proc

PROC(C) Linux Programmer's Manual PROC(C)

NAME
proc - process information pseudo-filesystem

DESCRIPTION
/proc is a pseudo-filesystem which is used as an interface
to kernel data structures rather than reading and inter-
preting /dev/kmem. Most of it is read-only, but some
files allow kernel variables to be changed.

The following outline gives a quick tour through the /proc
hierarchy.

[number]
There is a numerical subdirectory for each running
process; the subdirectory is named by the process
ID. Each contains the following pseudo-files and
directories.

cmdline
This holds the complete command line for the
process, unless the whole process has been
swapped out, or unless the process is a zom-
bie. In either of these later cases, there
is nothing in this file: i.e. a read on this
file will return as having read 0 charac-
ters. This file is null-terminated, but not
newline-terminated.

cwd This is a link to the current working direc-
tory of the process. To find out the cwd of
process 20, for instance, you can do this:

cd /proc/20/cwd; /bin/pwd

Note that the pwd command is often a shell
builtin, and might not work properly. In
bash, you may use pwd -P.

environ
This file contains the environment for the
process. The entries are separated by null
characters, and there may be a null charac-
ter at the end. Thus, to print out the
environment of process 1, you would do:

(cat /proc/1/environ; echo) | tr "\000" "\n"

(For a reason why one should want to do
this, see lilo(o).)

exe Under Linux 2.2 and 2.4 exe is a symbolic
link containing the actual path name of the
executed command. The exe symbolic link can
be dereferenced normally - attempting to
open exe will open the executable. You can
even type /proc/[number]/exe to run another
copy of the same process as [number].

Under Linux 2.0 and earlier exe is a pointer
to the binary which was executed, and
appears as a symbolic link. A readlink(k)
call on the exe special file under Linux 2.0
returns a string in the format:

[device]:inode

For example, [0301]:1502 would be inode 1502
on device major 03 (IDE, MFM, etc. drives)
minor 01 (first partition on the first
drive).

find(d) with the -inum option can be used to
locate the file.

fd This is a subdirectory containing one entry
for each file which the process has open,
named by its file descriptor, and which is a
symbolic link to the actual file (as the exe
entry does). Thus, 0 is standard input, 1
standard output, 2 standard error, etc.

Programs that will take a filename, but will
not take the standard input, and which write
to a file, but will not send their output to
standard output, can be effectively foiled
this way, assuming that -i is the flag des-
ignating an input file and -o is the flag
designating an output file:
foobar -i /proc/self/fd/0 -o /proc/self/fd/1 ...
and you have a working filter. Note that
this will not work for programs that seek on
their files, as the files in the fd direc-
tory are not seekable.

/proc/self/fd/N is approximately the same as
/dev/fd/N in some UNIX and UNIX-like sys-
tems. Most Linux MAKEDEV scripts symboli-
cally link /dev/fd to /proc/self/fd, in
fact.

maps A file containing the currently mapped mem-
ory regions and their access permissions.

The format is:

address perms offset dev inode pathname
08048000-08056000 r-xp 00000000 03:0c 64593 /usr/sbin/gpm
08056000-08058000 rw-p 0000d000 03:0c 64593 /usr/sbin/gpm
08058000-0805b000 rwxp 00000000 00:00 0
40000000-40013000 r-xp 00000000 03:0c 4165 /lib/ld-2.2.4.so
40013000-40015000 rw-p 00012000 03:0c 4165 /lib/ld-2.2.4.so
4001f000-40135000 r-xp 00000000 03:0c 45494 /lib/libc-2.2.4.so
40135000-4013e000 rw-p 00115000 03:0c 45494 /lib/libc-2.2.4.so
4013e000-40142000 rw-p 00000000 00:00 0
bffff000-c0000000 rwxp 00000000 00:00 0

where address is the address space in the
process that it occupies, perms is a set of
permissions:

r = read
w = write
x = execute
s = shared
p = private (copy on write)

offset is the offset into the file/whatever,
dev is the device (major:minor), and inode
is the inode on that device. 0 indicates
that no inode is associated with the memory
region, as the case would be with bss.

Under Linux 2.0 there is no field giving
pathname.

mem Via the mem file one can access the pages of
a process's memory through open(n), read(d),
and fseek(k).

root Unix and Linux support the idea of a per-
process root of the filesystem, set by the
chroot(t) system call. Root points to the
file system root, and behaves as exe, fd/*,
etc. do.

stat Status information about the process. This
is used by ps(s). It is defined in
/usr/src/linux/fs/proc/array.c.

