Procfs

Last updated February 20, 2024

The proc filesystem (procfs) is a special filesystem in Unix-like operating systems that presents information about processes and other system information in a hierarchical file-like structure, providing a more convenient and standardized method for dynamically accessing process data held in the kernel than traditional tracing methods or direct access to kernel memory. Typically, it is mapped to a mount point named /proc at boot time. The proc file system acts as an interface to internal data structures about running processes in the kernel. In Linux, it can also be used to obtain information about the kernel and to change certain kernel parameters at runtime (sysctl).

History

UNIX 8th Edition

Tom J. Killian implemented the UNIX 8th Edition (V8) version of /proc: he presented a paper titled "Processes as Files" at USENIX in June 1984. The design of procfs aimed to replace the ptrace system call used for process tracing. Detailed documentation can be found in the proc(4) manual page.

SVR3

The original AT&T System V Release 3 (SVR3) operating system (available internally to AT&T in 1986 and generally in 1987) did not come with the /proc filesystem, but a subsequent incremental version of it did. It only contained files representing the processes rather than the now common subdirectories.

SVR4

Roger Faulkner and Ron Gomes ported V8 /proc to SVR4, and published a paper called "The Process File System and Process Model in UNIX System V" at USENIX in January 1991. This kind of procfs supported the creation of ps , but the files could only be accessed with functions read(), write(), and ioctl(). Between 1995 and 1996, Roger Faulkner created the procfs-2 interface for Solaris-2.6 that offers a structured /proc filesystem with sub-directories.

Plan 9

Plan 9 implemented a process file system, but went further than V8. V8's process file system implemented a single file per process. Plan 9 created a hierarchy of separate files to provide those functions, and made /proc a real part of the file system.

4.4BSD and derivatives

4.4BSD cloned its implementation of /proc from Plan 9.^{[ citation needed ]}As of February 2011^[update], procfs is gradually becoming phased out in FreeBSD,^[3] and it has turned to use the sysctl interface instead for process-related information. To provide binary compatibility with Linux user space programs, the FreeBSD kernel also provides linprocfs that is similar to the Linux procfs.^[4] It was removed from OpenBSD in version 5.7, which was released in May 2015, because it "always suffered from race conditions and is now unused".^[5] macOS did not implement procfs and user space programs have to use the sysctl interface for retrieving process data.^[2]

Solaris

/proc in Solaris was available from the beginning (June 1992). Solaris 2.6 in 1996 introduced procfs2 from Roger Faulkner.

Linux

Linux first added a /proc filesystem in v0.97.3, September 1992, and first began expanding it to non-process related data in v0.98.6, December 1992.

As of 2020, the Linux implementation includes a directory for each running process, including kernel processes, in directories named /proc/PID, where PID is the process number. Each directory contains information about one process, including:

/proc/PID/cmdline, the command that originally started the process.
/proc/PID/cwd, a symlink to the current working directory of the process.
/proc/PID/environ contains the names and values of the environment variables that affect the process.
/proc/PID/exe, a symlink to the original executable file, if it still exists (a process may continue running after its original executable has been deleted or replaced).
/proc/PID/fd, a directory containing a symbolic link for each open file descriptor.
/proc/PID/fdinfo, a directory containing entries which describe the position and flags for each open file descriptor.
/proc/PID/maps, a text file containing information about mapped files and blocks (like heap and stack).
/proc/PID/mem, a binary image representing the process's virtual memory, can only be accessed by a ptrace'ing process.
/proc/PID/root, a symlink to the root path as seen by the process. For most processes this will be a link to / unless the process is running in a chroot jail.
/proc/PID/status contains basic information about a process including its run state and memory usage.
/proc/PID/task, a directory containing hard links to any tasks that have been started by this (i.e.: the parent) process.

(Users may obtain the PID with a utility such as pgrep, pidof or ps:

$ ls-l/proc/$(pgrep-npython3)/fd# List all file descriptors of the most recently started `python3' processtotal 0lrwx------ 1 baldur baldur 64 2020-03-18 12:31 0 -> /dev/pts/3lrwx------ 1 baldur baldur 64 2020-03-18 12:31 1 -> /dev/pts/3lrwx------ 1 baldur baldur 64 2020-03-18 12:31 2 -> /dev/pts/3$ readlink/proc/$(pgrep-npython3)/exe# List executable used to launch the most recently started `python3' process  /usr/bin/python3.8

)

