proc — process and system information pseudo-filesystem
The proc
filesystem is a pseudo-filesystem
which provides an interface to Cygwin data structures.
It is commonly mounted at /proc
.
Typically, it is mounted automatically by the system.
Underneath /proc
, there are the following
general groups of files and subdirectories:
/proc/[pid]
subdirectoriesEach one of these subdirectories contains files and subdirectories exposing information about the process with the corresponding process id.
The /proc/[pid]
subdirectories are
visible when iterating through /proc
with
readdir(2)
(and thus are visible when one uses
ls(1)
to view the contents of /proc
).
/proc/self
When a process accesses this magic symbolic link, it resolves
to the process's own /proc/[pid]
directory.
/proc/[a-z]*
Various other files and subdirectories under
/proc
expose system-wide information.
All of the above are described in more detail below.
The following list provides details of many of the files
and directories under the /proc
hierarchy.
/proc/[pid]
There is a numerical subdirectory for each running
process; the subdirectory is named by the process id.
Each /proc/[pid]
subdirectory
contains the pseudo-files and directories described below.
The files inside each /proc/[pid]
directory are normally owned by the effective user and
effective group id of the process.
/proc/[pid]/cmdline
This read-only file holds the complete command line for the process, unless the process is a zombie. In the latter case, there is nothing in this file: that is, a read on this file will return 0 characters. The command-line arguments appear in this file as a set of strings followed by null bytes ('\0').
/proc/[pid]/ctty
This read-only file holds the name of the console or control terminal device for the process, unless the process is detached from any terminal. In the latter case, there is only a newline in this file.
/proc/[pid]/cwd
This is a symbolic link to the current working directory of the process. To find out the current working directory of process 20, for instance, you can do this:
$
cd /proc/20/cwd; /bin/pwd
Note that the pwd command
is often a shell built-in, and might not work properly. In
bash(1),
you may use pwd -P
.
/proc/[pid]/environ
This read-only file contains the current environment that may have been changed by the currently executing program. The entries are separated by null bytes ('\0'), and there may be a null byte at the end. Thus, to print out the environment of process 1, you would do:
$
cat -A /proc/1/environ
If, after an execve(2), the process modifies its environment (e.g., by calling functions such as putenv(3) or modifying the environ(7) variable directly), this file will reflect those changes. That may not be the case on other systems such as Linux.
/proc/[pid]/exe
This file is a symbolic link containing the actual pathname of
the executed command.
This symbolic link can be dereferenced normally; attempting to
open it will open the executable.
You can even type /proc/[pid]/exe
to run another copy of the same executable that is being run by
process [pid].
/proc/[pid]/exe
is a pointer to
the binary which was executed, and appears as a symbolic link.
/proc/[pid]/exename
This read-only file contains the actual pathname of the executed command.
/proc/[pid]/fd/
This is a subdirectory containing one entry for each file which the process has open, named by its file descriptor, and which is a symbolic link to the actual file. Thus, 0 is standard input, 1 standard output, 2 standard error, and so on.
For file descriptors for pipes and sockets, the entries will
be symbolic links whose content is the file type with the
inode. A
readlink(2)
call on this file returns a string in the format:
type:[inode]
For example, socket:[2248868]
will be a socket and its inode is 2248868.
Programs that take a filename as a command-line argument, but
don't take input from standard input if no argument is supplied,
and programs that write to a file named as a command-line
argument, but don't send their output to standard output if no
argument is supplied, can nevertheless be made to use standard
input or standard output by using
/proc/[pid]/fd
files as command-line
arguments.
For example, assuming that -i
is the flag
designating an input file and -o
is the flag
designating an output file:
$
foobar -i /proc/self/fd/0 -o /proc/self/fd/1 ...
and you have a working filter.
/proc/self/fd/N
is approximately
the same as /dev/fd/N
in some Unix
and Unix-like systems.
Most Linux makedev scripts symbolically
link /dev/fd
to
/proc/self/fd
, in fact.
Most systems provide symbolic links
/dev/stdin
,
/dev/stdout
, and
/dev/stderr
, which respectively link
to the files 0
, 1
,
and 2
in /proc/self/fd
.
Thus the example command above could be written as:
$
foobar -i /dev/stdin -o /dev/stdout ...
