Complete /proc Directory Reference

What is /proc?
The /proc filesystem (procfs) is a virtual filesystem that provides an interface to kernel data structures. It doesn't contain real files on disk—instead, the kernel generates the contents dynamically when you read them. This makes /proc a window into the running kernel and all processes.

Key Characteristics:

Virtual filesystem (no disk space used)
Generated by kernel in real-time
Most files are read-only, some are writable for tuning
File sizes usually show as 0 bytes
Contents change based on system state

Process-Specific Directories (/proc/[PID]/)

Each running process has a directory named by its Process ID (PID). For example, process 1234 has directory /proc/1234/. These directories contain detailed information about that specific process.

/proc/[PID]/cmdline

Read-only
Complete command line for the process. Arguments are separated by null bytes (\0). Shows the exact command used to start the process.

cat /proc/1234/cmdline | tr '\0' ' '

/proc/[PID]/cwd

Symlink
Symbolic link to the current working directory of the process. Useful for determining where a process is operating.

ls -l /proc/1234/cwd

/proc/[PID]/environ

Read-only
Environment variables for the process. Variables are separated by null bytes. Shows all ENV vars the process has access to.

cat /proc/1234/environ | tr '\0' '\n'

/proc/[PID]/exe

Symlink
Symbolic link to the actual executable file that started this process. Extremely useful for identifying what binary is running.

ls -l /proc/1234/exe

/proc/[PID]/fd/

Directory
Contains symbolic links to all file descriptors opened by the process. Each link is numbered (0=stdin, 1=stdout, 2=stderr, 3+ are other open files). Essential for troubleshooting file access issues.

ls -l /proc/1234/fd/

/proc/[PID]/fdinfo/

Directory
Detailed information about each file descriptor (flags, position, mount ID). More verbose than fd/.

/proc/[PID]/maps

Read-only
Memory map showing all mapped regions (libraries, stack, heap, executable segments). Shows address ranges, permissions, offsets, and file mappings. Critical for debugging memory issues.

cat /proc/1234/maps

/proc/[PID]/mem

Read/Write (dangerous)
Direct access to process memory. Can read/write process memory. Use with extreme caution—can crash processes.

/proc/[PID]/root

Symlink
Symbolic link to the root directory as seen by the process. Useful when process is running in a chroot environment.

/proc/[PID]/stat

Read-only
Status information in a single line. Includes: PID, command name, state, parent PID, CPU times, memory usage, priority, nice value. Used by tools like ps and top.

cat /proc/1234/stat

/proc/[PID]/statm

Read-only
Memory usage statistics: total program size, resident set size, shared pages, code, data/stack.

/proc/[PID]/status

Read-only
Human-readable version of stat and statm. Much easier to parse. Shows: Name, State, PID, UID, GID, memory usage, CPU usage, capabilities. Preferred over stat for scripting.

cat /proc/1234/status

/proc/[PID]/task/

Directory
Contains subdirectories for each thread in the process. Each thread has its own directory with similar structure to the process directory.

/proc/[PID]/limits

Read-only
Shows resource limits (ulimit) for the process: max file size, max open files, max processes, max memory, CPU time, etc.

cat /proc/1234/limits

/proc/[PID]/io

Read-only
I/O statistics: bytes read/written, system calls, disk I/O. Useful for identifying I/O-heavy processes.

/proc/[PID]/net/

Directory
Network-related information for the process (if in different network namespace). Shows sockets, routes, statistics.

/proc/[PID]/oom_score

Read-only
Current OOM (Out Of Memory) killer score. Higher score = more likely to be killed when system runs out of memory.