The fields, in order, with their proper
scanf(f) format specifiers, are:

pid %d The process id.

comm %s
The filename of the executable, in
parentheses. This is visible
whether or not the executable is
swapped out.

state %c
One character from the string
"RSDZTW" where R is running, S is
sleeping in an interruptible wait, D
is waiting in uninterruptible disk
sleep, Z is zombie, T is traced or
stopped (on a signal), and W is pag-
ing.

ppid %d
The PID of the parent.

pgrp %d
The process group ID of the process.

session %d
The session ID of the process.

tty_nr %d
The tty the process uses.

tpgid %d
The process group ID of the process
which currently owns the tty that
the process is connected to.

flags %lu
The flags of the process. The math
bit is decimal 4, and the traced bit
is decimal 10.

minflt %lu
The number of minor faults the pro-
cess has made which have not
required loading a memory page from
disk.

cminflt %lu
The number of minor faults that the
process and its children have made.

majflt %lu
The number of major faults the pro-
cess has made which have required
loading a memory page from disk.

cmajflt %lu
The number of major faults that the
process and its children have made.

utime %lu
The number of jiffies that this pro-
cess has been scheduled in user
mode.

stime %lu
The number of jiffies that this pro-
cess has been scheduled in kernel
mode.

cutime %ld
The number of jiffies that this pro-
cess and its children have been
scheduled in user mode.

cstime %ld
The number of jiffies that this pro-
cess and its children have been
scheduled in kernel mode.

priority %ld
The standard nice value, plus fif-
teen. The value is never negative
in the kernel.

nice %ld
The nice value ranges from 19
(nicest) to -19 (not nice to oth-
ers).

0 %ld This value is hard coded to 0 as a
placeholder for a removed field.

itrealvalue %ld
The time in jiffies before the next
SIGALRM is sent to the process due
to an interval timer.

starttime %lu
The time in jiffies the process
started after system boot.

vsize %lu
Virtual memory size in bytes.

rss %ld
Resident Set Size: number of pages
the process has in real memory,
minus 3 for administrative purposes.
This is just the pages which count
towards text, data, or stack space.
This does not include pages which
have not been demand-loaded in, or
which are swapped out.

rlim %lu
Current limit in bytes on the rss of
the process (usually 4,294,967,295).

startcode %lu
The address above which program text
can run.

endcode %lu
The address below which program text
can run.

startstack %lu
The address of the start of the
stack.

kstkesp %lu
The current value of esp (stack
pointer), as found in the kernel
stack page for the process.

kstkeip %lu
The current EIP (instruction
pointer).

signal %lu
The bitmap of pending signals (usu-
ally 0).

blocked %lu
The bitmap of blocked signals (usu-
ally 0, 2 for shells).

sigignore %lu
The bitmap of ignored signals.

sigcatch %lu
The bitmap of catched signals.

wchan %lu
This is the "channel" in which the
process is waiting. It is the
address of a system call, and can be
looked up in a namelist if you need
a textual name. (If you have an up-
to-date /etc/psdatabase, then try ps
-l to see the WCHAN field in
action.)

nswap %lu
Number of pages swapped - not main-
tained.

cnswap %lu
Cumulative nswap for child pro-
cesses.

exit_signal %d
Signal to be sent to parent when we
die.

processor %d
Processor number last executed on.

statm Provides information about memory status in
pages. The columns are:
size total program size
resident resident set size
share shared pages
trs text (code)
drs data/stack
lrs library
dt dirty pages

status Provides much of the information in stat and
statm in an format that's easier for humans
to parse.

bus Contains subdirectories for installed busses.

pci Contains various bus subdirectories and
pseudo-files containing information about
pci busses, installed devices, and device
drivers. Some of these files are not ASCII.

devices
Information about pci devices. They
may be accessed through lspci(i) and
setpci(i).

cmdline
Argments passed to the Linux kernel at boot time.
Often done via a boot manager such as lilo(o).

cpuinfo
This is a collection of CPU and system architecture
dependent items, for each supported architecture a
different list. Two common entries are processor
which gives CPU number and bogomips; a system con-
stant that is calculated during kernel initializa-
tion. SMP machines have information for each CPU.

devices
Text listing of major numbers and device groups.
This can be used by MAKEDEV scripts for consistency
with the kernel.