Note that for file descriptors referring to inodes (pipes and
sockets, see above), those inodes still have permission bits and
ownership information distinct from those of the
/proc/[pid]/fd
entry, and that the
owner may differ from the user and group ids of the process.
An unprivileged process may lack permissions to open them, as in
this example:
$
echo test | sudo -u nobody cat
test
$
echo test | sudo -u nobody cat /proc/self/fd/0
cat: /proc/self/fd/0: Permission denied
File descriptor 0 refers to the pipe created by the shell and
owned by that shell's user, which is not
nobody
, so cat
does not have permission to create a new file descriptor to
read from that inode, even though it can still read from its
existing file descriptor 0.
/proc/[pid]/gid
This read-only file contains the primary group id for the process.
/proc/[pid]/maps
A file containing the currently mapped memory regions and their access permissions. See mmap(2) for some further information about memory mappings.
The format of the file is:
address perms offset dev inode pathname
00010000-00020000 rw-s 00000000 0000:0000 0 [win heap 1 default shared]
...
00080000-00082000 rw-p 00000000 0000:0000 0 [win heap 0 default grow]
00082000-0009A000 ===p 00002000 0000:0000 0 [win heap 0 default grow]
000A0000-000A1000 rw-p 00000000 0000:0000 0 [win heap 2 grow]
000A1000-000BA000 ===p 00001000 0000:0000 0 [win heap 2 grow]
000C0000-000D9000 rw-p 00000000 0000:0000 0 [win heap 0 default grow]
000D9000-001C0000 ===p 00019000 0000:0000 0 [win heap 0 default grow]
00200000-00377000 ===p 00000000 0000:0000 0
00377000-00378000 rw-p 00177000 0000:0000 0 [peb]
00378000-0037A000 rw-p 00178000 0000:0000 0 [teb (tid 8844)]
...
00400000-005F9000 ===p 00000000 0000:0000 0 [stack (tid 8884)]
005F9000-005FC000 rw-g 001F9000 0000:0000 0 [stack (tid 8884)]
005FC000-00600000 rw-p 001FC000 0000:0000 0 [stack (tid 8884)]
00600000-006C7000 r--s 00000000 EE45:4341 281474976741117 /proc/cygdrive/c/Windows/System32/locale.nls
...
100400000-100401000 r--p 00000000 EE45:4341 281474978095037 /usr/bin/sh.exe
100401000-100413000 r-xp 00001000 EE45:4341 281474978095037 /usr/bin/sh.exe
100413000-100414000 rw-p 00013000 EE45:4341 281474978095037 /usr/bin/sh.exe
...
180010000-180020000 rw-s 00000000 0000:0000 0 [procinfo]
180020000-180029000 rw-s 00000000 0000:0000 0 [cygwin-user-shared]
180030000-18003C000 rw-s 00000000 0000:0000 0 [cygwin-shared]
180040000-180041000 r--p 00000000 EE45:4341 2251799814294868 /usr/bin/cygwin1.dll
180041000-18022D000 r-xp 00001000 EE45:4341 2251799814294868 /usr/bin/cygwin1.dll
18022D000-180231000 rwxp 001ED000 EE45:4341 2251799814294868 /usr/bin/cygwin1.dll
180231000-18026A000 rw-p 001F1000 EE45:4341 2251799814294868 /usr/bin/cygwin1.dll
...
800000000-800090000 rw-p 00000000 0000:0000 0 [heap]
800090000-820000000 ===p 00090000 0000:0000 0 [heap]
7FF4FDEB0000-7FF4FDEB5000 r--s 00000000 0000:0000 0
7FF4FDEB5000-7FF4FDFB0000 ===s 00005000 0000:0000 0
7FF4FDFB0000-7FF5FDFD0000 ===p 00000000 0000:0000 0
...
7FFBEEAC0000-7FFBEEAC1000 r--p 00000000 EE45:4341 844424934724994 /proc/cygdrive/c/Windows/System32/kernel32.dll
7FFBEEAC1000-7FFBEEB36000 r-xp 00001000 EE45:4341 844424934724994 /proc/cygdrive/c/Windows/System32/kernel32.dll
7FFBEEB36000-7FFBEEB68000 r--p 00076000 EE45:4341 844424934724994 /proc/cygdrive/c/Windows/System32/kernel32.dll
7FFBEEB68000-7FFBEEB6A000 rw-p 000A8000 EE45:4341 844424934724994 /proc/cygdrive/c/Windows/System32/kernel32.dll
7FFBEEB6A000-7FFBEEB72000 r--p 000AA000 EE45:4341 844424934724994 /proc/cygdrive/c/Windows/System32/kernel32.dll
...
