Why this article
I am trying to collect some tips for getting userland information from procfs.
Warning: Information may be specific to kernel version 2.6
What is this procfs all about
Procfs is a virtual file system in linux, mounted in /proc and serves multiple purposes including access to kernel information in userland or for debuggging purpose.
One of the feature which makes Linux special to me is access to process information in text stream. Lot of linux commands(ps, top, pstree etc) rely on this filesystem for information.
The virtual file system...
The files and directories of /proc filesystems are virtual because the data is not actually stored on any sort of permanent storage like a hard disk; instead, the directories, files, and data within them are created dynamically in memory from raw kernel data whenever you attempt to read from them.
Mounting proc
Check if you already have procfs mounted on your system(cat /etc/mtab|grep proc), otherwise mount it using the following command:
mount -t proc proc /proc
Process information
Lot of commands including ps, top etc. retreive process information from this filesystem. Each process has an entry in /proc/ filesystem identified by it's pid.
Following are the important files in /proc/
pid/cmdline contains the command that was used to start the process (using null characters to separate arguments).
/proc/pid/cwd contains a link to the current working directory of the process.
/proc/pid/environ contains a list of the environment variables that the process has available.
/proc/pid/exe contains a link to the program that is running in the process.
/proc/pid/fd/ is a directory containing a link to each of the files that the process has open.
/proc/pid/mem contains the memory contents of the process.
/proc/pid/stat contains process status information.
/proc/pid/statm contains process memory usage information
Examples of getting process information are:
0x00000002 Process being created
0x00000004 Exiting
0x00000008 Dead
0x00000040 Process using super user privilage
0x00000200 Process dumping core
0x00000400 Process received some signal
0x00000800 Process allocating memory
0x00001000 Killed for out-of-memory
I picked up these flags from /usr/src/linux/include/linux/sched.h
To find out input files used by a process:
ls -l /proc/[pid]/fd/0
To find out socket used by a process:
ls -l /proc/[pid]/fd|grep socket|cut -d: -f3|sed 's/\[//;s/\]//'
Information about these sockets can be obtained from
netstat -ae
cat /proc/[pid]/cmdline
grep PPid /proc/[pid]/status
General system information..
Procfs is used to get lot of system information. This includes information on cpu load, file system information and networking configuration.
Following are some examples of viewing or changing the system information using procfs:
grep Free /proc/meminfo
grep processes /proc/stat
awk '{"1 min:"$1"/n5 min:"$2"\n15 min:"$3}' /proc/loadavg
To disable ping, As root do the following:
echo 1> /proc/sys/net/ipv4/icmp_echo_ignore_all
or to enable IP forwarding, IP Masquerade:
echo 1 > /proc/sys/net/ipv4/ip_forward
echo www.abc.com > /proc/sys/kernel/hostname
cat /proc/cpuinfo
cat /proc/swaps
cat /proc/uptime
cat /proc/fs/nfsd/exports
A bit of kernel information..
Though I intend to cover it in some other article, here are some kernel titbits:
cat /proc/version
To get more information have a look at: /usr/src/linux/Documentation/filesystems/proc.txt
I will try to look at this filesystem from kernel level in some future article.
