Handle With Linux

LPI tutorial exam 101 part 2 exploring proc

In my previous article I already touched on the subject of the virtual file-system mounted on /proc
As this is an important topic on the LPI exam (and it's also a very interesting subject), we are going to explore the /proc file-system today.

Overview of /proc

The proc file-system, as mentioned before, is a pseudo file-system. It's used as an interface to the kernel. Most of it's contents are read-only files which provide real time information about the running kernel. It's a great show of the build-in relative simplicity of the Linux OS. As you probably know already everything in Linux is a file, so is this interface to the kernel, just a bunch of files.

One of the interesting parts of this story is the fact that MOST of it's files are read only, the first time I encountered the implications of this I was truly amazed. Fact is, you can actually control some behaviors of the kernel by writing to files in the /proc directory.

Remember you can use the cat command to show the contents of these files:

$ cat /proc/10314/cmdline

/usr/sbin/rsyslogd-c3

Numerical directories

There's a numerical subdirectory for every running process, guess what these numbers are?
Right! Every process id has it's own numerical directory in proc containing pseudo files and directories with process information. There's a lot of information contained in these directories and many of the system tools in Linux don't do much more than creating a nice overview of information found in /proc

While you don't need to know all the specifics of the files in the numerical directories, there are certainly a few here worth mentioning:

cmdline

shows the full commandline of the process

cwd

symlink to the current working directory of the process (try ls-l)

environ

contains the process environment

exe

from Linux 2.2 up this is a symbolic link to the program executable, you can actually use this link to start another copy of the program running on this process id.

fd

fd is a directory containing symlinks to every file this process has open. Try ls -l command on this directory. Can be very useful if you need to find out which process has a specific file open.

limits

Since kernel 2.6.24 this file shows process resource limits

mountinfo

contains information about mount points

mountstats

Since kernel 2.6.17 this file shows statistics about mount points in the process namespace

oom_adj

(since kernel 2.6.11)

This is an example of a writable file in proc, this file can be updated to control which process is more likely to be killed by the kernel in an out of memory situation. (told you the writable part is interesting)

Values from -17 to +15 are valid. Setting the value to -17 disables the killing of this process and positive values give the process a higher change of being killed in an out of memory situation.

oom_score

(since kernel 2.6.11)

current score for this file for the OOM-processkiller, bigger number more change of being killed

root

contains a symbolic link to this process's root directory. When you chroot a process this points to the directory the process “sees” as it's root.

Smaps

(since kernel 2.6.14)

This file is only present if the CONFIG_MMU kernel configuration option is enabled.
smaps shows a lot of information about memory mappings in use by the process.
Resident memory for instance:

b7fa3000-b7fef000 r-xp 00000000 16:01 2409822 /usr/bin/ssh
Size: 304 kB
Rss: 272 kB <<< resident set size is resident in memory
Pss: 136 kB
Shared_Clean: 272 kB
Shared_Dirty: 0 kB
Private_Clean: 0 kB
Private_Dirty: 0 kB
Referenced: 272 kB
Swap: 0 kB
KernelPageSize: 4 kB
MMUPageSize: 4 kB

stat

This is used by ps, not very useful to show with cat. Useful if you are a programmer though.

statm

Memory usage in pages

status

much of the information provided by stat and statm but in human readable form this time.

On the exam

I don't think you'll have to fear to much of the aforementioned files in the numerical directories, most of them are primarily usable by programmers. But it may be useful to at least have some basic understanding what it's all about. It's also nice to know how to find certain information in the proc diretory structure.

The following files which are not in the numerical directories are more important, as I know pretty sure you'll encounter questions about their contents or purpose on the exam.
Especially the files showing specific information about your hardware are a popular subject on the exam.

/proc/apm

Advanced power management version and battery information when CONFIG_APM is defined at kernel compilation time.

/proc/bus

has subdirectories for installed busses

/proc/bus/pccard

PCMCIA devices

/proc/bus/pci

Yet another subdirectory containing files and directories :
PCI busses installed devices and device drivers

/proc/bus/pci/devices

pci device information

/proc/cmdline

arguments passed to the kernel at boot time

/proc/config.gz

(since kernel 2.6)

configuration options used to build the kernel. It's a compressed file. (gzip)

/proc/cpuinfo

processor information

/proc/devices

list of devices in use, shows for instance your tty (console device) character device
and your disks

/proc/diskstats

(since kernel 2.5.69)

Shows Input/Output statistics for your disk devices

/proc/dma

lists DMA channels in use

/proc/filesystems

lists filesystems the kernel has support for

/proc/ide

Only here on systems with an IDE bus, directories for each IDE channel and attached devices.

/proc/interrupts

shows the numbers of kernel interrupts per cpu per device

proc/ioports

shows ioports in use

/proc/iomem

I/O memory map in Linux 2.4

/proc/kallsyms

kernel exported symbol definitions, before kernel 2.5.72 it's called ksyms

/proc/kcore

file representing physical system memory, total length is the size of physical memory plus 4kb

/proc/kmsg

kernel messages, use dmesg command to show kernel messages in this file.

/proc/loadavg

shows average system load like uptime and top do and the number of currently executing kernel scheduling entities (processes, threads) / number of kernel scheduling entities that currently exist on the system. The last number is the process id of the process that was most recently created on the system.

/proc/meminfo

memory usage statistics

/proc/modules

loaded modules

/proc/mounts

before kernel 2.4.19 it's a list of mounted filesystems, after that it's a link to /proc/self/mounts

/proc/net

various network pseudo files, use netstat command to show the same information.

/proc/scsi

scsi files and driver directories

/proc/scsi/scsi

Another writable file allows configuration of hotplug scsi

/proc/scsi/[drivername]

readable for configuration information, writable for scsi configuration (driver dependent)

/proc/self

refers to the the process accessing the /proc filesystem

/proc/stat

kernel/system statistics

/proc/swaps

swap areas in use

/proc/sys

files and subdirectories for kernel variables.

More about this directory in a following article..

/proc/uptime

show uptime and idle time

/proc/version

kernel version

/proc/vmstat

(kernel 2.6)

virtual memory statistics

This is it for now I'll get back on /proc/sys later because there's a lot more to say about that.
Feel free to comment/add

Practice exam questions on this site!

I've put up a quiz on the site which has 25 random chosen questions to test your level of knowledge. They are chosen random from a pool of questions. The difficulty level and material covered is that of the LPIC 101 exam. If there's demand I'll put up more questions and other exam levels.

Register for free and try your skill level:
(don't worry if you don't have enough time to finish, the test will resume where you left of when you come back.)
LPIC level 1 exam practice

(Also nice to do if you just like to know if you could make it)

UPDATE: improved registration captcha, excuse for those of you who couldn't pass it.

added the Level 1 second exam (lpic 102):
LPIC level 2 exam practice

UPDATE: 15 random practice questions about proc available: (more in the future)

proc practice test (hard)