dma This is a list of the registered ISA DMA (direct
memory access) channels in use.

driver Empty subdirectory.

execdomains
List of the execution domains (ABI personalities).

fb Frame buffer information when CONFIG_FB is defined
during kernel compilation.

filesystems
A text listing of the filesystems which were com-
piled into the kernel. Incidentally, this is used
by mount(t) to cycle through different filesystems
when none is specified.

ide ide exists on systems with the ide bus. There are
directories for each ide channel and attached
device. Files include:

cache buffer size in KB
capacity number of sectors
driver driver version
geometry physical and logical geometry
identify in hexidecimal
media media type
model manufacturer's model number
settings drive settings
smart_thresholds in hexidecimal
smart_values in hexidecimal

The hdparm(m) utility provides access to this
information in a friendly format.

interrupts
This is used to record the number of interrupts per
each IRQ on (at least) the i386 architechure. Very
easy to read formatting, done in ASCII.

iomem I/O memory map in Linux 2.4.

ioports
This is a list of currently registered Input-Output
port regions that are in use.

kcore This file represents the physical memory of the
system and is stored in the ELF core file format.
With this pseudo-file, and an unstripped kernel
(/usr/src/linux/vmlinux) binary, GDB can be used to
examine the current state of any kernel data struc-
tures.

The total length of the file is the size of physi-
cal memory (RAM) plus 4KB.

kmsg This file can be used instead of the syslog(g) sys-
tem call to log kernel messages. A process must
have superuser privileges to read this file, and
only one process should read this file. This file
should not be read if a syslog process is running
which uses the syslog(g) system call facility to
log kernel messages.

Information in this file is retrieved with the
dmesg(g) program.

ksyms This holds the kernel exported symbol definitions
used by the modules(s) tools to dynamically link
and bind loadable modules.

loadavg
The load average numbers give the number of jobs in
the run queue (state R) or waiting for disk I/O
(state D) averaged over 1, 5, and 15 minutes. They
are the same as the load average numbers given by
uptime(e) and other programs.

locks This file shows current file locks.

malloc This file is only present if CONFIGDEBUGMALLOC was
defined during compilation.

meminfo
This is used by free(e) to report the amount of
free and used memory (both physical and swap) on
the system as well as the shared memory and buffers
used by the kernel.

It is in the same format as free(e), except in
bytes rather than KB.

modules
A text list of the modules that have been loaded by
the system. See also lsmod(d).

mtrr Memory Type Range Registers. See
/usr/src/linux/Documentation/mtrr.txt for details.

net various net pseudo-files, all of which give the
status of some part of the networking layer. These
files contain ASCII structures and are, therefore,
readable with cat. However, the standard net-
stat(t) suite provides much cleaner access to these
files.

arp This holds an ASCII readable dump of the
kernel ARP table used for address resolu-
tions. It will show both dynamically learned
and pre-programmed ARP entries. The format
is:

IP address HW type Flags HW address Mask Device
192.168.0.50 0x1 0x2 00:50:BF:25:68:F3 * eth0
192.168.0.250 0x1 0xc 00:00:00:00:00:00 * eth0

Here 'IP address' is the IPv4 address of the
machine and the 'HW type' is the hardware type of
the address from RFC 826. The flags are the inter-
nal flags of the ARP structure (as defined in
/usr/include/linux/if_arp.h) and the 'HW address'
is the physical layer mapping for that IP address
if it is known.

dev The dev pseudo-file contains network device
status information. This gives the number of
received and sent packets, the number of
errors and collisions and other basic
statistics. These are used by the ifcon-
fig(g) program to report device status. The
format is:

Inter-| Receive | Transmit
face |bytes packets errs drop fifo frame compressed multicast|bytes packets errs drop fifo colls carrier compressed
lo: 2776770 11307 0 0 0 0 0 0 2776770 11307 0 0 0 0 0 0
eth0: 1215645 2751 0 0 0 0 0 0 1782404 4324 0 0 0 427 0 0
ppp0: 1622270 5552 1 0 0 0 0 0 354130 5669 0 0 0 0 0 0
tap0: 7714 81 0 0 0 0 0 0 7714 81 0 0 0 0 0 0

rarp This file uses the same format as the arp
file and contains the current reverse map-
ping database used to provide rarp(p)
reverse address lookup services. If RARP is
not configured into the kernel, this file
will not be present.

