[Linux] Proc File System

Reprinted from: http://linux.chinaunix.net/doc/2004-10-05/16.shtml#324lfindex0

Directory :

• /proc---A virtual file system
• Loading the proc file system
• View/proc's Files
• Get useful system/kernel information
• Information about the running process
• Interacting with the kernel via/proc
• Conclusion
• Reference documents
  

proc---a virtual file system

The/proc file system is a mechanism used by kernel and kernel modules to send information to processes (so called/proc). This pseudo file system allows you to interact with the internal data structure of the kernel, get useful information about the process, and change the settings (by changing the kernel parameters) in the run (on the fly). Unlike other file systems,/proc exists in memory, not on the hard disk. If you look at the file/proc/mounts (and the Mount command lists all the file systems that have been loaded), you'll see one line like this:

grep proc/proc/mounts/proc/proc proc RW 0 0

The/proc is controlled by the kernel and does not have a device that hosts/proc. Because/proc primarily stores state information controlled by the kernel, the logical location of most of this information resides in kernel-controlled memory. A ' ls-l ' for/proc can see that most files are 0 bytes large, but when you look at these files, you can actually see some information. How is that possible? This is because the/proc file system registers itself with the virtual file system layer (VFS) Like other regular file systems. However, until the VFS invokes it and requests the i-node of the file and directory, the/proc file system establishes the corresponding files and directories based on the information in the kernel.

Loading the proc file system

If the proc file system is not yet loaded on the system, you can load the proc file system with the following command:

MOUNT-T proc Proc/proc

The above command will successfully load your proc file system. For more details, read the man page of the Mount command.

View/proc's Files

The

/proc file can be used to access information about the state of the kernel, the properties of the computer, the state of the running process, and so on. Most files and directories in/proc provide the latest information about the physical environment of the system. Although the files in/proc are virtual, they can still be viewed using any file editor or a program like ' more ' or ' less ' or ' cat '. When the editor tries to open a virtual file, the file is created from a thin air (on the fly) through the information in the kernel. Here are some interesting results I got from my system:

$ ls-l/proc/cpuinfo-r--r--r--1 root root 0 Dec 11:01/proc/cpuinfo$ file/proc/cpuinfo/proc/cpuinfo:empty$ cat/pro C/CPUINFOPROCESSOR:0VENDOR_ID:GENUINEINTELCPU Family:6model:8model Name:pentium  III (Coppermine) stepping:6cpu mhz:1000.119cache size:256 kbfdiv_bug:nohlt_bug:  Nosep_bug:nof00f_bug:nocoma_bug:nofpu:yesfpu_exception:yescpuid level: 2WP:YESFLAGS:FPU VME de PSE TSC MSR PAE MCE cx8 apic Sep mtrr PGE Mcacmov Pat PSE36 MMX FXSR X Mmbogomips:1998.85processor:3vendor_id:genuineintelcpu Family:6model:8model NA Me:pentium III (Coppermine) stepping:6cpu Mhz:1000.119cache size:256 kbfdiv_bug:n Ohlt_bug:nosep_bug:nof00f_bug:nocoma_bug:nofpu:yesfpu_exception:ye  Scpuid LEVEL:2WP            : Yesflags:fpu vme de PSE TSC MSR PAE MCE cx8 apic Sep mtrr PGE Mcacmov Pat Pse36 MMX FXSR Xmmbogo mips:1992.29

This is a result of a dual CPU system, most of the above information is very clear about the system's useful hardware information. Some/proc files are encoded, and different tools can be used to interpret the encoded information and output it in a readable form. Such tools include: ' Top ', ' ps ', ' APM ' and so on.

Get useful system/kernel information

The proc file system can be used to gather useful information about the system and the running kernel. Here are some important files:

• /PROC/CPUINFO-CPU information (model, family, cache size, etc.)
• /proc/meminfo-Information on physical memory, swap space, etc.
• /proc/mounts-List of loaded file systems
• /proc/devices-List of available devices
• /proc/filesystems-Supported file systems
• /proc/modules-Loaded Modules
• /proc/version-Kernel version
• /proc/cmdline-Kernel command line parameters entered at system startup

The files in proc are much more than the one listed above. Readers who want to know more about each of/proc's files are ' more ' or read references [1] to get more information about the files in the/proc directory. I recommend using ' more ' instead of ' cat ' unless you know that the file is small because some files (such as Kcore) can be very long.

