What is the /proc filesystem?

/proc is a virtual (pseudo) filesystem the Linux kernel generates in memory. The files report kernel and process state on demand, so they always show 0 bytes in a directory listing yet stream live data when read.

Why does cat /proc/PID/cmdline run the lines together?

The arguments are separated by NUL (\0) bytes rather than spaces or newlines, so a plain cat shows them joined. Pipe through 'tr "\0" " "' to make it readable.

Are /proc files safe to read?

Reading is safe and read-only for most entries. Some, like /proc/PID/environ, are restricted to the owning user or root. A few under /proc/sys are writable and change live kernel settings, so edit those with care.

How do I find a process's open files?

List /proc/PID/fd/ — it holds one numbered symlink per open file descriptor that resolves to the underlying file, socket or pipe. This is what lsof reads under the hood.

Is /proc the same across all Linux systems?

The core entries (cpuinfo, meminfo, stat, the per-PID files) are very stable, but exact fields evolve between kernel versions and some are architecture-specific. Treat the format notes here as the common case and confirm against your kernel's proc(5) man page.

Linux /proc Files Reference

Email me this result

Get this tool's output sent to your inbox, plus one useful tool a week. No spam, unsubscribe any time.

Inspect the kernel through /proc

The /proc filesystem is the Linux kernel’s window into itself. Instead of a system call, you read a file: cat /proc/meminfo for memory, cat /proc/loadavg for load, or cat /proc/PID/status for one process. This tool is a searchable map of the most useful entries, split between system-wide files and the per-process files under /proc/PID/, with the exact data format you will see.

How it works

/proc is a virtual filesystem mounted at boot. The files do not exist on disk — the kernel synthesises their contents the moment you open them, which is why they report a size of zero yet return live data. System-wide entries live directly under /proc (for example /proc/cpuinfo), while each running process gets a numbered directory whose name is its PID. A process can always reach its own directory through the /proc/self symlink. Many tools you already use are thin readers over /proc: top and ps parse /proc/PID/stat, free parses /proc/meminfo, and lsof walks /proc/PID/fd/.

Tips and notes

Fields differ slightly by kernel version and architecture, so use these format notes as a guide and confirm with man 5 proc. Remember that values containing embedded NUL bytes — cmdline and environ — look run-together under cat; translate the NULs to spaces or newlines to read them. Entries under /proc/sys/ mirror sysctl, and writing to those leaf files changes the live setting, so treat that tree as configuration rather than read-only data.