The /proc Filesystem — In Depth

/proc is a virtual filesystem. Nothing in it exists on disk. It is generated on the fly by the kernel and gives you a live window into exactly what the kernel knows about the system — hardware, processes, memory, network state, and its own configuration.

Every file you read from /proc is the kernel answering a question in real time.

System information

CPU

cat /proc/cpuinfo

One block per logical CPU. Key fields:

• processor — logical CPU index (0-based)
• model name — CPU model string
• cpu MHz — current clock speed
• cache size — L2 cache
• siblings — logical CPUs sharing the physical package
• cpu cores — physical cores per package
• flags — CPU feature flags (sse4_2, avx2, vmx for virtualisation, etc.)

Count logical CPUs:

grep -c "^processor" /proc/cpuinfo

Check for virtualisation support:

grep -E "vmx|svm" /proc/cpuinfo

vmx is Intel VT-x. svm is AMD-V. Required for running KVM virtual machines.

Memory

cat /proc/meminfo

Key fields:

MemAvailable is the important one for "how much memory is free" — it accounts for reclaimable cache. MemFree alone is misleading because Linux aggressively uses free RAM for caching.

Kernel version and boot parameters

cat /proc/version

Linux version 6.1.0-18-amd64 (debian-kernel@lists.debian.org) (gcc-12 (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40) #1 SMP PREEMPT_DYNAMIC Debian 6.1.76-1 (2024-02-01)

Boot parameters passed to the kernel:

cat /proc/cmdline

BOOT_IMAGE=/boot/vmlinuz-6.1.0-18-amd64 root=UUID=abc123 ro quiet splash

Uptime

cat /proc/uptime

86423.45 337821.23

First number is seconds since boot. Second is cumulative idle time across all CPUs. To make it readable:

uptime

Loaded filesystems

cat /proc/filesystems

Shows all filesystem types the kernel currently supports — both built-in and loaded via modules.

Per-process information

Every running process has a directory in /proc named by its PID. We touched on this in the process management post — here is more detail.

ls /proc/1/

Key files:

Reading a process's command line cleanly:

tr '\0' ' ' < /proc/1/cmdline
echo

Open files for a process:

ls -la /proc/1234/fd/

Each entry is a symlink to the actual file. File descriptor 0 is stdin, 1 is stdout, 2 is stderr.

Memory usage breakdown:

cat /proc/1234/smaps | grep -E "^(Size|Rss|Pss):" | awk '{sum[$1]+=$2} END {for (k in sum) print k, sum[k], "kB"}'

/proc/net

Network state from the kernel's perspective:

cat /proc/net/dev          # interface statistics
cat /proc/net/tcp          # TCP connections (hex format)
cat /proc/net/tcp6         # IPv6 TCP connections
cat /proc/net/udp          # UDP sockets
cat /proc/net/route        # routing table (hex)
cat /proc/net/arp          # ARP table
cat /proc/net/if_inet6     # IPv6 addresses

/proc/net/tcp is raw but contains everything ss and netstat read. The local and remote addresses are in little-endian hex:

# Decode a hex address like 0F02000A:0050
printf "%d.%d.%d.%d\n" 0x0A 0x00 0x02 0x0F   # IP
printf "%d\n" 0x0050                            # port 80

/proc/sys

/proc/sys is where runtime kernel parameters live. Reading a file shows the current value. Writing to it changes the behaviour of the running kernel immediately.

cat /proc/sys/kernel/hostname
cat /proc/sys/vm/swappiness
cat /proc/sys/net/ipv4/ip_forward

Change IP forwarding (required for routing/NAT):

echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward

Change swappiness (how aggressively the kernel swaps):

echo 10 | sudo tee /proc/sys/vm/swappiness

These changes are immediate but not persistent. To make them permanent, use sysctl — covered in the next post.

/proc/interrupts

Shows hardware interrupt counts per CPU:

cat /proc/interrupts

Useful for diagnosing interrupt affinity issues on multi-core systems, or seeing which devices are generating excessive interrupts.

/proc/iomem and /proc/ioports

Physical memory and I/O port ranges claimed by hardware:

cat /proc/iomem
cat /proc/ioports

Useful for low-level hardware debugging.

/proc/buddyinfo and /proc/slabinfo

Kernel memory allocator state:

cat /proc/buddyinfo    # buddy allocator free pages by order
cat /proc/slabinfo     # slab allocator cache statistics

slabinfo shows the kernel's internal object caches — dentries (directory entries), inodes, socket buffers, and more. Memory fragmentation and slab pressure show up here before they show up in application behaviour.

/proc is the kernel talking directly to you. Everything the kernel knows about the system is exposed here as readable files. Tools like ps, top, ss, netstat, and free are just convenient wrappers around what you can read directly from /proc yourself.

Next up: the /sys filesystem — hardware topology, driver bindings, and udev rules.