Processes · Lesson 10

/proc Filesystem

Learn how Linux exposes live process and kernel information through the virtual `/proc` filesystem.

Linux commonly mounts procfs at /proc. This virtual filesystem presents kernel-generated interfaces as files and directories; its contents are not ordinary persistent files stored on disk. It exposes process state as well as selected system-wide kernel information.

Finding Process Directories

List the mount and top-level entries with:

$ findmnt /proc
$ ls /proc

Numeric directory names correspond to process IDs visible in the caller's PID namespace. For example, /proc/12345 represents PID 12345 at the instant it exists. /proc/self is a symbolic link that resolves to the observing process's own directory, and /proc/thread-self identifies the current thread.

Visibility and access depend on credentials, namespaces, security policy, and procfs mount options such as hidepid. A process can exit between listing a directory and opening one of its files, so disappearance is a normal race that inspection tools must handle.

What does numeric directory /proc/12345 normally represent?

Reading Process Information

Inspect a process status file when permissions allow:

$ less /proc/12345/status

It includes fields such as process name, state, IDs, credentials, memory counters, capabilities, and signal masks. Other useful entries include:

/proc/12345/cmdline: command-line arguments separated by null bytes
/proc/12345/environ: environment entries, access-controlled and potentially sensitive
/proc/12345/fd/: symbolic links representing open file descriptors
/proc/12345/maps: current memory mappings
/proc/12345/cwd: symbolic link to the current working directory

Treat these as changing observations. Fields can differ by kernel version, a process can change state during a multi-file read, and some counters have subtleties not captured by their names alone.

Which path contains a readable field-oriented summary for PID 12345?

Reading System-Wide Interfaces

Not every /proc entry belongs to a process. Examples include:

/proc/cpuinfo for kernel-reported CPU information
/proc/meminfo for system memory counters
/proc/mounts for the current process's view of mounts
/proc/loadavg for load-average and runnable-task information
/proc/sys/ for runtime kernel parameters

Some files, especially under /proc/sys, are writable configuration interfaces. Do not write to them merely because they look like regular files. Understand the parameter, scope, persistence mechanism, and rollback before making an authorized system change.

Which entry provides system-wide memory counters rather than one process's status?

Using `/proc` through Tools

Linux implementations of tools such as ps, top, and free obtain much of their data from procfs and other kernel interfaces, then label, calculate, and format it. Prefer those tools for routine work when they provide the needed field; read /proc directly for specific details or scripting only after studying the interface documentation.

Direct readers must parse formats correctly, tolerate missing processes, protect sensitive output, and avoid assuming one read is an atomic system snapshot.

Why can /proc/PID disappear between two inspection commands?

Lesson complete

You finished /proc Filesystem

You can now use procfs as a live, access-controlled kernel interface.

Associate numeric /proc directories with visible PIDs.
Read selected per-process files while accounting for races and sensitivity.
Distinguish process directories from system-wide interfaces.
Prefer documented tools and formats for reliable routine inspection.

Keep your learning progress

Create a free account to save this lesson and continue learning on any device.

Create a free account

Next Lesson

Back to Processes