Part II · Your system
13.3 /proc and /sys
alsoproc/procsys/sysprocfssysfspseudo filesystem
TL;DR
- Neither is on disk: the kernel makes up their content when you read it.
/proc: one folder per process (/proc/1234), plus system-wide files such as/proc/meminfoand/proc/cpuinfo./sys: devices and drivers, as a tree (/sys/block,/sys/class/net).- Some files can be written to change kernel settings live. That needs root, and the change is lost at reboot.
cat /proc/self/status # the process reading it: cat itself
ls /sys/class/net # your network interfaces
Pitfalls
- Most
/procfiles show a size of 0 inls -l: their content only exists when read. Usecat, not the size. - Values are a snapshot: read twice, get two answers.
/proc/sysholds whatsysctlchanges:sysctl vm.swappinessreads/proc/sys/vm/swappiness. Persistent settings go in/etc/sysctl.d/.- A PID is reused after its process exits:
/proc/1234can be a different program a minute later.
Deep dive 2 questions
Why two of them?
/proc came first. Its idea, processes as files, comes from Unix research
systems of the 1980s. On Linux it grew into a place for all kinds of kernel
information, with no rules on what goes where.
/sys (sysfs) arrived with kernel 2.6 and a stricter design: one value per
file, arranged by the kernel's model of devices and drivers. New device
information goes to /sys; /proc keeps processes and its historical
files.
How does atfq read your machine?
Mostly from these two trees: memory from /proc/meminfo, processes from
/proc/PID/stat, disks from /sys/block, network interfaces from
/sys/class/net. Reading files needs no root and runs no other program,
which is why atfq can stay read-only.