What is the /proc filesystem?

/proc is a virtual (pseudo) filesystem the Linux kernel generates in memory. The files report kernel and process state on demand, so they always show 0 bytes in a directory listing yet stream live data when read.

Why does cat /proc/PID/cmdline run the lines together?

The arguments are separated by NUL (\0) bytes rather than spaces or newlines, so a plain cat shows them joined. Pipe through 'tr "\0" " "' to make it readable.

Are /proc files safe to read?

Reading is safe and read-only for most entries. Some, like /proc/PID/environ, are restricted to the owning user or root. A few under /proc/sys are writable and change live kernel settings, so edit those with care.

How do I find a process's open files?

List /proc/PID/fd/ — it holds one numbered symlink per open file descriptor that resolves to the underlying file, socket or pipe. This is what lsof reads under the hood.

Is /proc the same across all Linux systems?

The core entries (cpuinfo, meminfo, stat, the per-PID files) are very stable, but exact fields evolve between kernel versions and some are architecture-specific. Treat the format notes here as the common case and confirm against your kernel's proc(5) man page.

What is the Linux /proc Files Reference?

Searchable reference for important Linux /proc filesystem entries including cpuinfo, meminfo, loadavg, net/dev and per-process status, maps, fd and limits, each with its exact file format. It runs free in your browser on Gera Tools, with nothing uploaded.

Linux /proc Files Reference

Name: Linux /proc Files Reference
Creator: Gera Tools
License: https://creativecommons.org/licenses/by/4.0/

Inspect the kernel through /proc

The /proc filesystem is the Linux kernel’s window into itself. Instead of a system call, you read a file: cat /proc/meminfo for memory, cat /proc/loadavg for load, or cat /proc/PID/status for one process. This tool is a searchable map of the most useful entries, split between system-wide files and the per-process files under /proc/PID/, with the exact data format you will see.

How it works

/proc is a virtual filesystem mounted at boot. The files do not exist on disk — the kernel synthesises their contents the moment you open them, which is why they report a size of zero yet return live data. System-wide entries live directly under /proc (for example /proc/cpuinfo), while each running process gets a numbered directory whose name is its PID. A process can always reach its own directory through the /proc/self symlink. Many tools you already use are thin readers over /proc: top and ps parse /proc/PID/stat, free parses /proc/meminfo, and lsof walks /proc/PID/fd/.

The most useful /proc files and what they tell you

System-wide files

/proc/meminfo — Memory accounting for the entire system. Key fields: MemTotal (physical RAM), MemFree (unused), MemAvailable (actually available for new processes — more useful than MemFree because it accounts for reclaimable caches), Buffers and Cached (kernel I/O cache), SwapTotal / SwapFree. The free command is a formatted view of this file.

/proc/cpuinfo — One block per logical CPU showing model name, clock frequency, cache sizes, and feature flags. The flags field lists CPU capabilities (sse4_2, avx2, vmx for Intel VT-x, svm for AMD-V, etc.) that compilers and hypervisors detect at runtime.

/proc/loadavg — Five space-separated values: 1-minute, 5-minute, and 15-minute load averages, then running/total threads, then the most recently created PID. Load average counts runnable plus uninterruptible (disk-waiting) threads; a sustained load above the CPU count means there is a queue.

/proc/net/dev — Per-interface packet and byte counters. The ip -s link and ifstat commands both read from here. Fields are receive bytes, packets, errors, drops, then transmit bytes, packets, errors, drops.

/proc/diskstats — Per-block-device I/O statistics: reads/writes completed, sectors, and milliseconds spent. The iostat command is a front-end for this file.

/proc/sys/ — A writable subtree of kernel tuning parameters, mirrored by sysctl. Writing to /proc/sys/vm/swappiness is equivalent to sysctl -w vm.swappiness=10. Changes are volatile until persisted in /etc/sysctl.conf.

Per-process files (under /proc/PID/)

/proc/PID/status — Human-readable process summary: state, PID, PPID, UID, GID, VmRSS (resident set size), VmPeak, and thread count. Easier to parse than /proc/PID/stat for most monitoring purposes.

/proc/PID/stat — Machine-parseable one-line summary. Fields 14–17 are user-mode and kernel-mode CPU time in clock ticks (sysconf(_SC_CLK_TCK) converts to seconds). ps and top read this to compute CPU%.

/proc/PID/maps — Each memory mapping: address range, permissions (rwxp), offset, device, inode, and the backing file. Essential for understanding which shared libraries are loaded and what memory regions are executable.

/proc/PID/fd/ — A directory with one numbered symlink per open file descriptor. Reading the symlink target (readlink /proc/PID/fd/3) reveals the underlying file, socket, or pipe. lsof walks this directory for every process.

/proc/PID/cmdline — The command line used to start the process, with arguments separated by NUL bytes (\0). A plain cat prints them joined; pipe through tr '\0' ' ' to separate them.

/proc/PID/environ — The environment variables at process start, also NUL-separated. Reading requires permission (root or the owning user). Use strings /proc/PID/environ for a quick readable dump.

/proc/PID/limits — The current resource limits (soft and hard) for the process: open files, address space, CPU time, etc. More reliable than ulimit -a, which only shows shell settings.

Tips and notes

Fields differ slightly by kernel version and architecture, so use these format notes as a guide and confirm with man 5 proc. Remember that values containing embedded NUL bytes — cmdline and environ — look run-together under cat; translate the NULs to spaces or newlines to read them. Entries under /proc/sys/ mirror sysctl, and writing to those leaf files changes the live setting, so treat that tree as configuration rather than read-only data.