Process Directories

Every /proc/ directory contains a number of directories with numerical names. A listing of them may be similar to the following:

dr-xr-xr-x    3 root     root            0 Feb 13 01:28 1
dr-xr-xr-x    3 root     root            0 Feb 13 01:28 1010
dr-xr-xr-x    3 xfs      xfs             0 Feb 13 01:28 1087
dr-xr-xr-x    3 daemon   daemon          0 Feb 13 01:28 1123
dr-xr-xr-x    3 root     root            0 Feb 13 01:28 11307
dr-xr-xr-x    3 apache   apache          0 Feb 13 01:28 13660
dr-xr-xr-x    3 rpc      rpc             0 Feb 13 01:28 637
dr-xr-xr-x    3 rpcuser  rpcuser         0 Feb 13 01:28 666

These directories are called process directories, as they are named after a program's process ID and contain information specific to that process. The owner and group of each process directory is set to the user running the process. When the process is terminated, its /proc/ process directory vanishes.

Each process directory contains the following files:

• cmdline - Contains the command issued when starting the process.

• cwd - A symbolic link to the current working directory for the process.
• environ - A list of the environment variables for the process. The environment variable is given in all upper-case characters, and the value is in lower-case characters.
• exe - A symbolic link to the executable of this process.
• fd - A directory containing all of the file descriptors for a particular process. These are given in numbered links:

  total 0
  lrwx------    1 root     root           64 May  8 11:31 0 -> /dev/null
  lrwx------    1 root     root           64 May  8 11:31 1 -> /dev/null
  lrwx------    1 root     root           64 May  8 11:31 2 -> /dev/null
  lrwx------    1 root     root           64 May  8 11:31 3 -> /dev/ptmx
  lrwx------    1 root     root           64 May  8 11:31 4 -> socket:[7774817]
  lrwx------    1 root     root           64 May  8 11:31 5 -> /dev/ptmx
  lrwx------    1 root     root           64 May  8 11:31 6 -> socket:[7774829]
  lrwx------    1 root     root           64 May  8 11:31 7 -> /dev/ptmx

• maps - A list of memory maps to the various executables and library files associated with this process. This file can be rather long, depending upon the complexity of the process, but sample output from the sshd process begins like the following:

  08048000-08086000 r-xp 00000000 03:03 391479     /usr/sbin/sshd
  08086000-08088000 rw-p 0003e000 03:03 391479 /usr/sbin/sshd
  08088000-08095000 rwxp 00000000 00:00 0
  40000000-40013000 r-xp 0000000 03:03 293205 /lib/ld-2.2.5.so
  40013000-40014000 rw-p 00013000 03:03 293205 /lib/ld-2.2.5.so
  40031000-40038000 r-xp 00000000 03:03 293282 /lib/libpam.so.0.75
  40038000-40039000 rw-p 00006000 03:03 293282 /lib/libpam.so.0.75
  40039000-4003a000 rw-p 00000000 00:00 0
  4003a000-4003c000 r-xp 00000000 03:03 293218 /lib/libdl-2.2.5.so
  4003c000-4003d000 rw-p 00001000 03:03 293218 /lib/libdl-2.2.5.so

• mem - The memory held by the process. This file cannot be read by the user.
• root - A link to the root directory of the process.
• stat - The status of the process.
• statm - The status of the memory in use by the process. Below is a sample /proc/statm file:

  210 210 5 0 205 0

  The seven columns relate to different memory statistics for the process. From left to right, they report the following aspects of the memory used:

  1. Total program size, in kilobytes.
• Size of memory portions, in kilobytes.
• Number of pages that are shared.
• Number of pages that are code.
• Number of pages of data/stack.
• Number of library pages.
• Number of dirty pages.
• status - The status of the process in a more readable form than stat or statm. Sample output for sshd looks similar to the following:

  Name: sshd
  State: S (sleeping)
  Tgid: 797
  Pid: 797
  PPid: 1
  TracerPid: 0
  Uid: 0 0 0 0
  Gid: 0 0 0 0
  FDSize: 32
  Groups:
  VmSize:     3072 kB
  VmLck:        0 kB
  VmRSS:      840 kB
  VmData:      104 kB
  VmStk:       12 kB
  VmExe:      300 kB
  VmLib:     2528 kB
  SigPnd: 0000000000000000
  SigBlk: 0000000000000000
  SigIgn: 8000000000001000
  SigCgt: 0000000000014005
  CapInh: 0000000000000000
  CapPrm: 00000000fffffeff
  CapEff: 00000000fffffeff

  The information in this output includes the process name and ID, the state (such as S (sleeping) or R (running)), user/group ID running the process, and detailed data regarding memory usage.