Information about the running process

The/proc file system can be used to obtain information about a running process. There are some numbered subdirectories in the/proc. Each numbered directory corresponds to a process ID (PID). In this way, each running process/proc has a directory named after it's PID. These subdirectories contain files that can provide important details about the state of the process and the environment. Let's try to find a running process.

$ PS-AEF | grep mozillaroot 32558 32425 8  22:53 pts/1  00:01:23  /usr/bin/mozilla

The above command shows that the PID of a running Mozilla process is 32558. Correspondingly, there should be a directory named 32558 in the/proc.

$ ls-l/proc/32558total 0-r--r--r--1 root root 0 Dec 22:59 cmdline-r--r--r--1 ro  OT root 0 Dec 22:59 cpulrwxrwxrwx 1 root root 0 Dec 22:59 cwd-/proc/-r--------1 Root root 0 Dec 22:59 environlrwxrwxrwx 1 root root 0 Dec 22:59 exe-/usr/bin/mozil La*dr-x------2 root root 0 Dec 22:59 fd/-r--r--r--1 root root 0 Dec 22:59 maps-rw---    ----1 root root 0 Dec 22:59 mem-r--r--r--1 root root 0 Dec 22:59 mountslrwxrwxrwx    1 root root 0 Dec 22:59 root-//-r--r--r--1 root root 0 Dec 22:59 stat-r--r--r-- 1 root root 0 Dec 22:59 statm-r--r--r--1 root root 0 Dec 22:59 status 

The file "CmdLine" contains the command line that was called when the process was started. The environment of the "envir" process becomes two. "Status" is the status information for the process, including the user ID (UID) and group ID (GID) of the user who initiated the process, the parent process ID (PPID), and the current state of the process, such as "sleelping" and "Running". The directory for each process has several symbolic links, "cwd" is a symbolic link to the current working directory of the process, "EXE" points to the executable of the running process, "root" points to the directory (usually "/") that the process considers to be the root directory. The directory "FD" contains a link to the file descriptor used by the process. "CPU" only occurs when running the SMP kernel, which is the process time divided by CPU.

/proc/self is an interesting subdirectory that makes it easy for programs to use/proc to find information about this process. /proc/self is a symbolic link to a directory that is linked to the PID of the process that accesses/proc in/proc.

Interacting with the kernel via/proc

Most of the/proc files discussed above are read-only. In fact, the/proc file system provides a mechanism for interacting with the kernel through files that can be read and written in/proc. Writing these files can change the state of the kernel, so make careful changes to the files. The/proc/sys directory, which stores all readable and writable files, can be used to change kernel behavior.

/proc/sys/kernel -This directory contains information about the anti-generic kernel behavior. /proc/sys/kernel/{domainname, hostname} holds the domain name and hostname of the machine/network. These files can be used to modify these names.

$ hostnamemachinename.domainname.com$ cat/proc/sys/kernel/domainnamedomainname.com$ cat/proc/sys/kernel/ hostnamemachinename$ echo "New-machinename"  >/proc/sys/kernel/hostname$ Hostnamenew-machinename.domainname.com

Thus, by modifying the files in the/proc file system, we can modify the hostname. Many other configurable files exist in the/proc/sys/kernel/. It is not possible to list all of these files, and the reader can go to this directory by himself to see more details.
Another configurable directory is /proc/sys/net. The files in this directory can be used to modify the network properties of the machine/network. For example, simply modify a file that you can be addicted to in a network of hidden computers.

$ echo 1 >/proc/sys/net/ipv4/icmp_echo_ignore_all

This will be addictive in the network to hide your machine as it does not respond to Icmp_echo. The host will not respond to ping queries issued by other hosts.

$ ping Machinename.domainname.comno answer from Machinename.domainname.com

To change back to the default setting, simply

$ echo 0 >/proc/sys/net/ipv4/icmp_echo_ignore_all

There are many other/proc/sys that can be used to change kernel properties. Readers can obtain more information by reference [1], [2].

Conclusion

The/proc file system provides a file-based internal Linux interface. It can be used to determine the state of various devices and processes of the system. Configure them. Thus, understanding and applying the knowledge about this filesystem is key to understanding your Linux system.

Reference documents

• [1] documentation for the Linux proc file system is located at:/usr/src/linux/documentation/filesystems/proc.txt
  
• [2] RedHat guide:the/proc File system:http://www.redhat.com/docs/manuals/linux/rhl-7.3-manual/ref-guide/ch-proc.html

[Linux] Proc File System