The address
field is the address
space in the process that the mapping occupies.
The perms
field is a set of permissions:
read
write
execute
reserved
shared
guard
private
The offset
field is the offset
into the file/whatever;
dev
is the device (major:minor);
inode
is the inode on that device.
0 indicates that no inode is associated with the memory
region, as would be the case with BSS (uninitialized data).
The pathname
field will usually
be the file that is backing the mapping.
There are additional helpful pseudo-paths:
cygwin-shared
]Global shared Cygwin process information.
cygwin-user-shared
]Global shared Cygwin user information.
peb
]Windows Process Environment Block.
procinfo
]Cygwin process information.
shared-user-data
]Shared user information.
heap
]The process's heap.
stack
]The initial process's (also known as the main thread's) stack.
stack
(tid <tid>
)]
A thread's stack (where the
<tid>
is a thread id).
teb
(tid <tid>
)]
Windows Thread Environment Block (where
<tid>
is a thread id).
win heap <n>
default shared exec grow noserial debug
]
Windows extended heap (where
<n>
is a heap id)
and the rest of the words are heap flags:
default
default heap flags
shared
shareable and mapped heap flags
exec
executable heap flag
grow
growable heap flag
noserial
do not serialize heap flag
debug
debugged heap flag
If the pathname
field is blank,
this is an anonymous mapping as obtained via
mmap(2).
There is no easy way to coordinate this back to a process's
source, short of running it through
gdb(1),
strace(1),
or similar.
pathname
is shown unescaped except
for newline characters, which are replaced with an
octal escape sequence.
As a result, it is not possible to determine whether the
original pathname
contained a newline
character or the literal \e012
character sequence.
If the mapping is file-backed and the file has been deleted,
the string " (deleted)
"
is appended to the pathname
.
Note that this is ambiguous too.
/proc/[pid]/mountinfo
This file contains information about mount points in the
process's mount namespace (see
mount_namespaces(7)).
It supplies various information (e.g., propagation state, root
of mount for bind mounts, identifier for each mount and its
parent) that is missing from the (older)
/proc/[pid]/mounts
file, and fixes various other problems with that file (e.g.,
nonextensibility, failure to distinguish per-mount versus
per-superblock options).
The file contains lines of the form:
36 35 98:0 /mnt1 /mnt2 rw,noatime master:1 - ext3 /dev/root rw,errors=continue
(1)(2)(3) (4) (5) (6) (?) (7) (8) (9) (10)
The numbers in parentheses are labels for the descriptions below:
mount id: a unique id for the mount (may be reused after umount(2)).
parent id: the id of the parent mount (or of self for the root of this mount namespace's mount tree).
major:
minor:
the value of st_dev
for files on this filesystem (see
stat(2)).
root: the pathname of the directory in the filesystem which forms the root of this mount.
mount point: the pathname of the mount point relative to the process's root directory.
mount options: per-mount options (see mount(2)).
optional fields: zero or more fields of the form
"tag[:
value]
";
see below.
separator: the end of the optional fields is marked by a single hyphen.
filesystem type: the filesystem type in the form
"type[.
subtype]
".
mount source: filesystem-specific information or
"none
".
super options: per-superblock options (see mount(2)).
/proc/[pid]/mounts
This file lists all the filesystems currently mounted in the process's mount namespace (see mount_namespaces(7)). The format of this file is documented in fstab(5).
/proc/[pid]/pgid
This read-only file contains the process group id for the process.
/proc/[pid]/ppid
This read-only file contains the parent process id for the process.
/proc/[pid]/root
UNIX and Linux support the idea of a per-process root of the
filesystem, set by the
chroot(2) system call.
This file is a symbolic link that points to the process's root
directory, and behaves in the same way as
exe
, and
fd/*
.
/proc/[pid]/sid
This read-only file contains the session id for the process.
/proc/[pid]/stat
Status information about the process. This is used by some implementations of ps(1).
The fields, in order, with their proper scanf(3) format specifiers, are listed below.
