Part II · Your system

21. Kernel

1. 21.1sysctlKernel settings are files under /proc/sys. sysctl reads and writes them with dots instead of slashes: vm.swappiness is /proc/sys/vm/swappiness.
2. 21.2Kernel modulesMost drivers are modules: pieces of the kernel loaded when the hardware that needs them shows up.
3. 21.3dmesg and the kernel logThe kernel keeps its messages in a buffer in RAM: hardware found, driver errors, OOM kills, a USB stick plugged in.
4. 21.4syscalls and stracePrograms don't touch files, the network or devices themselves: they ask the kernel, with system calls (openat, read, connect…).
5. 21.5Why a tool may not watch the kernelProfilers and eBPF tools (perf, bpftrace, Omniscient) ask the kernel to watch other code. A few settings decide whether an ordinary user may.