/proc, /sys & sysctl
The kernel as a filesystem you can read.
Linux exposes the kernel and running system as files, and understanding this "everything is a file" design is what lets you inspect and tune the system with ordinary tools. /proc is a virtual filesystem (nothing on disk) presenting live information about the kernel and every process; /sys presents kernel and device settings, many of them writable. Reading and writing these pseudo-files is how you observe and adjust the kernel without special APIs — the same cat and echo you already know.
$ cat /proc/cpuinfo | grep "model name" | head -1 # the CPU$ cat /proc/meminfo | head -3 # memory, in detail$ cat /proc/loadavg # load + running/total procs$ ls /proc/812/ # everything about PID 812:# cmdline, environ, fd/ (open files), status, limits, maps (memory), cwd, exe
Per-process ground truth
For any process, /proc/<pid>/ is the authoritative view that tools like ps and top merely summarize: cmdline is the exact command, environ its environment, fd/ every open file and socket, limits its resource ceilings, maps its memory layout, and status a rich summary. When you need to know precisely what a process is doing — which files it has open, what it was launched with, how much memory it maps — you read it straight from /proc rather than trusting a formatted tool. It is also why the security course could detect processes hiding from ps by reading /proc directly.
$ sudo cat /proc/812/limits | grep "open files" # this process’s fd ceilingMax open files 1024 4096 files$ sudo ls -l /proc/812/fd | wc -l # how many is it actually using?$ sudo cat /proc/812/status | grep -E "VmRSS|Threads" # real memory + thread count
sysctl: tuning via /proc/sys
The tunable kernel parameters live under /proc/sys, and sysctl is the friendly interface to them — the same mechanism the hardening course used, here for performance and behavior. You read a value, write one to change it live, and put it in /etc/sysctl.d/ to persist across reboots. Everything from network buffer sizes to how aggressively the kernel swaps (vm.swappiness) to file-handle limits is a sysctl. This is the kernel’s control panel, and it is just files.
$ sysctl vm.swappiness # read (how eager to swap: 0–100)vm.swappiness = 60$ sudo sysctl -w vm.swappiness=10 # change live (swap less; keep more in RAM)$ echo 'vm.swappiness = 10' | sudo tee /etc/sysctl.d/99-tuning.conf # persist$ sudo sysctl --system # apply all persisted settings now