06-C.8: Kernel Module Monitoring

Last updated
Save as PDF

Page ID: 32799

\( \newcommand{\vecs}[1]{\overset { \scriptstyle \rightharpoonup} {\mathbf{#1}} } \) \( \newcommand{\vecd}[1]{\overset{-\!-\!\rightharpoonup}{\vphantom{a}\smash {#1}}} \)\(\newcommand{\id}{\mathrm{id}}\) \( \newcommand{\Span}{\mathrm{span}}\) \( \newcommand{\kernel}{\mathrm{null}\,}\) \( \newcommand{\range}{\mathrm{range}\,}\) \( \newcommand{\RealPart}{\mathrm{Re}}\) \( \newcommand{\ImaginaryPart}{\mathrm{Im}}\) \( \newcommand{\Argument}{\mathrm{Arg}}\) \( \newcommand{\norm}[1]{\| #1 \|}\) \( \newcommand{\inner}[2]{\langle #1, #2 \rangle}\) \( \newcommand{\Span}{\mathrm{span}}\) \(\newcommand{\id}{\mathrm{id}}\) \( \newcommand{\Span}{\mathrm{span}}\) \( \newcommand{\kernel}{\mathrm{null}\,}\) \( \newcommand{\range}{\mathrm{range}\,}\) \( \newcommand{\RealPart}{\mathrm{Re}}\) \( \newcommand{\ImaginaryPart}{\mathrm{Im}}\) \( \newcommand{\Argument}{\mathrm{Arg}}\) \( \newcommand{\norm}[1]{\| #1 \|}\) \( \newcommand{\inner}[2]{\langle #1, #2 \rangle}\) \( \newcommand{\Span}{\mathrm{span}}\)\(\newcommand{\AA}{\unicode[.8,0]{x212B}}\)

EXAM OBJECTIVES COVERED
1.2 Given a scenario, install, configure, and monitor kernel modules.
2.7 Explain the use and operation of Linux devices.

The /proc Directory

/proc is very special in that it is also a virtual filesystem. It's sometimes referred to as a process information pseudo-file system. It doesn't contain 'real' files but runtime system information (e.g., system memory, devices mounted, hardware configuration, etc). For this reason, it can be regarded as a control and information center for the kernel. In fact, quite a lot of system utilities are simply calls to files in this directory. For example, 'lsmod' is the same as 'cat /proc/modules' while 'lspci' is a synonym for 'cat /proc/pci'. By altering files located in this directory you can even read/change kernel parameters (sysctl) while the system is running.

The most distinctive thing about files in this directory is the fact that all of them have a file size of 0, with the exception of kcore, mtrr and self.

Directories	Contents
/proc/cmdline	Options passed to the kernel by the boot loader at boot time, such as mounting the kernel as read-only.
/proc/cpuinfo	Information about the processor, such as its type, make, model, and performance.
/proc/devices	List of device drivers configured into the currently running kernel.
/proc/filesystems	Filesystems configured into the kernel.
/proc/interrupts	Shows which interrupts are in use, and how many of each there have been.
/proc/ioports	Which I/O ports are in use at the moment.
/proc/meminfo	Information about memory usage, both physical and swap.
/proc/modules	Which kernel modules are loaded at the moment.
/proc/net	Status information about network protocols.
/proc/stat	Various statistics about the system, such as the number of page faults since the system was booted.
/proc/uptime	The length of time the kernel has been running since boot and spent in idle mode (both in seconds).

In Linux, you can also find the kernel information in the file /proc/version. Just look at the contents of this file:

pbmac@pbmac-server $ cat /proc/version
Linux version 4.15.0-91-generic (buildd@lgw01-amd64-013) (gcc version 7.4.0 (Ubuntu 7.4.0-1ubuntu1~18.04.1)) 
#92-Ubuntu SMP Fri Feb 28 11:09:48 UTC 2020

You’ll see an output similar to what you saw with uname. Remember what all the digits mean here? Here is an explanation:

4 – Kernel version
15 – Major revision
0 – Minor revision
91 – Bug fix
generic – Distribution-specific string. For Ubuntu, it means I’m using the desktop version. For Ubuntu server edition, it would be ‘server.’

There is other information in this output as well:

Linux – Kernel name. If you run the same command on BSD or MacOS, the result will be different.
4.15.0-91-generic – Kernel release (as we saw above).
buildd@lgw01-amd64-013 – Username who compiled the kernel.
7.4.0 – GCC version (GCC is the C compiler used to compile the kernel).
#92-Ubuntu SMP Fri Feb 28 11:09:48 UTC 2020 – This means that Ubuntu has compiled 4.15.0-91-generic 92 times. A timestamp for the last compilation is also there.

Adapted from:
"3 Ways to Check Linux Kernel Version in Command Line" by Abhishek Prakash, It's FOSS is licensed under CC BY-SA 4.0
"1.14. /proc" by Multiple contributors, The Linux Documentation Project is licensed under CC BY-SA 3.0
"3.7. The /proc filesystem" by Multiple contributors, The Linux Documentation Project is licensed under CC BY-SA 3.0