/proc

/proc

This directory which is found on unix operating systems should be noted that all files stored here are not physical files that take up disk space, but rather kernel data structures and other current runtime variables.

Programs suchs as uptime and free use these files to display current system statistics.

/proc/kcore

A file that is found on a unix machine that represents the current total physical memory plus a 4KB header in the format of a core file. Mainly used for with a debugger such as gdb to examine variables in the kernel.

Note: This is not a physical file that resides on disk, as all other files in the /proc directory.

There's a nice way to determine if a script kiddie has some evil processes running on your Unix box, using /proc. Most script kiddies will install some sort of rootkit that will modify some important binaries, such as "ps", to hide script kiddies processes. One could use following even if "ps" was changed, to see all processes on Linux:

cat /proc/*/stat |awk '{print $1,$2}' |less

On FreeBSD, one should use following:

cat /proc/*/status |awk '{print $1,$2}' |less