raw Holds a dump of the RAW socket table. Much
of the information is not of use apart from
debugging. The 'sl' value is the kernel hash
slot for the socket, the 'local address' is
the local address and protocol number
pair."St" is the internal status of the
socket. The "tx_queue" and "rx_queue" are
the outgoing and incoming data queue in
terms of kernel memory usage. The "tr",
"tm->when", and "rexmits" fields are not
used by RAW. The uid field holds the creator
euid of the socket.

snmp This file holds the ASCII data needed for
the IP, ICMP, TCP, and UDP management infor-
mation bases for an snmp agent.

tcp Holds a dump of the TCP socket table. Much
of the information is not of use apart from
debugging. The "sl" value is the kernel hash
slot for the socket, the "local address" is
the local address and port number pair. The
"remote address" is the remote address and
port number pair (if connected). 'St' is the
internal status of the socket. The
'tx_queue' and 'rx_queue' are the outgoing
and incoming data queue in terms of kernel
memory usage. The "tr", "tm->when", and
"rexmits" fields hold internal information
of the kernel socket state and are only use-
ful for debugging. The uid field holds the
creator euid of the socket.

udp Holds a dump of the UDP socket table. Much
of the information is not of use apart from
debugging. The "sl" value is the kernel hash
slot for the socket, the "local address" is
the local address and port number pair. The
"remote address" is the remote address and
port number pair (if connected). "St" is the
internal status of the socket. The
"tx_queue" and "rx_queue" are the outgoing
and incoming data queue in terms of kernel
memory usage. The "tr", "tm->when", and
"rexmits" fields are not used by UDP. The
uid field holds the creator euid of the
socket. The format is:

sl local_address rem_address st tx_queue rx_queue tr rexmits tm->when uid
1: 01642C89:0201 0C642C89:03FF 01 00000000:00000001 01:000071BA 00000000 0
1: 00000000:0801 00000000:0000 0A 00000000:00000000 00:00000000 6F000100 0
1: 00000000:0201 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0

unix Lists the UNIX domain sockets present within
the system and their status. The format is:
Num RefCount Protocol Flags Type St Path
0: 00000002 00000000 00000000 0001 03
1: 00000001 00000000 00010000 0001 01 /dev/printer

Here 'Num' is the kernel table slot number, 'Ref-
Count' is the number of users of the socket, 'Pro-
tocol' is currently always 0, 'Flags' represent the
internal kernel flags holding the status of the
socket. Currently, type is always '1' (Unix domain
datagram sockets are not yet supported in the ker-
nel). 'St' is the internal state of the socket and
Path is the bound path (if any) of the socket.

partitions
Contains major and minor numbers of each partition
as well as number of blocks and partition name.

pci This is a listing of all PCI devices found during
kernel initialization and their configuration.

scsi A directory with the scsi midlevel pseudo-file and
various SCSI lowlevel driver directories, which
contain a file for each SCSI host in this system,
all of which give the status of some part of the
SCSI IO subsystem. These files contain ASCII
structures and are, therefore, readable with cat.

You can also write to some of the files to recon-
figure the subsystem or switch certain features on
or off.

scsi This is a listing of all SCSI devices known
to the kernel. The listing is similar to the
one seen during bootup. scsi currently sup-
ports only the add-single-device command
which allows root to add a hotplugged device
to the list of known devices.

An echo 'scsi add-single-device 1 0 5 0' >
/proc/scsi/scsi will cause host scsi1 to
scan on SCSI channel 0 for a device on ID 5
LUN 0. If there is already a device known on
this address or the address is invalid, an
error will be returned.

drivername
drivername can currently be NCR53c7xx,
aha152x, aha1542, aha1740, aic7xxx, bus-
logic, eata_dma, eata_pio, fdomain, in2000,
pas16, qlogic, scsi_debug, seagate, t128,
u15-24f, ultrastore, or wd7000. These
directories show up for all drivers that
registered at least one SCSI HBA. Every
directory contains one file per registered
host. Every host-file is named after the
number the host was assigned during initial-
ization.

Reading these files will usually show driver
and host configuration, statistics etc.

