The proc Directory Structure

To use /proc directly (as opposed to from a utility that accesses /proc and interprets its contents for you), you must understand something about what's in the /proc directory tree. For the most part, /proc's files and subdirectories are named after the subsystems to which they interface. For instance, /proc/pci provides information on devices connected to the PCI bus, and /proc/asound delivers information on sound cards managed by ALSA. Some devices are complex enough that they merit entire subdirectory trees under/proc. You may find yourself digging into several layers of subdirectories to locate the information you want. There are also links within the /proc hierarchy. Some of the more important files and directories in the main /proc directory include:

The CPU The most obvious CPU information resides in cpuinfo, which holds information on the CPU's brand, model, speed in megahertz, and so on. The loadavg and stat files also hold information relevant to the CPU, in the form of CPU load averages and related statistics. The loadavg file presents this information in a form that's more intelligible to humans. The uptime command displays this information, as well.

Busses The bus directory holds subdirectories that interface to various system busses, such as the ISA (isapnp) and PCI (pci) busses. You'll also find an interface to information on USB devices (usb) here. The PCI and ISA busses also merit files in the base of /proc. These files deliver summary information on devices on their respective busses, whereas the bus/pci and bus/isapnp subdirectories deliver more detailed information on specific devices.

Interrupts, DMAs, and I/O Ports In order to be useable, hardware must be accessible to the CPU. To do so, a unique set of hardware addresses is assigned to each device. These addresses are known as interrupt requests (IRQs or interrupts), direct memory access (DMA) lines, and input/output (I/O) ports. You can learn which of these critical resources are in use and by what drivers by examining the interrupts, dma, and ioports files. There's also an irq subdirectory that can provide more detailed information on devices using specific IRQs, but this information is usually scarce.

Memory The meminfofile presents information on memory use, similar to that provided by the free command. The kcore file is essentially a window upon all of the system's memory; if you knew where to look, you could dredge any information from any running program by reading that file. The swaps file presents information on swap space usage, similar to that provided by typing swapon -s.

Warning The kcore file is unusually sensitive. It's set to be owned byoot with 0400 permissions (read-only for root, no access for others). Even root cannot change these settings. If an unauthorized individual were to gain access to this file, no information on the computer would be safe—passwords, sensitive data files, and more would all be open to view.

The Kernel and Modules The version file holds overview information on the kernel, including its version number, when it was compiled, and what compiler did the job. The cmdline file holds the kernel's boot parameters, as passed to the kernel from a boot loader. The modules file delivers information on modules that are loaded on the system. (This file does not present information on modules that are unloaded but available for manual or automatic loading.) The ksyms file presents kernel symbols—names given to kernel data structures and used to pass information back and forth between kernel subcomponents.

Network The net subdirectory holds files related to network statistics. Most of the information presented by these files is much more readily interpreted with the aid of network utilities such as netstat and ifconfig, as described in Chapter 19, "Basic Network Configuration."

Filesystems and Partitions The filesystems file presents a list of supported filesystems. Some of these filesystems are things you might not think of as such, such as pipefs. These filesystems are used internally by Linux to implement specific features. The fs subdirectory contains information on certain specific filesystems, should they be supported by your system, such as nfs and reiserfs. Not all filesystems create /proc/fs entries for themselves, though. The partitions file summarizes disk partitions. You can obtain the same information from the fdisk utility or its equivalent on non-IA-32 architectures, such as pdisk for Macintosh systems.

Disk Subsystems The ide and scsi subdirectories contain information on EIDE and SCSI devices, respectively. (One or the other subdirectory may be missing if you lack that interface type.) Both subdirectories contain entire subdirectory trees themselves, giving access to information on the EIDE controller or SCSI host adapter as well as specific hard disks and other devices, such as tape drives.

Sound Cards The ALSA drivers create a subdirectory called asound, which contains several files and subdirectories. These files provide information on the ALSA configuration and all of your system's sound cards.

Running Programs If you type Is Iproc, chances are that half or more of the entries you'll see will be numbered subdirectories. These contain files related to specific running processes; each is named after one process's process ID (PID) number. Some of the information provided by these files is accessible from the ps command and related commands, such as top.

Miscellaneous Information Various additional files relating to specific subsystems, such as Advanced Power Management (APM; apm), supported devices (devices), and ttys (files in the tty subdirectory), are also available in the /proc directory.

Note The /proc filesystem is generated by the kernel and its modules. As such, the layout of the /proc filesystem can change as you install and remove modules. The layout can differ from one system to another because of differences in hardware (say, the presence or absence of a SCSI host adapter) and because of differences in the kernel. Even given the same hardware, different kernels may produce different /proc filesystems.

Most of the files in /proc are reported as having a length of 0. Don't be deceived; most of these files actually contain data—or will generate it when accessed. One notable exception is/proc/kcore, whose length is equal to the amount of useable memory on your computer. This value is your installed memory minus a small amount (often 60KB, but sometimes more) reserved for I/O ports and the like.

Warning When you back up your computer, as described in Chapter 17, "Protecting Your System with Backups," be sure not to back up /proc! Backing up/proc will unnecessarily increase the size of your backup by something more than the amount of RAM you have installed. Even worse, a miscreant who obtains the backup might be able to extract information from the /proc/kcore backup file, or restoring over the working /proc filesystem could cause problems when settings are overwritten.

0 0

Post a comment