Frequently Asked Question

What's inside /proc/<PID>/ and what is each file for?

/proc/<PID>/ is the kernel's live view of a single process, synthesised on demand every time you read it. cmdline is the program's argv, NUL-separated; exe is a symlink to the binary on disk; cwd to its current working directory; root to its filesystem root; environ to its environment variables (also NUL-separated). status is a human-readable summary, state letter, PPID, UIDs, memory totals, threads. stat is the same data in machine-readable form, which ps and top parse.

maps lists every memory region the process has mapped, including stack, heap, shared libraries, and memory-mapped files. fd/ contains one symlink per open file descriptor, named 0, 1, 2, …, pointing at the file, pipe, socket, or device behind it, which is how lsof knows what every process has open. task/<TID>/ repeats the whole structure once per thread of the process. Almost every tool that "looks at a process" is really just formatting these files.