
lrwx------ 1 foo foo 64 Mar 19 11:15 0 -> /dev/pts/5
lrwx------ 1 foo foo 64 Mar 19 11:15 1 -> /dev/pts/5
lrwx------ 1 foo foo 64 Mar 19 11:15 2 -> /dev/pts/5

Entire system information

Three system-wide files are also presented.

partitions

Partitions detected by the Linux kernel are included. In the following, the NVMe storage partition is shown. When a USB storage device is inserted, sda, sda1, sda2, etc. will be added to the list. This is useful to check if the Linux kernel recognizes the connected storage device.
$ cat /proc/partitions 
major minor  #blocks  name

 259        0 1953514584 nvme0n1
 259        1     498688 nvme0n1p1
 259        2   19530752 nvme0n1p2
 259        3   19530752 nvme0n1p3
 259        4   19530752 nvme0n1p4
 259        5   19530752 nvme0n1p5
 259        6 1874891776 nvme0n1p6

uptime

The time since Linux was started is stored.
$ uptime
 11:22:23 up  9:19,  2 users,  load average: 0.00, 0.00, 0.00

self

When a process refers to this file, it is a link to the directory for that process. In other words, different links point to different destinations depending on the process reading them.

In the following example, The link 73729 is the directory for the ls command itself which is reading /proc.

$ ls -l /proc/self
lrwxrwxrwx 1 root root 0 Mar 19 02:02 /proc/self -> 73729

More information

There are many files in /proc as shown in the examples in this article. See below for a detailed description of them.

No comments:

Post a Comment