Deep System Discovery on your Linux Server With /proc - page 2
So we've looked at process information, but proc also deals with system information. This is dealt with in the files and directories in /proc that have real names rather than numbers.
uptime and version give you, unsurprisingly, uptime and version info (this is where the uname command gets its information from). /proc/cmdline tells you what options were passed to the kernel at boot time, e.g.:
auto BOOT_IMAGE=Linux ro root=302 hdc=ide-scsiYou can check your LILO or GRUB config to find out which boot image this is. It was mounted read-only (as normal). root=302 means that the root partition is the '3 major, 2 minor' device. Now, take a look at the partitions file, which lists devices by major and minor number:
major minor #blocks name 3 0 39082680 hda 3 1 9767488 hda1 3 2 14651280 hda2 3 3 14161297 hda3 3 4 498015 hda4So the root partition is hda2 (you can also get this information from df). The final option in /proc/cmdlinetells the kernel to treat my DVD drive (at hdc) as IDE-SCSI.
The acpi/ directory contains ACPI (Advanced Configuration and Power Interface) information. The details of this directory will depend on your hardware, but here's a couple of interesting files:
- acpi/thermal_zone/ may contain information from the internal temperature sensors if that's supported.
- apm looks at APM information if your system has that enabled. apm -v gets its information here, and it's useful for checking your battery status from console.
locks displays the files currently locked by the system. Here's a few sample lines:
1: FLOCK ADVISORY WRITE 4056 03:02:588739 0 EOF 2: FLOCK ADVISORY WRITE 2747 03:02:596797 0 EOF 3: POSIX ADVISORY READ 2507 03:02:572375 4 4FLOCK locks result from an flock system call; POSIX locks from a newer lockf system call. ADVISORY locks (unlike MANDATORY ones) allow other processes to read but not to lock the data; and you are also shown whether the lock is for read or write access. Column 5 shows the process ID which owns the lock, and column 6 is the file ID, written as major-device:minor-device:inode. The final columns show the start and end of the locked region: so in the first 4 lines that's the whole file (0 to end of file). This information is most likely to be useful if you're trying to retrieve deleted files by inode number. Or you can check out which file is which with find / -inum INODE_NUM (warning: may take some time!).
/proc/filesystems lists the filesystems available on your system, and marks them with nodev if they're virtual or networked. This is useful if you're trying to connect external or networked disks, to tell you if you'll have to recompile the kernel.
kcore is more memory information, but while it's useful to debuggers like gdb, it's not at all human-parseable. /proc/kmsg deals with kernel messages. net/ provides the raw info for various networking information commands, such as route. It's usually easier to get the data from the relevant commands: technically these files are human-readable but there's largely just a lot of numbers in there! Column headings are provided if you do want to look.
Finding more information
Unfortunately the proc documentation is sometimes a little lacking. Start with the man page; you may also be able to find some information in /usr/src/linux/Documentation/, or at http://www.kernel.org. Alternatively, go take a look through /proc and then Google for whatever file or directory names you find. Come back next month to learn more right here!
- 1Linux Top 3: Alpine Linux 3.4, deepin 15.2 and Linux Lite 3.0
- 2Linux 4.7 Set to Boost Live Patching, Security and Power Management
- 3Linux 4.6 Charred Weasel adds USB 3.1 Support
- 4Linux Top 3: OpenIndiana 2016.04, Ubuntu 16.04 and Debian's New Leader
- 5Linux Top 3: KaOS 2016.04, TurnKey 14.1 and pfSense 2.3