/proc/[PID]/oom_score_adj

Writable
Adjust OOM score (-1000 to +1000). -1000 disables OOM killer for this process. Use to protect critical processes.

echo -1000 > /proc/1234/oom_score_adj

System-Wide Information Files

/proc/cpuinfo

Read-only
Detailed CPU information: processor count, model, vendor, speed, cache sizes, flags/capabilities, bogomips. One entry per logical CPU/core.

cat /proc/cpuinfo
grep "model name" /proc/cpuinfo | uniq
nproc # number of CPUs

/proc/meminfo

Read-only
Comprehensive memory statistics: total RAM, free RAM, available RAM, buffers, cache, swap usage, slab memory, huge pages. Used by free, top, and monitoring tools.

cat /proc/meminfo
grep MemTotal /proc/meminfo
grep MemAvailable /proc/meminfo

/proc/version

Read-only
Kernel version, compile date, GCC version used to compile kernel. Quick way to check kernel version.

cat /proc/version

/proc/uptime

Read-only
Two numbers: system uptime (seconds since boot) and cumulative idle time. Used by uptime command.

cat /proc/uptime

/proc/loadavg

Read-only
System load averages: 1-minute, 5-minute, 15-minute averages, plus running/total processes and last PID. Used by uptime and top.

cat /proc/loadavg

/proc/stat

Read-only
System-wide statistics: CPU time (user, system, idle, iowait), context switches, boot time, processes created. Used for CPU usage calculations.

/proc/vmstat

Read-only
Virtual memory statistics: page faults, swapping activity, memory allocation. Critical for memory performance analysis.

cat /proc/vmstat | grep -E 'pgpgin|pgpgout'

/proc/swaps

Read-only
Active swap devices/files with usage statistics. Shows which swap partitions are in use and how full they are.

cat /proc/swaps

/proc/partitions

Read-only
All disk partitions visible to the kernel. Shows major/minor device numbers, block count, and device names.

cat /proc/partitions

/proc/mounts

Read-only (symlink to /proc/self/mounts)
Currently mounted filesystems. Similar to /etc/mtab but always accurate. Shows mount point, filesystem type, and mount options.

cat /proc/mounts
mount # uses this file

/proc/filesystems

Read-only
Filesystems supported by the kernel. Lists all filesystem types the kernel can mount (ext4, xfs, nfs, tmpfs, etc.).

cat /proc/filesystems

/proc/devices

Read-only
Character and block devices configured in the kernel. Shows major device numbers and device names.

/proc/interrupts

Read-only
Hardware interrupt statistics per CPU. Shows interrupt counts for each IRQ line. Useful for diagnosing hardware issues.

cat /proc/interrupts

/proc/iomem

Read-only
Memory-mapped I/O regions. Shows physical memory address ranges used by system RAM and devices.

/proc/cmdline

Read-only
Kernel boot parameters. Shows the exact command line passed to the kernel at boot. Useful for debugging boot issues.

cat /proc/cmdline

/proc/modules

Read-only
Currently loaded kernel modules. Shows module name, size, use count, and dependencies. Same info as lsmod command.

cat /proc/modules
lsmod # formatted version

/proc/diskstats

Read-only
Disk I/O statistics for all block devices. Shows reads/writes, sectors transferred, time spent. Used by iostat.

cat /proc/diskstats

/proc/net/ - Network Information

/proc/net/dev

Read-only
Network interface statistics: bytes/packets transmitted and received, errors, drops. One line per interface. Used by ifconfig and ip.

cat /proc/net/dev

/proc/net/tcp, /proc/net/tcp6

Read-only
Active TCP connections (IPv4 and IPv6). Shows local/remote addresses, ports, connection state, inode. Used by netstat and ss.

cat /proc/net/tcp

/proc/net/udp, /proc/net/udp6

Read-only
Active UDP sockets (IPv4 and IPv6). Shows bound addresses and ports.

/proc/net/unix

Read-only
UNIX domain sockets. Shows local IPC connections between processes on the same machine.

/proc/net/route

Read-only
Kernel IP routing table. Shows destination, gateway, interface. Used by route command.

cat /proc/net/route
route -n # formatted version

/proc/net/arp

Read-only
ARP cache (IP-to-MAC address mappings). Shows known hardware addresses on local network.

cat /proc/net/arp
arp -n # formatted version

/proc/net/netstat

Read-only
Extended network statistics: TCP retransmits, packet loss, congestion. Used for network performance analysis.

/proc/sys/ - Kernel Parameters (sysctl)

The /proc/sys/ directory contains tunable kernel parameters. These files are writable (with root privileges) and allow runtime kernel configuration without rebooting. Changes are not persistent across reboots unless added to /etc/sysctl.conf or /etc/sysctl.d/.