/proc also includes non-process-related system information, although in the 2.6 kernel much of that information moved to a separate pseudo-file system, sysfs, mounted under /sys:

depending on the mode of power management (if at all), either directory, /proc/acpi or /proc/apm, which predate sysfs and contain various bits of information about the state of power management.
/proc/buddyinfo, information about the buddy algorithm that handles memory fragmentation.^[6]
/proc/bus, containing directories representing various buses on the computer, such as PCI/USB. This has been largely superseded by sysfs under /sys/bus which is far more informative.
/proc/fb, a list of the available framebuffers
/proc/cmdline, giving the boot options passed to the kernel
/proc/cpuinfo, containing information about the CPU, such as its vendor (and CPU family, model and model names which should allow users to identify the CPU) and its speed (CPU clockspeed), cache size, number of siblings, cores, and CPU flags. The format and available information is highly architecture-depended. On some architectures, /proc/cpuinfo includes a value for "bogomips", frequently misconstrued as a measure of CPU speed, like a benchmark, but it does not actually measure any sensible (for end-users) value at all. It occurs as a side-effect of kernel timer calibration and yields highly varying values depending on CPU type, even at equal clock speeds.

$ cat/proc/cpuinfo processor   : 0 vendor_id  : AuthenticAMD cpu family : 16 model      : 6 model name : AMD Athlon(tm) II X2 270 Processor stepping   : 3 microcode  : 0x10000c8 cpu MHz    : 2000.000 cache size : 1024 KB ... processor  : 1 vendor_id  : AuthenticAMD cpu family : 16 model      : 6 model name : AMD Athlon(tm) II X2 270 Processor stepping   : 3 microcode  : 0x10000c8 cpu MHz    : 800.000 cache size : 1024 KB ...

On multi-core CPUs, /proc/cpuinfo contains the fields for "siblings" and "cpu cores" which represent the following calculation is applied:^[7]

"siblings" = (HT per CPU package) * (# of cores per CPU package) "cpu cores" = (# of cores per CPU package)

A CPU package means physical CPU which can have multiple cores (single core for one, dual core for two, quad core for four). This allows a distinction between hyper-threading and dual-core, i.e. the number of hyper-threads per CPU package can be calculated by siblings / CPU cores. If both values for a CPU package are the same, then hyper-threading is not supported.^[8] For instance, a CPU package with siblings=2 and "cpu cores"=2 is a dual-core CPU but does not support hyper-threading.

/proc/crypto, a list of available cryptographic modules
/proc/devices, a list of character and block devices sorted by device ID but giving the major part of the /dev name too
/proc/diskstats, giving some information (including device numbers) for each of the logical disk devices
/proc/filesystems, a list of the file systems supported by the kernel at the time of listing
/proc/interrupts, /proc/iomem, /proc/ioports and the directory /proc/irq, giving some details about the devices (physical or logical) using the various system resources
/proc/kmsg, holding messages output by the kernel^[9]
/proc/loadavg, containing stats about the current load average in the last minutes.
/proc/meminfo, containing a summary of how the kernel is managing its memory.
/proc/modules, one of the most important files in /proc, containing a list of the kernel modules currently loaded . It gives some indication (not always entirely correct) of dependencies.
/proc/mounts, a symlink to self/mounts which contains a list of the currently mounted devices and their mount points (and which file system is in use and what mount options are in use).
/proc/net/, a directory containing useful information about the network stack, in particular /proc/net/nf_conntrack, which lists existing network connections (particularly useful for tracking routing when iptables FORWARD is used to redirect network connections)
/proc/partitions, a list of the device-numbers, their size and /dev names which the kernel has identified as existing partitions
/proc/scsi, giving information about any devices connected via a SCSI or RAID controller
a symbolic link to the current (traversing) process at /proc/self (i.e. /proc/PID/ where PID is that of the current process).
/proc/slabinfo, listing statistics on the caches for frequently-used objects in the Linux kernel
/proc/swaps, a list of the active swap partitions, their various sizes and priorities
Access to dynamically configurable kernel options under /proc/sys. Under /proc/sys appear directories representing the areas of kernel, containing readable and writable virtual files.
For example, a commonly referenced virtual file is /proc/sys/net/ipv4/ip_forward, because it is necessary for routing firewalls or tunnels. The file contains either a '1' or a '0': if it is 1, the IPv4 stack forwards packets not meant for the local host, if it is 0 then it does not.
/proc/sysvipc, containing memory-sharing and inter-process communication (IPC) information.
/proc/tty, containing information about the current terminals; /proc/tty/driver looks to be^{[ original research? ]} a list of the different types of tty available - each of which is a list of those of each type
/proc/uptime, the length of time the kernel has been running since boot and spent in idle mode (both in seconds)
/proc/version, containing the Linux kernel version, distribution number, gcc version number (used to build the kernel) and any other pertinent information relating to the version of the kernel currently running
other files depending on various hardware, module configurations, and changes to the kernel.

The basic utilities that use /proc under Linux come in the procps (/proc processes) package, and only function in conjunction with a mounted /proc.

CYGWIN

Cygwin implemented a procfs that is basically the same as the Linux procfs.

