Decoding /proc

When I built my Telemetry Engine, I made a very deliberate architectural choice: I decided to build it specifically for Linux and bypass third-party libraries like psutil. Why? Because on Windows or macOS, there is no /proc directory. Cross-platform libraries like psutil are amazing, but they have to do a lot of heavy lifting under the hood to abstract away the differences between the Win32 API, macOS Mach kernel, and Linux.

Since my goal was to build a zero-dependency, ultra-lightweight monitor for Linux, I went straight to the source: the Linux kernel. The /proc directory is a pseudo-filesystem that acts as an interface to kernel data structures. It doesn't actually exist on your hard drive; it exists purely in memory. Reading from it is the fastest way to get system telemetry without spawning subprocesses or using external libraries.

But reading from it is an illusion. Here is how to decode the raw data and understand what the OS is actually doing.

1. The Linux Illusion of "Free" Memory

If you open Windows Task Manager, it tells you how much RAM is "In Use." Linux does the opposite. Linux believes that empty RAM is wasted RAM.

If you aren't using a block of memory, Linux will use it as a disk cache (called Buffers and Cached). It holds recently opened files there so the system feels instantly fast. If you open a heavy app, Linux instantly drops that cache and gives the RAM to your app.

Because of this, if you just read MemFree from /proc/meminfo, your system will look like it's using 95% of its RAM, even when it's completely idle. It's lying to you.

The Math (The Heuristic)

To find the actual available memory, you have to calculate it:

Available ≈ MemFree + Buffers + Cached + SReclaimable

About 10 years ago, the Linux kernel developers realized everyone was writing this exact formula. So, they built the math directly into the kernel and exposed it as MemAvailable. It is the kernel's official guess of how much RAM your apps can actually use without swapping to disk.

How to Parse it in Python

The /proc/meminfo file outputs a list of strings separated by colons. You can easily convert this into a Python dictionary to access keys directly like mem['MemFree']:

def get_memory_info():
    mem = {}
    with open('/proc/meminfo', 'r') as f:
        for line in f:
            parts = line.split(':')
            key = parts[0].strip()
            # Extract the number and ignore 'kB'
            val = int(parts[1].strip().split()[0])
            mem[key] = val

    free = mem['MemFree']
    total = mem['MemTotal']
    available = mem['MemAvailable']

    return free, total, available

2. The Anatomy of CPU Ticks

Reading /proc/stat is completely different. The first line usually looks like this:

cpu 759 0 1359 16661 195 0 216 0 0 0

The word cpu means this is the aggregate total for all your cores. The 10 numbers that follow are cumulative clock ticks. A "tick" is a tiny fraction of a second (usually 1/100th of a second, a "jiffy").

Here is what the columns mean:

• user: Time spent running normal user processes.
• nice: Time spent running user processes with altered priority.
• system: Time spent running kernel processes.
• idle: Time the CPU spent doing absolutely nothing.
• iowait: Time waiting for disk or network I/O to finish.
• irq / softirq: Time handling hardware/software interrupts.
• steal / guest: Time stolen by virtual machines.

The Math (Delta T)

You cannot look at the total ticks to find CPU usage. You have to take two snapshots and subtract them.

Total Ticks = The sum of all 10 numbers.
Active Ticks = Total Ticks - idle - iowait

Time passed = Total_Ticks(T2) - Total_Ticks(T1)
Work done = Active_Ticks(T2) - Active_Ticks(T1)

CPU % = (Work done / Time passed) * 100

How to Parse it in Python

To get these numbers, you read the first line, split by whitespace, and ignore the first word (`cpu`).

def get_cpu_ticks():
    with open('/proc/stat', 'r') as f:
        line = f.readline()

    parts = line.split()
    # parts[0] is 'cpu', we want the numbers after it
    ticks = [int(x) for x in parts[1:]]
    return ticks

# Example usage:
# t1 = get_cpu_ticks()
# time.sleep(1)
# t2 = get_cpu_ticks()
# print('Delta:', [t2[i] - t1[i] for i in range(len(t1))])