/proc/sys/kernel/ - Core Kernel Parameters

/proc/sys/kernel/hostname

Writable
System hostname. Same as hostname command.

cat /proc/sys/kernel/hostname
echo "newhost" > /proc/sys/kernel/hostname

/proc/sys/kernel/pid_max

Writable
Maximum PID value. Default is usually 32768. Can be increased to 4194304 on 64-bit systems for more processes.

cat /proc/sys/kernel/pid_max
echo 4194304 > /proc/sys/kernel/pid_max

/proc/sys/kernel/threads-max

Writable
Maximum number of threads the system can create. Limited by available memory.

/proc/sys/kernel/panic

Writable
Seconds to wait before rebooting after a kernel panic. 0 = never reboot, >0 = reboot after N seconds. Useful for automatic recovery.

echo 10 > /proc/sys/kernel/panic # reboot after 10 seconds

/proc/sys/kernel/printk

Writable
Controls kernel message logging levels. Four values: console_loglevel, default_message_loglevel, minimum_console_loglevel, default_console_loglevel.

/proc/sys/kernel/core_pattern

Writable
Format for core dump filenames. Can include path and pattern variables (%p=PID, %e=executable name, %t=timestamp).

echo "/var/crash/core.%e.%p" > /proc/sys/kernel/core_pattern

/proc/sys/kernel/sysrq

Writable
Enable/disable Magic SysRq key functionality. 0=disabled, 1=enabled. Allows emergency system commands via keyboard.

/proc/sys/kernel/randomize_va_space

Writable
Address Space Layout Randomization (ASLR). 0=disabled, 1=conservative, 2=full (recommended for security).

/proc/sys/vm/ - Virtual Memory Management

/proc/sys/vm/swappiness

Writable
Controls swap usage aggressiveness (0-100). Lower = less swapping, higher = more swapping. Default is 60. Set to 10 for desktops, 1 for databases.

cat /proc/sys/vm/swappiness
echo 10 > /proc/sys/vm/swappiness
sysctl vm.swappiness=10

/proc/sys/vm/dirty_ratio

Writable
Percentage of system memory that can be filled with dirty pages before forcing synchronous write to disk. Default is 20%.

/proc/sys/vm/dirty_background_ratio

Writable
Percentage of memory at which background writeback starts. Default is 10%.

/proc/sys/vm/vfs_cache_pressure

Writable
Controls tendency to reclaim memory used for caching directory and inode objects. 100 is default (fair), lower = less aggressive, higher = more aggressive.

/proc/sys/vm/overcommit_memory

Writable
Memory overcommit policy. 0=heuristic (default), 1=always overcommit, 2=never overcommit beyond overcommit_ratio.

/proc/sys/vm/overcommit_ratio

Writable
Percentage of physical RAM considered when overcommit_memory=2. Default is 50%.

/proc/sys/vm/drop_caches

Write-only (use with caution)
Emergency use only! Write 1 to free pagecache, 2 to free dentries/inodes, 3 to free both. System will slow down temporarily.

# Clear all caches (requires root)
sync; echo 3 > /proc/sys/vm/drop_caches

/proc/sys/vm/min_free_kbytes

Writable
Minimum free memory (KB) the kernel tries to keep available. Important for preventing OOM conditions.

/proc/sys/net/ - Network Stack Parameters

/proc/sys/net/ipv4/ip_forward

Writable
Enable (1) or disable (0) IP forwarding. Required for routers and NAT. Critical for routing/gateway systems.

echo 1 > /proc/sys/net/ipv4/ip_forward
sysctl net.ipv4.ip_forward=1

/proc/sys/net/ipv4/tcp_syncookies

Writable
Enable (1) SYN cookies to protect against SYN flood attacks. Recommended for internet-facing servers.

/proc/sys/net/ipv4/tcp_keepalive_time

Writable
Seconds before sending TCP keepalive probes. Default is 7200 (2 hours). Lower for faster dead connection detection.

/proc/sys/net/ipv4/tcp_max_syn_backlog

Writable
Maximum queued connection requests (half-open connections). Increase for high-traffic servers.

/proc/sys/net/ipv4/tcp_fin_timeout

Writable
Seconds to wait in FIN-WAIT-2 state. Default is 60. Lower to free up resources faster.