Related Research Articles

<span class="mw-page-title-main">Load (computing)</span> Amount of computational work that a computer system performs

In UNIX computing, the system load is a measure of the amount of computational work that a computer system performs. The load average represents the average system load over a period of time. It conventionally appears in the form of three numbers which represent the system load during the last one-, five-, and fifteen-minute periods.

The Filesystem Hierarchy Standard (FHS) is a reference describing the conventions used for the layout of Unix-like systems. It has been made popular by its use in Linux distributions, but it is used by other Unix-like systems as well. It is maintained by the Linux Foundation. The latest version is 3.0, released on 3 June 2015.

In computing, a loadable kernel module (LKM) is an object file that contains code to extend the running kernel, or so-called base kernel, of an operating system. LKMs are typically used to add support for new hardware and/or filesystems, or for adding system calls. When the functionality provided by an LKM is no longer required, it can be unloaded in order to free memory and other resources.

tmpfs is a temporary file storage paradigm implemented in many Unix-like operating systems. It is intended to appear as a mounted file system, but data is stored in volatile memory instead of a persistent storage device. A similar construction is a RAM disk, which appears as a virtual disk drive and hosts a disk file system.

The inode is a data structure in a Unix-style file system that describes a file-system object such as a file or a directory. Each inode stores the attributes and disk block locations of the object's data. File-system object attributes may include metadata, as well as owner and permission data.

chroot is an operation on Unix and Unix-like operating systems that changes the apparent root directory for the current running process and its children. A program that is run in such a modified environment cannot name files outside the designated directory tree. The term "chroot" may refer to the chroot(2) system call or the chroot(8) wrapper program. The modified environment is called a chroot jail.

sysfs is a pseudo file system provided by the Linux kernel that exports information about various kernel subsystems, hardware devices, and associated device drivers from the kernel's device model to user space through virtual files. In addition to providing information about various devices and kernel subsystems, exported virtual files are also used for their configuration.

inotify is a Linux kernel subsystem created by John McCutchan, which monitors changes to the filesystem, and reports those changes to applications. It can be used to automatically update directory views, reload configuration files, log changes, backup, synchronize, and upload. The inotifywait and inotifywatch commands allow using the inotify subsystem from the command line. One major use is in desktop search utilities like Beagle, where its functionality permits reindexing of changed files without scanning the filesystem for changes every few minutes, which would be very inefficient.

mount (Unix) Unix command to mount a filesystem

In computing, mount is a command in various operating systems. Before a user can access a file on a Unix-like machine, the file system on the device which contains the file needs to be mounted with the mount command. Frequently mount is used for SD card, USB storage, DVD and other removable storage devices. The command is also available in the EFI shell.

The following tables compare general and technical information for a number of file systems.

debugfs is a special file system available in the Linux kernel since version 2.6.10-rc3. It was written by Greg Kroah-Hartman.

The Linux booting process involves multiple stages and is in many ways similar to the BSD and other Unix-style boot processes, from which it derives. Although the Linux booting process depend very much on the computer architecture, those architectures share similar stages and software components, including system startup, bootloader execution, loading and startup of a Linux kernel image, and execution of various startup scripts and daemons. Those are grouped into 4 steps: system startup, bootloader stage, kernel stage, and init process. When a Linux system is powered up or reset, its processor will execute a specific firmware/program for system initialization, such as Power-on self-test, invoking the reset vector to start a program at a known address in flash/ROM, then load the bootloader into RAM for later execution. In personal computer (PC), not only limited to Linux-distro PC, this firmware/program is called BIOS, which is stored in the mainboard. In embedded Linux system, this firmware/program is called boot ROM. After being loaded into RAM, bootloader will execute to load the second-stage bootloader. The second-stage bootloader will load the kernel image into memory, decompress and initialize it then pass control to this kernel image. Second-stage bootloader also performs several operation on the system such as system hardware check, mounting the root device, loading the necessary kernel modules,... Finally, the very first user-space process starts, and other high-level system initializations are performed.

In computer science, a synthetic file system or a pseudo file system is a hierarchical interface to non-file objects that appear as if they were regular files in the tree of a disk-based or long-term-storage file system. These non-file objects may be accessed with the same system calls or utility programs as regular files and directories. The common term for both regular files and the non-file objects is node.

In Unix-like operating systems, a device file or special file is an interface to a device driver that appears in a file system as if it were an ordinary file. There are also special files in DOS, OS/2, and Windows. These special files allow an application program to interact with a device by using its device driver via standard input/output system calls. Using standard system calls simplifies many programming tasks, and leads to consistent user-space I/O mechanisms regardless of device features and functions.

