Understanding Linux Proc Filesystem

poornaMoksha's Avatar author of Understanding Linux Proc Filesystem
This is an article on Understanding Linux Proc Filesystem in Linux.
Proc file system is a pseuso-filesystem that contains the running state information of Linux kernel. This information is presented in the form of proc files. Every proc file represents some information about the current state of kernel. Now, since proc files represent the dynamic state of kernel so no two system can contain exactly same proc file information. The 'Pseudo' word used here is because these proc files are filled with information on run time, ie, when they are read through a utility like 'cat' etc. One can create his/her own entry of proc file in the proc file system by writing a loadable kernel module(which I have already explained in one of my previous articles).The proc file system is rooted on the '/proc' path.

Example



For a quick view, this is how proc file system looks like on my machine :

Code:
~ $ ls /proc
1     1290  1481  1631  1696  1733  1987  24   32   41   63   836  948        dma          kcore          mounts        swaps              zoneinfo
10    1292  15    1634  1697  1736  1988  25   35   414  64   853  977        dri          key-users      mtrr          sys
1051  13    1551  1635  1698  1738  1990  26   353  417  65   874  acpi       driver       kmsg           net           sysrq-trigger
1056  1329  1569  1636  17    1760  1992  27   354  42   66   9    asound     execdomains  kpagecount     pagetypeinfo  sysvipc
11    14    1603  1638  1702  1784  1993  28   355  5    67   914  buddyinfo  fb           kpageflags     partitions    timer_list
12    1429  1606  1641  1704  18    2     29   36   55   68   916  bus        filesystems  latency_stats  sched_debug   timer_stats
1255  1448  1607  1642  1705  1820  20    294  37   56   69   927  cgroups    fs           loadavg        schedstat     tty
1259  1463  1610  1644  1707  1825  21    295  38   59   7    935  cmdline    interrupts   locks          scsi          uptime
1268  1469  1617  1662  1710  1829  2120  296  385  6    718  937  cpuinfo    iomem        mdstat         self          version
1269  1471  1619  1665  1713  1885  2135  3    39   60   8    942  crypto     ioports      meminfo        slabinfo      version_signature
1273  1475  1624  1672  1714  19    22    30   4    61   824  944  devices    irq          misc           softirqs      vmallocinfo
1278  1480  1630  1694  1715  1985  23    31   40   62   829  945  diskstats  kallsyms     modules        stat          vmstat
Most of the entries above are directories while some are files also. As we see, most of the names are numerics. These numerics are directories representing the processes currently running in the system and hence their respective names. For each process running in your system there will be a directory entry with name equal to the PID of the process in system. Do you know, even our favorite command 'ps' uses proc files to extract and present the information to us. Anyways, lets enter into a numeric directory (directory corresponding to a process) :

Code:
/ $ cd proc/1273/

/proc/1273 $ ls
attr    clear_refs       cpuset   exe     io       loginuid  mountinfo   net        oom_score    root       sessionid  stat    syscall
auxv    cmdline          cwd      fd      latency  maps      mounts      numa_maps  pagemap      sched      smaps      statm   task
cgroup  coredump_filter  environ  fdinfo  limits   mem       mountstats  oom_adj    personality  schedstat  stack      status  wchan

/proc/1273 $ vim status
Through above command we have enetred the directory corresponding to the process whose PID is '1273'. Now in the next command we have a look at the contents of this directory. We see a wide range of information for a this particular process. Lets open the 'status' file :

Code:
/proc/1273 $ cat status
Name:    getty
State:    S (sleeping)
Tgid:    1273
Pid:    1273
PPid:    1
TracerPid:    0
Uid:    0    0    0    0
Gid:    0    0    0    0
FDSize:    64
Groups:    
VmPeak:        6080 kB
VmSize:        6076 kB
VmLck:           0 kB
VmHWM:         648 kB
VmRSS:         644 kB
VmData:         192 kB
VmStk:          84 kB
VmExe:          20 kB
VmLib:        1648 kB
VmPTE:          36 kB
Threads:    1
SigQ:    1/23963
SigPnd:    0000000000000000
ShdPnd:    0000000000000000
SigBlk:    0000000000000000
SigIgn:    0000000000000000
SigCgt:    0000000000000000
CapInh:    0000000000000000
CapPrm:    ffffffffffffffff
CapEff:    ffffffffffffffff
CapBnd:    ffffffffffffffff
Cpus_allowed:    3
Cpus_allowed_list:    0-1
Mems_allowed:    00000000,00000001
Mems_allowed_list:    0
voluntary_ctxt_switches:    2
nonvoluntary_ctxt_switches:    2
Stack usage:    8 kB
Now, we see a huge amount of information about the process ranging from the name of the process to the state of the process to its stack usage etc.
So this was all about processes, apart from the processes, a lot of hardware information is also presented by proc files. Like for example in the proc file system, there is a file name 'cpuinfo'. As the name suggests, this file should give a lot of cpu info :

Code:
processor    : 0
vendor_id    : GenuineIntel
cpu family    : 6
model        : 15
model name    : Intel(R) Core(TM)2 Duo CPU     T5800  @ 2.00GHz
stepping    : 13
cpu MHz        : 800.000
cache size    : 2048 KB
physical id    : 0
siblings    : 2
core id        : 0
cpu cores    : 2
apicid        : 0
initial apicid    : 0
fpu        : yes
fpu_exception    : yes
cpuid level    : 10
wp        : yes
flags        : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx lm constant_tsc arch_perfmon pebs bts rep_good aperfmperf pni dtes64 monitor ds_cpl est tm2 ssse3 cx16 xtpr pdcm lahf_lm
bogomips    : 3989.88
clflush size    : 64
cache_alignment    : 64
address sizes    : 36 bits physical, 48 bits virtual
power management:

processor    : 1
vendor_id    : GenuineIntel
cpu family    : 6
model        : 15
model name    : Intel(R) Core(TM)2 Duo CPU     T5800  @ 2.00GHz
stepping    : 13
cpu MHz        : 800.000
cache size    : 2048 KB
physical id    : 0
siblings    : 2
core id        : 1
cpu cores    : 2
apicid        : 1
initial apicid    : 1
fpu        : yes
fpu_exception    : yes
cpuid level    : 10
wp        : yes
flags        : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx lm constant_tsc arch_perfmon pebs bts rep_good aperfmperf pni dtes64 monitor ds_cpl est tm2 ssse3 cx16 xtpr pdcm lahf_lm
bogomips    : 3989.99
clflush size    : 64
cache_alignment    : 64
address sizes    : 36 bits physical, 48 bits virtual
Similar to this file there are many other files that provide useful information about the dynamic state of kernel and hardware.

One intersting fact about proc files is that their size is always zero.

Code:
/proc $ ls -lart cpuinfo 
-r--r--r-- 1 root root 0 2011-09-29 21:39 cpuinfo
This is because, they just reflect the information promised by them. They do not store any information. As soon as you open them, they fetch the information from kernel and provide it to the user-space. As already discussed many of the Linux command line utilities rely on proc files to fetch information. Proc files can be read only or can be read-write. Through read-write proc files, we can even change the dynamic state of the kernel.

In one of next articles, we will learn how to create and modify a proc file.

Conclusion



To conclude, proc file system is a very powerful and simple interface exposed by Linux where-in user processes can have a direct view of the kernel's current state. Besides, viewing the user space can change some of the parameters of the kernel by changing the proc files which are marked as read-write.