The Filesystem That Isn't a Filesystem
/proc is a virtual filesystem — it has no files on disk. It is a window the Linux kernel exposes into its own internal state. Every number you see in top, ps, free, and vmstat is ultimately read from /proc. Going directly to /proc lets you access information that high-level tools sometimes obscure or aggregate away.
In a debugging interview, knowing /proc paths signals senior-level Linux fluency. It shows you understand where the data comes from, not just which tool displays it.
The Most Useful /proc Paths
Several /proc/<PID> entries expose kernel-level ground truth about a running process. The wchan ("wait channel") entry names the exact kernel function the process is sleeping in — a futex wait means it's deadlocked on a mutex, a tcp_recvmsg wait means it's blocked on network data, a do_sys_open wait means it's stuck opening a file. The fd directory lists every open file descriptor — stdin, stdout, stderr, plus whatever files, sockets, and pipes the process opened itself. The net/tcp entry lists the process's raw TCP connections. The environ entry exposes the exact environment variables the process was started with — invaluable for confirming that the right database URL or API key actually reached the running process rather than trusting the deploy config. And maps shows the full memory map of loaded libraries and files.
A Practical Example: Verifying Environment Variables
A common production bug is an application connecting to the wrong database because an environment variable was set incorrectly at deploy time. Reading that process's environ entry directly — without restarting it — reveals exactly what value it's actually running with, which can differ from what the deploy configuration claims.