Toybox is a free and open-source software implementation of over 200 Unix command line utilities such as ls, cp, and mv. The Toybox project was started in 2006, and became a 0BSD licensed BusyBox alternative. Toybox is used for most of Android's command-line tools in all currently supported Android versions, and is also used to build Android on Linux and macOS. All of the tools are tested on Linux, and many of them also work on BSD and macOS.

System Activity Report (sar) is a Unix System V-derived system monitor command used to report on various system loads, including CPU activity, memory/paging, interrupts, device load, network and swap space utilization. Sar uses /proc filesystem for gathering information.

In Unix and operating systems inspired by it, the file system is considered a central component of the operating system. It was also one of the first parts of the system to be designed and implemented by Ken Thompson in the first experimental version of Unix, dated 1969.

Namespaces are a feature of the Linux kernel that partition kernel resources such that one set of processes sees one set of resources, while another set of processes sees a different set of resources. The feature works by having the same namespace for a set of resources and processes, but those namespaces refer to distinct resources. Resources may exist in multiple spaces. Examples of such resources are process IDs, host-names, user IDs, file names, some names associated with network access, and Inter-process communication.

In the Linux kernel, kernfs is a set of functions that contain the functionality required for creating the pseudo file systems used internally by various kernel subsystems so that they may use virtual files. For example, sysfs provides a set of virtual files by exporting information about hardware devices and associated device drivers from the kernel's device model to user space.

References

1 2 Nemeth, Evi; Snyder, Garth; Hein, Trent R.; Whaley, Ben (14 July 2010). UNIX and Linux System Administration Handbook. Pearson Education. p. 136. ISBN 978-0-13-211736-4.
1 2 Amit Singh (2003). "/proc on Mac OS X". Mac OS X Internals: The Book. Archived from the original on 4 May 2012. Retrieved 10 July 2021.
↑ "Why is procfs deprecated in favor of procstat?". freebsd.org. 22 February 2011.
↑ "linprocfs(5)". FreeBSD Manual Pages. The FreeBSD Project. 13 November 2019. Retrieved 12 June 2021.
↑ "Detailed changes between OpenBSD 5.6 and 5.7". openbsd.org.
↑ "3.2.2. /proc/buddyinfo". centos.org. Archived from the original on 2 September 2013. Retrieved 23 May 2011.
↑ Baron, Jason. "HT vs. dual-core". Archived from the original on 13 May 2016. Retrieved 28 June 2011.
↑ "Understanding Linux /proc/cpuinfo". richweb.com. Archived from the original on 3 April 2012. Retrieved 21 April 2015.
↑ Nguyen, Binh (30 July 2004). "Linux Filesystem Hierarchy". Binh Nguyen. p. 63. Retrieved 18 July 2016. /proc/kmsg[:] Messages output by the kernel. These are also routed to syslog.

Sources

Unix 8th Edition proc(2) manual page - Description of the original procfs.
Plan 9 procfs manual page - Plan 9 greatly expanded the procfs concept, providing a much expanded interface to control and manipulate processes.
Linux Manual Pages Proc(5) Linux manual documentation for procfs
Documentation/filesystems/proc.txt Linux kernel documentation for procfs

External links

A brief history of /proc Eric Schrock's Weblog
Access the Linux kernel using the Procfs An IBM developerWorks article by M. Tim Jones
Linux-Filesystem-Hierarchy Linux Documentation Project
Discover the possibilities of the /proc directory by Federico Kereki

This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.

[:0-1] 1 2 Nemeth, Evi; Snyder, Garth; Hein, Trent R.; Whaley, Ben (14 July 2010). UNIX and Linux System Administration Handbook. Pearson Education. p. 136. ISBN 978-0-13-211736-4.

[:1-2] 1 2 Amit Singh (2003). "/proc on Mac OS X". Mac OS X Internals: The Book. Archived from the original on 4 May 2012. Retrieved 10 July 2021.

[3] "Why is procfs deprecated in favor of procstat?". freebsd.org. 22 February 2011.

[4] "linprocfs(5)". FreeBSD Manual Pages. The FreeBSD Project. 13 November 2019. Retrieved 12 June 2021.

[5] "Detailed changes between OpenBSD 5.6 and 5.7". openbsd.org.

[6] "3.2.2. /proc/buddyinfo". centos.org. Archived from the original on 2 September 2013. Retrieved 23 May 2011.

[7] Baron, Jason. "HT vs. dual-core". Archived from the original on 13 May 2016. Retrieved 28 June 2011.

[8] "Understanding Linux /proc/cpuinfo". richweb.com. Archived from the original on 3 April 2012. Retrieved 21 April 2015.

[9] Nguyen, Binh (30 July 2004). "Linux Filesystem Hierarchy". Binh Nguyen. p. 63. Retrieved 18 July 2016. /proc/kmsg[:] Messages output by the kernel. These are also routed to syslog.

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]