Procfs Explained

The proc filesystem (procfs) is a special filesystem in Unix-like operating systems that presents information about processes and other system information in a hierarchical file-like structure, providing a more convenient and standardized method for dynamically accessing process data held in the kernel than traditional tracing methods or direct access to kernel memory. Typically, it is mapped to a mount point named /proc at boot time. The proc file system acts as an interface to internal data structures about running processes in the kernel. In Linux, it can also be used to obtain information about the kernel and to change certain kernel parameters at runtime (sysctl).

Many Unix-like operating systems support the proc filesystem, including System V, Solaris, IRIX, Tru64 UNIX, BSD, Linux, IBM AIX,^[1] QNX, and Plan 9 from Bell Labs. OpenBSD dropped support in version 5.7, released in May 2015. It is absent from HP-UX and macOS.

The Linux kernel extends it to non–process-related data.

The proc filesystem provides a method of communication between kernel space and user space. For example, the GNU version of the process reporting utility ps uses the proc file system to obtain its data, without using any specialized system calls.

History

UNIX 8th Edition

Tom J. Killian implemented the UNIX 8th Edition (V8) version of /proc: he presented a paper titled "Processes as Files" at USENIX in June 1984. The design of procfs aimed to replace the ptrace system call used for process tracing. Detailed documentation can be found in the proc(4) manual page.

SVR3

The original AT&T System V Release 3 (SVR3) operating system (available internally to AT&T in 1986 and generally in 1987) did not come with the /proc filesystem, but a subsequent incremental version of it did. It only contained files representing the processes rather than the now common subdirectories.

SVR4

Roger Faulkner and Ron Gomes ported V8 /proc to SVR4, and published a paper called "The Process File System and Process Model in UNIX System V" at USENIX in January 1991. This kind of procfs supported the creation of ps, but the files could only be accessed with functions read, write, and ioctl. Between 1995 and 1996, Roger Faulkner created the procfs-2 interface for Solaris-2.6 that offers a structured /proc filesystem with sub-directories.

Plan 9

Plan 9 implemented a process file system, but went further than V8. V8's process file system implemented a single file per process. Plan 9 created a hierarchy of separate files to provide those functions, and made /proc a real part of the file system.

4.4BSD and derivatives

4.4BSD cloned its implementation of from Plan 9., procfs is gradually becoming phased out in FreeBSD,^[2] and it has turned to use the sysctl interface instead for process-related information.To provide binary compatibility with Linux user space programs, the FreeBSD kernel also provides linprocfs that is similar to the Linux procfs.^[3] It was removed from OpenBSD in version 5.7, which was released in May 2015, because it "always suffered from race conditions and is now unused".^[4] macOS did not implement procfs and user space programs have to use the sysctl interface for retrieving process data.^[5]

Solaris

/proc in Solaris was available from the beginning (June 1992). Solaris 2.6 in 1996 introduced procfs2 from Roger Faulkner.

Linux

Linux first added a /proc filesystem in v0.97.3, September 1992, and first began expanding it to non-process related data in v0.98.6, December 1992.

As of 2020, the Linux implementation includes a directory for each running process, including kernel processes, in directories named, where is the process number. Each directory contains information about one process, including:

• , the command that originally started the process.
• , a symlink to the current working directory of the process.
• contains the names and values of the environment variables that affect the process.
• , a symlink to the original executable file, if it still exists (a process may continue running after its original executable has been deleted or replaced).
• , a directory containing a symbolic link for each open file descriptor.
• , a directory containing entries which describe the position and flags for each open file descriptor.
• , a text file containing information about mapped files and blocks (like heap and stack).
• , a binary image representing the process's virtual memory, can only be accessed by a ptrace'ing process.
• , a symlink to the root path as seen by the process. For most processes this will be a link to / unless the process is running in a chroot jail.
• contains basic information about a process including its run state and memory usage.
• , a directory containing hard links to any tasks that have been started by this (i.e.: the parent) process.

(Users may obtain the PID with a utility such as pgrep, pidof or ps:$ ls -l /proc/$(pgrep -n python3)/fd # List all file descriptors of the most recently started `python3' processtotal 0lrwx------ 1 baldur baldur 64 2020-03-18 12:31 0 -> /dev/pts/3lrwx------ 1 baldur baldur 64 2020-03-18 12:31 1 -> /dev/pts/3lrwx------ 1 baldur baldur 64 2020-03-18 12:31 2 -> /dev/pts/3$ readlink /proc/$(pgrep -n python3)/exe # List executable used to launch the most recently started `python3' process /usr/bin/python3.8)

also includes non-process-related system information, although in the 2.6 kernel much of that information moved to a separate pseudo-file system, sysfs, mounted under :

• depending on the mode of power management (if at all), either directory, or, which predate sysfs and contain various bits of information about the state of power management.
• , information about the buddy algorithm that handles memory fragmentation.^[6]
• , containing directories representing various buses on the computer, such as PCI/USB. This has been largely superseded by sysfs under /sys/bus which is far more informative.
• , a list of the available framebuffers
• , giving the boot options passed to the kernel
• , containing information about the CPU, such as its vendor (and CPU family, model and model names which should allow users to identify the CPU) and its speed (CPU clockspeed), cache size, number of siblings, cores, and CPU flags. The format and available information is highly architecture-depended. On some architectures, includes a value for "bogomips", frequently misconstrued as a measure of CPU speed, like a benchmark, but it does not actually measure any sensible (for end-users) value at all. It occurs as a side-effect of kernel timer calibration and yields highly varying values depending on CPU type, even at equal clock speeds.

