Kernel parameters, modules, and runtime information
Once running, the kernel can be inspected and tuned. Its parameters, modules, and virtual file systems reveal and control how the system behaves.
Kernel command line
Parameters passed by the boot loader shape the kernel's behaviour: root= names the root file system, quiet reduces boot messages, ro mounts root read-only at first, and options such as mitigations= or nomodeset adjust security or graphics behaviour. The current command line can be read from /proc/cmdline; permanent changes are made in the boot loader configuration.
Kernel versions
Kernel versions have the form major.minor.patch, such as 6.8.12. Mainline releases arrive every nine to ten weeks; stable releases fix bugs; and long-term support (LTS) kernels receive fixes for several years. Distributions often ship their own patched kernels, so their version numbers include extra suffixes.
Loadable modules
Much kernel functionality, especially device drivers and file systems, is built as loadable modules (.ko files) under /lib/modules/<version>/. lsmod lists loaded modules; modinfo describes one; modprobe loads a module together with its dependencies, and modprobe -r removes it. Configuration files in /etc/modprobe.d/ can set module options or block modules from loading.
The /proc file system
/proc is a virtual file system generated by the kernel. Each running process has a directory /proc/<PID> showing its command line, status, memory maps, and open files. System-wide files include /proc/cpuinfo, /proc/meminfo, /proc/loadavg, and /proc/mounts. Reading them is how tools such as ps, top, and free gather information.
The /sys file system
/sys, the sysfs file system, presents the kernel's model of devices, drivers, buses, and kernel objects as a directory tree. It shows, for example, network interfaces under /sys/class/net/ and block devices under /sys/block/, along with attributes that can sometimes be written to change settings, such as a disk's I/O scheduler or an LED's brightness.
sysctl
Many tunable kernel parameters live under /proc/sys/ and are managed with sysctl. sysctl net.ipv4.ip_forward shows whether the machine forwards IPv4 packets; sysctl -w net.ipv4.ip_forward=1 enables it until reboot; files in /etc/sysctl.d/ make settings persistent. Common tunables include network buffer sizes, virtual memory behaviour such as vm.swappiness, and security options.
Kernel logs and crashes
The kernel writes messages to a ring buffer, read with dmesg or journalctl -k. Messages reveal hardware detection, driver errors, out-of-memory kills, and file-system problems. A kernel panic is an unrecoverable error that halts the system; an oops is a serious but sometimes survivable error. Tools such as kdump capture crash dumps for later analysis.
Worked example
A Wi-Fi card stops working after an update. lsmod | grep iwlwifi shows whether its driver module is loaded; dmesg | grep iwlwifi reveals an error loading firmware. Checking modinfo iwlwifi lists the firmware files it expects; installing the matching firmware package and running modprobe -r iwlwifi && modprobe iwlwifi reloads the driver without rebooting.
Key takeaways
The boot loader passes kernel parameters such as root=, ro, and quiet, readable in /proc/cmdline. Kernel versions are major.minor.patch, with mainline, stable, and long-term support series. Drivers and file systems often load as modules managed by lsmod, modinfo, and modprobe, configured in /etc/modprobe.d/. /proc exposes processes and system information; /sys exposes devices and drivers. sysctl reads and sets tunables under /proc/sys/, made persistent in /etc/sysctl.d/. dmesg and journalctl -k show kernel logs; panics halt the system, and kdump captures crash dumps.
Flashcard
Current kernel command line
Check your understanding
You enable IP forwarding with sysctl -w net.ipv4.ip_forward=1, but it is off again after reboot. How do you make it permanent?