/proc/sys/net/ipv4/tcp_tw_reuse

Writable
Allow reusing TIME_WAIT sockets for new connections. Useful for high-connection-rate servers.

/proc/sys/net/ipv4/ip_local_port_range

Writable
Range of local ports for outbound connections. Two numbers: min and max. Default is typically 32768-60999.

echo "1024 65535" > /proc/sys/net/ipv4/ip_local_port_range

/proc/sys/net/ipv4/icmp_echo_ignore_all

Writable
Ignore all ICMP echo requests (ping). 1=ignore, 0=respond. Security through obscurity (not recommended).

/proc/sys/net/core/somaxconn

Writable
Maximum socket listen() backlog. Increase for high-traffic web servers. Default is 128.

/proc/sys/net/core/netdev_max_backlog

Writable
Maximum packets in network device input queue. Increase for high-bandwidth systems.

/proc/sys/net/core/rmem_max, /proc/sys/net/core/wmem_max

Writable
Maximum socket receive/send buffer size (bytes). Increase for high-bandwidth, high-latency networks.

/proc/sys/fs/ - Filesystem Parameters

/proc/sys/fs/file-max

Writable
Maximum number of file handles the kernel can allocate system-wide. Increase for heavily-loaded servers.

cat /proc/sys/fs/file-max
echo 2097152 > /proc/sys/fs/file-max

/proc/sys/fs/file-nr

Read-only
Current file handle usage. Three numbers: allocated, unused, maximum. Monitor to ensure not hitting file-max.

Special /proc Entries

/proc/self/

Symlink
Symbolic link to the /proc/[PID]/ directory of the process that's accessing /proc. Always points to the current process.

ls -l /proc/self # shows your current shell's PID
cat /proc/self/cmdline

/proc/kcore

Read-only (dangerous)
Represents physical memory in ELF core format. Can be used by debuggers (gdb). Size equals RAM + swap. Reading can crash the system—use with extreme caution.

/proc/kmsg

Read-only
Kernel message buffer. Reading empties the buffer. Used by dmesg and syslog. Only one process should read this.

/proc/kallsyms

Read-only
Kernel symbol table. Shows kernel function/variable addresses and names. Used by profilers and debuggers.

/proc/slabinfo

Read-only
Kernel slab allocator information. Shows kernel memory cache usage. Used by slabtop command.

cat /proc/slabinfo
slabtop # interactive view

/proc/buddyinfo

Read-only
Memory fragmentation information. Shows available memory chunks by size. Useful for diagnosing memory fragmentation.

/proc/zoneinfo

Read-only
Memory zone information. Shows detailed statistics for each memory zone (DMA, Normal, HighMem).

/proc/mdstat

Read-only
Software RAID (md) status. Shows RAID array configuration, status, and rebuild progress.

cat /proc/mdstat

/proc/crypto

Read-only
Available cryptographic algorithms. Lists encryption ciphers supported by the kernel.

Important Safety Notes:

Many /proc/sys/ files require root privileges to modify
Changes to /proc/sys/ are NOT persistent across reboots (use /etc/sysctl.conf for persistence)
Incorrect kernel parameter changes can crash the system or cause data loss
Always test changes in a non-production environment first
Reading /proc/kcore or /proc/kmsg incorrectly can crash the system
Writing to /proc/sys/vm/drop_caches forces cache drops—use only for testing

Common /proc Usage Examples

Check memory usage

grep MemTotal /proc/meminfo
grep MemAvailable /proc/meminfo
grep SwapTotal /proc/meminfo
free -h # uses /proc/meminfo

Tune kernel parameters

# Temporary (until reboot)
echo 10 > /proc/sys/vm/swappiness

# Permanent (survives reboot)
echo "vm.swappiness=10" >> /etc/sysctl.conf
sysctl -p

# View current value
cat /proc/sys/vm/swappiness
sysctl vm.swappiness

Pro Tip: Use the sysctl command as a more convenient interface to /proc/sys/. It handles the path translation automatically:

sysctl -a # list all parameters
sysctl vm.swappiness # read value
sysctl -w vm.swappiness=10 # write value
sysctl -p # load from /etc/sysctl.conf