/proc Filesystem

Linux commonly mounts procfs at /proc. This virtual filesystem presents kernel-generated interfaces as files and directories; its contents are not ordinary persistent files stored on disk. It exposes process state as well as selected system-wide kernel information.

Finding Process Directories

List the mount and top-level entries with:

$ findmnt /proc
$ ls /proc

Numeric directory names correspond to process IDs visible in the caller's PID namespace. For example, /proc/12345 represents PID 12345 at the instant it exists. /proc/self is a symbolic link that resolves to the observing process's own directory, and /proc/thread-self identifies the current thread.

Visibility and access depend on credentials, namespaces, security policy, and procfs mount options such as hidepid. A process can exit between listing a directory and opening one of its files, so disappearance is a normal race that inspection tools must handle.

CheckWhat does numeric directory /proc/12345 normally represent?

The disk block numbered 12345. The process currently visible with PID 12345. The user account whose UID is 12345.

Reading Process Information

Inspect a process status file when permissions allow:

$ less /proc/12345/status

It includes fields such as process name, state, IDs, credentials, memory counters, capabilities, and signal masks. Other useful entries include:

• /proc/12345/cmdline: command-line arguments separated by null bytes
• /proc/12345/environ: environment entries, access-controlled and potentially sensitive
• /proc/12345/fd/: symbolic links representing open file descriptors
• /proc/12345/maps: current memory mappings
• /proc/12345/cwd: symbolic link to the current working directory

Treat these as changing observations. Fields can differ by kernel version, a process can change state during a multi-file read, and some counters have subtleties not captured by their names alone.

CheckWhich path contains a readable field-oriented summary for PID 12345?

/proc/status/12345 /proc/12345/status /proc/cpuinfo/12345

Reading System-Wide Interfaces

Not every /proc entry belongs to a process. Examples include:

• /proc/cpuinfo for kernel-reported CPU information
• /proc/meminfo for system memory counters
• /proc/mounts for the current process's view of mounts
• /proc/loadavg for load-average and runnable-task information
• /proc/sys/ for runtime kernel parameters

Some files, especially under /proc/sys, are writable configuration interfaces. Do not write to them merely because they look like regular files. Understand the parameter, scope, persistence mechanism, and rollback before making an authorized system change.

CheckWhich entry provides system-wide memory counters rather than one process's status?

/proc/self/status /proc/meminfo /proc/1/fd

Using /proc through Tools

Linux implementations of tools such as ps, top, and free obtain much of their data from procfs and other kernel interfaces, then label, calculate, and format it. Prefer those tools for routine work when they provide the needed field; read /proc directly for specific details or scripting only after studying the interface documentation.

Direct readers must parse formats correctly, tolerate missing processes, protect sensitive output, and avoid assuming one read is an atomic system snapshot.

CheckWhy can /proc/PID disappear between two inspection commands?

Every procfs file is automatically renamed once per second. Reading status deletes the process directory. The process can exit while it is being observed.

Summary

You can now use procfs as a live, access-controlled kernel interface.

1. Associate numeric /proc directories with visible PIDs.
2. Read selected per-process files while accounting for races and sensitivity.
3. Distinguish process directories from system-wide interfaces.
4. Prefer documented tools and formats for reliable routine inspection.