The process id.
The filename of the executable, in parentheses. This is visible whether or not the executable is swapped out.
One of the following characters, indicating process state:
Runnable
Running
Sleeping in an interruptible wait
Waiting in uninterruptible disk sleep
Zombie
Stopped (on a signal) or trace stopped
The PID of the parent of this process.
The process group id of the process.
The session id of the process.
The controlling terminal of the process. (The minor device number is contained in the combination of bits 31 to 20 and 7 to 0; the major device number is in bits 15 to 8.)
The id of the foreground process group of the controlling terminal of the process.
The kernel flags word of the process.
The number of minor faults the process has made which have not required loading a memory page from disk.
The number of minor faults that the process's waited-for children have made.
The number of major faults the process has made which have required loading a memory page from disk.
The number of major faults that the process's waited-for children have made.
Amount of time that this process has been scheduled in
user mode, measured in clock ticks (divide by
sysconf(_SC_CLK_TCK)
).
Amount of time that this process has been scheduled in
kernel mode, measured in clock ticks (divide by
sysconf(_SC_CLK_TCK)
).
Amount of time that this process's waited-for children
have been scheduled in user mode, measured in clock ticks
(divide by sysconf(_SC_CLK_TCK)
).
(See also
times(2)).
Amount of time that this process's waited-for children
have been scheduled in kernel mode, measured in clock
ticks (divide by sysconf(_SC_CLK_TCK)
).
For processes running a real-time scheduling policy (policy below; see sched_setscheduler(2)), this is the negated scheduling priority, minus one; that is, a number in the range -2 to -100, corresponding to real-time priorities 1 to 99. For processes running under a non-real-time scheduling policy, this is the raw nice value (setpriority(2)) as represented in the kernel. The kernel stores nice values as numbers in the range 0 (high) to 39 (low), corresponding to the user-visible nice range of -20 to 19.
The nice value (see setpriority(2)), a value in the range 19 (low priority) to -20 (high priority).
Number of threads in this process. Currently shown as 0.
The time in jiffies before the next
SIGALRM
is sent to the process due to an interval timer.
This field is no longer maintained, and is hard coded as 0.
The time the process started after system boot.
The value is expressed in clock ticks (divide by
sysconf(_SC_CLK_TCK)
).
Virtual memory size in bytes.
Resident Set Size: number of pages the process has in real memory. This is just the pages which count toward text, data, or stack space. This does not include pages which have not been demand-loaded in, or which are swapped out.
Current soft limit in bytes on the rss of the process; see
the description of RLIMIT_RSS
in
getrlimit(2).
/proc/[pid]/statm
Provides information about memory usage, measured in pages. The columns are:
total program size
(same as VmSize in /proc/[pid]/status
)
resident set size
(same as VmRSS in /proc/[pid]/status
)
number of resident shared pages
(i.e., backed by a file) (same as RssFile+RssShmem in
/proc/[pid]/status
)
text (code)
library
data + stack
dirty pages (always 0)
/proc/[pid]/status
Provides much of the information in
/proc/[pid]/stat
and
/proc/[pid]/statm
in a format that's easier for humans to parse.
Here's an example:
$
cat /proc/$$/status
Name: bash Umask: 0022 State: S (sleeping) Tgid: 17248 Pid: 17248 PPid: 17200 Uid: 1000 1000 1000 1000 Gid: 100 100 100 100 VmSize: 131168 kB VmLck: 0 kB VmRSS: 13484 kB VmData: 10332 kB VmStk: 136 kB VmExe: 992 kB VmLib: 2104 kB SigPnd: 0000000000000000 SigBlk: 0000000000010000 SigIgn: 0000000000384004
The fields are as follows:
Name: Command run by this process.
Umask: Process umask, expressed in octal with a leading zero; see umask(2).
State: Current state of the process. One of:
runnable
running
sleeping
disk sleep
stopped or tracing stop
zombie
Tgid: Thread group id (i.e., Process id).
Pid: Thread id (see gettid(2)).
PPid: PID of parent process.
Uid, Gid: Real, effective, saved set, and filesystem UIDs (GIDs).
VmSize: Virtual memory size.
VmLck: Locked memory size (see mlock(2)).
VmRSS: Resident set size.
