procfs — Processes Information and Kernel Tunables
/proc is the most commonly used virtual filesystem on any Linux system, and tools you’ve already used throughout this course have been reading from it constantly without you necessarily realizing it — ps, top, and free all get their information by reading files under /proc, not through some separate, hidden mechanism. This chapter goes directly into that structure: what’s there, what it means, and how to read it yourself.
Two Kinds Of Content Under /proc
/proc splits roughly into two categories: a numbered directory for every currently running process, and a set of system-wide files describing the kernel and hardware as a whole.
ls /proc1 612 1042 cpuinfo meminfo self ...
2 734 2044 filesystems sys uptime ...Those purely numeric entries — 1, 612, 1042 — are PIDs, one directory per running process, exactly matching the process vocabulary and PID concept from earlier in this course. Everything else — cpuinfo, meminfo, filesystems (which you already met in the last chapter), and more — describes the system as a whole rather than any single process.
Inside A Process’s Directory
Pick any running process — your own shell is a convenient, safe one to explore, since it’s guaranteed to be running right now:
echo $$$$ is a special shell variable holding the current shell’s own PID. Use it directly:
ls /proc/$$A genuinely large number of entries live here — the following are the ones worth actually knowing:
| Entry | Contents |
|---|---|
cmdline | The exact command line this process was started with |
environ | The process’s environment variables |
status | Human-readable summary — state, memory usage, UID/GID, and more |
cwd | A symlink to the process’s current working directory |
exe | A symlink to the actual executable file this process is running |
fd/ | A directory of symlinks, one per open file descriptor |
maps | The process’s memory mappings — libraries, heap, stack, and where each is located in memory |
statm | Memory usage figures in a compact, machine-readable form |
Try a few of these directly:
cat /proc/$$/cmdlineOutput here often looks slightly odd — the arguments are separated by null bytes rather than spaces, which your terminal typically renders as everything running together with no visible separator. This is deliberate: null-byte separation avoids any ambiguity about where one argument ends and the next begins, even if an argument itself happens to contain a space.
cat /proc/$$/statusName: bash
State: S (sleeping)
Pid: 2044
PPid: 2011
Uid: 1000 1000 1000 1000Notice State: S (sleeping) and PPid — the exact process-state and parent-PID vocabulary from earlier process-inspection material, here shown at the actual source ps itself reads from.
ls -l /proc/$$/fdlrwx------ 1 you you 64 Jan 15 10:03 0 -> /dev/pts/0
lrwx------ 1 you you 64 Jan 15 10:03 1 -> /dev/pts/0
lrwx------ 1 you you 64 Jan 15 10:03 2 -> /dev/pts/0File descriptors 0, 1, and 2 — standard input, standard output, and standard error, from earlier redirection material in this course — each shown here as a symlink to whatever they’re actually pointing at. For an interactive shell, all three typically point at the same terminal device.
The Convenient Shortcut: /proc/self
Rather than looking up your own PID with $$ every time, /proc/self is a symlink that always points at whichever process is currently reading it — a different target depending entirely on who’s asking:
ls -l /proc/selflrwxrwxrwx 1 root root 0 Jan 15 10:03 /proc/self -> 2211Note the target PID here belongs to whatever process just ran this ls command, not your shell — /proc/self resolves fresh, per-process, every single time it’s accessed.
System-Wide Information Files
A handful of files under /proc directly describe hardware and kernel state rather than any specific process:
cat /proc/cpuinfoDetailed information about every CPU core the system has — model, speed, features.
cat /proc/meminfoA far more detailed breakdown of memory usage than the summary line top’s header ever showed — total, free, buffers, cache, swap, broken into many precise figures.
cat /proc/uptimeTwo numbers: total seconds since boot, and total seconds the system has spent idle — the raw figures uptime-style tools calculate their human-readable output from.
/proc/sys: The Live, Writable Kernel Tree
This corner of /proc is different from everything else covered so far — most of /proc is read-only, a live snapshot of state you can inspect but not change. /proc/sys, by contrast, holds kernel parameters you can actually write to, changing kernel behavior immediately, while the system is running.
cat /proc/sys/net/ipv4/ip_forward0A 0 here means the kernel currently will not forward IP packets between interfaces — relevant if this machine were ever configured to act as a router. This value can genuinely be changed by writing directly to that same path:
echo 1 | sudo tee /proc/sys/net/ipv4/ip_forwardWarning
Writing directly to /proc/sys changes kernel behavior immediately and with no persistence — the change is gone the instant the system reboots, and there’s no confirmation prompt warning you before it takes effect. This is genuinely useful for testing something’s effect live, but it is not the recommended way to make a lasting configuration change. The next chapter covers sysctl, the proper, supported tool for reading and — more importantly — permanently setting these same values without needing to remember the exact /proc/sys path or redo the change after every reboot.
What’s Next
You can now read process-specific detail and system-wide kernel state directly from the source every monitoring tool in this course ultimately relies on. The next chapter builds directly on the /proc/sys tree just introduced — sysctl, the dedicated command for reading and persistently changing these kernel tunables the right way.