On multi-core CPUs, /proc/cpuinfo contains the fields for "siblings" and "cpu cores" which represent the following calculation is applied:^[7]

"siblings" = (HT per CPU package) * (# of cores per CPU package)
"cpu cores" = (# of cores per CPU package)

A CPU package means physical CPU which can have multiple cores (single core for one, dual core for two, quad core for four).This allows a distinction between hyper-threading and dual-core, i.e. the number of hyper-threads per CPU package can be calculated by siblings / CPU cores. If both values for a CPU package are the same, then hyper-threading is not supported.^[8] For instance, a CPU package with siblings=2 and "cpu cores"=2 is a dual-core CPU but does not support hyper-threading.

• , a list of available cryptographic modules
• , a list of character and block devices sorted by device ID but giving the major part of the name too
• , giving some information (including device numbers) for each of the logical disk devices
• , a list of the file systems supported by the kernel at the time of listing
• ,, and the directory, giving some details about the devices (physical or logical) using the various system resources
• , holding messages output by the kernel^[9]
• , containing stats about the current load average in the last minutes.
• , containing a summary of how the kernel is managing its memory.
• , one of the most important files in, containing a list of the kernel modules currently loaded . It gives some indication (not always entirely correct) of dependencies.
• , a symlink to self/mounts which contains a list of the currently mounted devices and their mount points (and which file system is in use and what mount options are in use).
• , a directory containing useful information about the network stack, in particular, which lists existing network connections (particularly useful for tracking routing when iptables FORWARD is used to redirect network connections)
• , a list of the device-numbers, their size and names which the kernel has identified as existing partitions
• , giving information about any devices connected via a SCSI or RAID controller
• a symbolic link to the current (traversing) process at (i.e. where PID is that of the current process).
• , listing statistics on the caches for frequently-used objects in the Linux kernel
• , a list of the active swap partitions, their various sizes and priorities
• Access to dynamically configurable kernel options under . Under appear directories representing the areas of kernel, containing readable and writable virtual files.
  For example, a commonly referenced virtual file is, because it is necessary for routing firewalls or tunnels. The file contains either a '1' or a '0': if it is 1, the IPv4 stack forwards packets not meant for the local host, if it is 0 then it does not.
• , containing memory-sharing and inter-process communication (IPC) information.
• , containing information about terminals; contains a list of TTY drivers and their usage^[10]
• , the length of time the kernel has been running since boot and spent in idle mode (both in seconds)
• , containing the Linux kernel version, distribution number, gcc version number (used to build the kernel) and any other pertinent information relating to the version of the kernel currently running
• other files depending on various hardware, module configurations, and changes to the kernel.

The basic utilities that use /proc under Linux come in the procps (processes) package, and only function in conjunction with a mounted .

CYGWIN

Cygwin implemented a procfs that is basically the same as the Linux procfs.

Sources

• Unix 8th Edition proc(2) manual page - Description of the original procfs.
• Plan 9 procfs manual page - Plan 9 greatly expanded the procfs concept, providing a much expanded interface to control and manipulate processes.
• Linux Manual Pages Proc(5) Linux manual documentation for procfs
• Documentation/filesystems/proc.txt Linux kernel documentation for procfs

External links

• A brief history of /proc Eric Schrock's Weblog
• Access the Linux kernel using the Procfs An IBM developerWorks article by M. Tim Jones
• Linux-Filesystem-Hierarchy Linux Documentation Project
• Discover the possibilities of the /proc directory by Federico Kereki

Notes and References

1. Book: Nemeth . Evi . UNIX and Linux System Administration Handbook . Snyder . Garth . Hein . Trent R. . Whaley . Ben . 2010-07-14 . Pearson Education . 978-0-13-211736-4 . 136 . en.
2. Web site: Why is procfs deprecated in favor of procstat?. freebsd.org. 22 February 2011 .
3. Web site: linprocfs(5) . FreeBSD Manual Pages . The FreeBSD Project . 2021-06-12 . en . 2019-11-13.
4. Web site: Detailed changes between OpenBSD 5.6 and 5.7. openbsd.org.
5. Web site: Amit Singh . /proc on Mac OS X . Mac OS X Internals: The Book . 2021-07-10 . https://web.archive.org/web/20120504052329/http://osxbook.com/book/bonus/ancient/procfs/ . 2012-05-04 . 2003.
6. Web site: 3.2.2. /proc/buddyinfo . centos.org . 23 May 2011 . https://web.archive.org/web/20130902032109/http://www.centos.org/docs/5/html/5.2/Deployment_Guide/s2-proc-buddyinfo.html . 2 September 2013 . dead .
7. Web site: Baron . Jason . HT vs. dual-core . 28 June 2011 . 13 May 2016 . https://web.archive.org/web/20160513191756/http://www.redhat.com/archives/nahant-list/2006-January/msg00176.html . dead .
8. Web site: Understanding Linux /proc/cpuinfo . https://web.archive.org/web/20120403230159/http://www.richweb.com/cpu_info . 2015-04-21 . 2012-04-03 . richweb.com.
9. Web site: Linux Filesystem Hierarchy . Nguyen . Binh . 2004-07-30 . Binh Nguyen . 63 . 2016-07-18 . /proc/kmsg[:] Messages output by the kernel. These are also routed to syslog..
10. Web site: The /proc filesystem . Linux Kernel documentation . 9 August 2024.