VmData, VmStk, VmExe: Size of data, stack, and text segments.
VmLib: Shared library code size.
SigPnd: Number of signals pending for process as a whole (see pthreads(7) and signal(7)).
SigBlk, SigIgn: Masks indicating signals being blocked and ignored (see signal(7)).
/proc/[pid]/uid
This read-only file contains the user id for the process.
/proc/[pid]/winexename
This read-only file contains the Windows pathname of the executed command.
/proc/[pid]/winpid
This read-only file contains the Windows process id for the process.
/proc/cpuinfo
This is a collection of CPU and system architecture dependent items, for each supported architecture a different list. Two common entries are processor which gives CPU number and bogomips, a system constant that is calculated during kernel initialization. SMP machines have information for each CPU. The lscpu(1) command gathers its information from this file.
/proc/cygdrive
This file is a symbolic link that points to the user's Windows mapped drive mount point, similar to root.
/proc/devices
Text listing of major numbers and device groups. This can be used by makedev scripts for consistency with the system.
/proc/filesystems
A text listing of the filesystems which are supported by Cygwin. (See also filesystems(5).) If a filesystem is marked with "nodev", this means that it does not require a block device to be mounted (e.g., virtual filesystem, network filesystem).
/proc/loadavg
The first three fields in this file are load average figures giving the number of jobs in the run queue (state R) averaged over 1, 5, and 15 minutes. They are the same as the load average numbers given by uptime(1) and other programs. The fourth field consists of two numbers separated by a slash (/). The first of these is the number of currently runnable scheduling entities (processes, threads). The value after the slash is the number of scheduling entities that currently exist on the system.
/proc/meminfo
This file reports statistics about memory usage on the system. It is used by free(1) to report the amount of free and used memory (both physical and swap) on the system as well as the shared memory and buffers used by the system. Each line of the file consists of a parameter name, followed by a colon, the value of the parameter, and an option unit of measurement (e.g., "kB"). The list below describes the parameter names and the format specifier required to read the field value. Some fields are displayed only if the system was configured with various options; those dependencies are noted in the list.
Total usable RAM (i.e., physical RAM minus a few reserved bits and the system binary code).
The sum of LowFree + HighFree.
Total amount of highmem.
Amount of free highmem.
Total amount of lowmem. Lowmem is memory which can be used for everything that highmem can be used for, but it is also available for the system's use for its own data structures. Bad things happen when you're out of lowmem.
Amount of free lowmem.
Total amount of swap space available.
Amount of swap space that is currently unused.
/proc/misc
Text listing of minor device numbers and names of devices with
major device number of the misc
device group.
This can be used by makedev scripts
for consistency with the system.
/proc/mounts
With the introduction of per-process mount namespaces, this file
became a link to
/proc/self/mounts
,
which lists the mount points of the process's own mount
namespace.
The format of this file is documented in
fstab(5).
/proc/net
This directory contains various files and subdirectories containing information about the networking layer. The files contain ASCII structures and are, therefore, readable with cat(1). However, the standard netstat(8) suite provides much cleaner access to these files.
/proc/net/if_inet6
This file contains information about IP V6 interface adapters, if used. Each line represents an IP V6 interface adapter.
fe800000000000002c393d3da6108636 12 40 20 80 {C6B5FBE5-A3AC-4DB0-A308-8EE94E1406A4}
fe8000000000000039da016f76bd92bc 13 40 20 20 {E06B8972-0918-41FC-851B-090C446C7D1C}
fe8000000000000050ba9cedf1fe1628 0b 40 20 20 {680ED6FD-DFAC-4398-AA85-FB33E17E38EA}
fe8000000000000030c5c6a0b30f109d 11 40 20 20 {B9E39F53-1659-4065-BDA5-F41162250E03}
20021840ac2c12343427e3b9ec6fa585 08 40 00 80 {4083A7F8-99CF-4220-8715-6FDF268B002F}
20021840ac2c12342403e3b2c7a5a32f 08 80 00 20 {4083A7F8-99CF-4220-8715-6FDF268B002F}
20021840ac2c1234284e8d0ecb4160cb 08 80 00 20 {4083A7F8-99CF-4220-8715-6FDF268B002F}
20021840ac2c123468cb06ea72f1d678 08 80 00 80 {4083A7F8-99CF-4220-8715-6FDF268B002F}
20021840ac2c12346cb59aca97c36e3b 08 80 00 20 {4083A7F8-99CF-4220-8715-6FDF268B002F}
20021840ac2c123498af9881de1fb828 08 80 00 20 {4083A7F8-99CF-4220-8715-6FDF268B002F}
20021840ac2c1234cd62a3d73a498611 08 80 00 20 {4083A7F8-99CF-4220-8715-6FDF268B002F}
20021840ac2c1234e410c873be09df93 08 80 00 20 {4083A7F8-99CF-4220-8715-6FDF268B002F}
fe800000000000003427e3b9ec6fa585 08 40 20 80 {4083A7F8-99CF-4220-8715-6FDF268B002F}
00000000000000000000000000000001 01 80 10 80 {2B5345AC-7502-11EA-AC73-806E6F6E6963}
(1) (2)(3)(4)(5) (6)
The fields in each line are:
The IP V6 address of the interface adapter.