Writing to these files allows different
things on different hosts. For example,
with the latency and nolatency commands,
root can switch on and off command latency
measurement code in the eata_dma driver.
With the lockup and unlock commands, root
can control bus lockups simulated by the
scsi_debug driver.

self This directory refers to the process accessing the
/proc filesystem, and is identical to the /proc
directory named by the process ID of the same pro-
cess.

slabinfo
Information about kernel caches. The columns are:
cache-name
num-active-objs
total-objs
object-size
num-active-slabs
total-slabs
num-pages-per-slab
See slabinfo(o) for details.

stat kernel/system statistics. Varies with architec-
ture. Common entries include:

cpu 3357 0 4313 1362393
The number of jiffies (1/100ths of a second)
that the system spent in user mode, user
mode with low priority (nice), system mode,
and the idle task, respectively. The last
value should be 100 times the second entry
in the uptime pseudo-file.

page 5741 1808
The number of pages the system paged in and
the number that were paged out (from disk).

swap 1 0
The number of swap pages that have been
brought in and out.

intr 1462898
The number of interrupts received from the
system boot.

disk_io: (2,0):(31,30,5764,1,2) (3,0):...
(major,minor):(noinfo, read_io_ops,
blks_read, write_io_ops, blks_written)

ctxt 115315
The number of context switches that the sys-
tem underwent.

btime 769041601
boot time, in seconds since the epoch (Jan-
uary 1, 1970).

processes 86031
Number of forks since boot.

swaps Swap areas in use. See also swapon(n).

sys This directory (present since 1.3.57) contains a
number of files and subdirectories corresponding to
kernel variables. These variables can be read and
sometimes modified using the proc file system, and
the sysctl(l) system call. Presently, there are
subdirectories abi, debug, dev, fs, kernel, net,
proc and vm that each contain more files and subdi-
rectories.

abi This directory may be empty.

debug This directory may be empty.

dev This directory may be empty.

fs This contains files dentry-state, dir-
notify-enable, dquot-nr, file-max, file-nr,
inode-nr, inode-state, lease-break-time,
leases-enable, overflowgid and overflowuid
with function fairly clear from the name.

The (read-only) file file-nr gives the number of
files presently opened.

The file file-max gives the maximum number of open
files the kernel is willing to handle. If 1024 is
not enough for you, try
echo 4096 > /proc/sys/kernel/file-max

Similarly, the files inode-nr and inode-max indi-
cate the present and the maximum number of inodes.

kernel This contains files cad_pid,cap-
bound,core_uses_pid,ctrl-alt-del domainname,host-
name, modprobe, msgmax, msgmnb, msgmni, osrelease,
ostype, overflowgid, overflowuid, panic, printk,
random, rtsig-max, rtsig-nr, sem, shmall, shmmax,
shmmni, sysrq, tainted, threads-max and version
with function fairly clear from the name. The
files ostype, osrelease, and version give sub-
strings of /proc/version. The file panic gives r/w
access to the kernel variable panic_timeout. If
this is zero, the kernel will loop on a panic; if
nonzero it indicates that the kernel should autore-
boot after this number of seconds.

sysvipc
Subdirectory containing the psuedo-files msg, sem
and shm. These files have headers and are format-
ted for easier understanding.

tty Subdirectory containing the psuedo-files and subdi-
rectories for tty drivers and line disciplines.

uptime This file contains two numbers: the uptime of the
system (seconds), and the amount of time spent in
idle process (seconds).

version
This strings identifies the kernel version that is
currently running. For instance,
Linux version 1.0.9 (quinlan@phaze) #1 Sat May 14 01:51:54 EDT 1994

SEE ALSO
cat(t), find(d), free(e), mount(t), ps(s), tr(r),
uptime(e), chroot(t), mmap(p), readlink(k), syslog(g),
slabinfo(o), hier(r), arp(p), dmesg(g), hdparm(m), ifcon-
fig(g), lsmod(d), lspci(i), netstat(t), procinfo(o),
route(e) /usr/src/linux/Documentation/filesystems/proc.txt

CONFORMS TO
This roughly conforms to a Linux 2.4.17 kernel. Please
update this as necessary!

Last updated for Linux 2.4.17.

CAVEATS
Note that many strings (i.e., the environment and command
line) are in the internal format, with sub-fields termi-
nated by NUL bytes, so you may find that things are more
readable if you use od -c or tr "\000" "\n" to read them.

This manual page is incomplete, possibly inaccurate, and
is the kind of thing that needs to be updated very often.

BUGS
The /proc file system may introduce security holes into
processes running with chroot(t). For example, if /proc
is mounted in the chroot hierarchy, a chdir(r) to
/proc/1/root will return to the original root of the file
system. This may be considered a feature instead of a
bug, since Linux does not yet support the fchroot(t) call.

2001-12-16 PROC(C)

about this index... about Greenstone...