Learn to read the kernel's live view in /sys and use it for fast troubleshooting and discovery. 03.02.2026 | reading time: 3 min The /sys hierarchy is the kernel's live, structured view of devices, drivers and kernel subsystems; reading it reveals state, writing to some attributes triggers behavior. This short guide shows concrete commands to explore /sys and what those files mean for troubleshooting and automation. Inspect a live system Try these commands to discover what the kernel is exposing on your host and to read a few stable attributes: ``` $ ls /sys/class/net lo eth0 wlp2s0 $ cat /sys/devices/system/cpu/online 0-3 $ cat /sys/class/net/lo/operstate unknown ``` Outputs will vary by machine, but `ls /sys/class/net` reliably lists network devices and `cat /sys/devices/system/cpu/online` shows which CPUs the kernel considers online. Read, write and observe Files in /sys present attributes with simple semantics: read-only, write-only or read-write; a write often needs root and sends data straight to the kernel, so use `sudo` and care. Use `find /sys -type f -perm -200 -maxdepth 3` to locate writable attributes, monitor changes with `inotifywait` or poll with simple scripts, and map a sysfs node back to udev and driver info with `udevadm info --attribute-walk`. Mapping sysfs to userspace When you find an interesting attribute, follow its symlinks to the device tree in /sys/devices to learn the physical path and driver; inspect uevent files for device metadata and use `grep` and `find` to trace relationships across the kobject hierarchy. Remember: sysfs mirrors kernel objects, so source code and driver docs are the authoritative explanation if you need to act on unusual attributes. Practical cautions Never write blindly: some attributes accept only specific values and can change hardware state or disable features; test reads first, consult kernel docs or the attribute's owner in /sys/bus/*/devices, and use version control for scripts that modify sysfs to avoid accidental regressions. Where to go from here Explore more nodes on a live system, write safe scripts to collect state, and combine sysfs reads with udev rules or systemd services for automation; deepen kernel and tooling knowledge and consider formal certification to make these skills portable, for example CompTIA Linux+ or LPIC-1 with intensive preparation at bitsandbytes.academy. Join Bits & Bytes Academy First class LINUX exam preparation. filesystem utilities scripting troubleshooting processes