The IP V6 interface adapter index.
The prefix length of the IP V6 interface address.
The scope of the IP V6 interface address.
The state of the IP V6 interface address.
The DUID/GUID/UUID of the IP V6 interface adapter.
The last number exists only for compatibility reasons and is always 1.
/proc/partitions
Contains the major and minor numbers of each partition as well as the number of 1024-byte blocks and the partition name.
/proc/registry
Under Cygwin, this directory contains subdirectories for registry paths, keys, and subkeys, and files named for registry values which contain registry data, for the current process.
/proc/registry32
Under 64 bit Windows, this directory contains subdirectories for registry paths, keys, and subkeys, and files named for registry values which contain registry data, for 32 bit processes.
/proc/registry64
Under 64 bit Windows, this directory contains subdirectories for registry paths, keys, and subkeys, and files named for registry values which contain registry data, for 64 bit processes.
/proc/self
This directory refers to the process accessing the
/proc
filesystem, and is identical to the
/proc
directory named by the process id
of the same process.
/proc/stat
system statistics. Varies with architecture. Common entries include:
The amount of time, measured in units of USER_HZ
(1/100ths of a second on most architectures, use
sysconf(_SC_CLK_TCK)
to obtain the right value), that the system ("cpu"
line) or the specific CPU
("cpu N" line)
spent in various states:
Time spent in user mode.
Time spent in user mode with low priority (nice).
Time spent in system mode.
Time spent in the idle task.
The number of pages the system paged in and the number that were paged out (from disk).
The number of swap pages that have been brought in and out.
The number of interrupts serviced.
The number of context switches that the system underwent.
boot time, in seconds since the Epoch, 1970-01-01 00:00:00 +0000 (UTC).
/proc/swaps
Swap areas in use. See also swapon(8).
/proc/sys
This directory contains a number of files and subdirectories linking to Windows objects, which can be read using these entries.
String values may be terminated by either '\0' or '\n'.
Integer and long values may be either in decimal or in hexadecimal notation (e.g. 0x3FFF). Multiple integer or long values may be separated by any of the following whitespace characters: ' ', '\t', or '\n'.
/proc/sysvipc
Subdirectory containing the pseudo-files
msg
, sem
and
shm
.
These files list the System V Interprocess Communication (IPC)
objects (respectively: message queues, semaphores, and shared
memory) that currently exist on the system, providing similar
information to that available via
ipcs(1).
These files are only available if the cygserver Cygwin service
is running.
These files have headers and are formatted (one IPC object per
line) for easy understanding.
svipc(7)
provides further background on the information shown by these
files.
/proc/uptime
This file contains two numbers (values in seconds): the uptime of the system (including time spent in suspend) and the amount of time spent in the idle process.
/proc/version
This string identifies the Cygwin version that is currently running. For example:
CYGWIN_NT-10.0-18363 version 3.1.7-340.x86_64 (corinna@calimero) (gcc version 9.3.0 20200312 (Fedora Cygwin 9.3.0-1) (GCC) ) 2020-08-22 17:48 UTC
Many files contain strings (e.g., the environment and command line) that are in the internal format, with subfields terminated by null bytes ('\0'). When inspecting such files, you may find that the results are more readable if you use a command of the following form to display them:
$
cat -A file
This manual page is incomplete, possibly inaccurate, and is the kind of thing that needs to be updated very often.