A bit of internals with Uptime

As a system admin you already know that uptime command in Linux is a handy tool that gives users a snapshot of the system’s health by reporting how long the system has been running, how many users are logged in, and the system’s load averages. While the output seems straightforward, there’s more going on behind the scenes. But you ever wondered how works internally ? I looked at the source code that drives it, and that exercise was a good initiation for me, back then for understanding linux internals.

What Does the uptime Command Show? You may be sick of seeing already…

14:35:04 up 5 days, 3:42, 2 users, load average: 0.03, 0.05, 0.01

This output includes several pieces of information:

Current time (14:35:04): The system’s current time. Up time (up 5 days, 3:42): How long the system has been running since the last boot. Logged-in users (2 users): The number of users currently logged in. Load average (load average: 0.03, 0.05, 0.01): System load averages for the last 1, 5, and 15 minutes. Now let’s break down how Linux tracks and reports these values.

1. System Uptime: /proc/uptime The core piece of information in the uptime command is how long the system has been running. Linux tracks this information in a special file located at /proc/uptime.

The /proc/uptime File When you run uptime, it reads the system uptime from the /proc/uptime file. This file contains two numbers:

System uptime: The total time in seconds since the system was booted. Idle time: The amount of time that the system has been idle. For example, the contents of /proc/uptime might look like this:

1234567.89 987654.32

1234567.89 seconds: The system has been running for this long. 987654.32 seconds: The system has been idle for this long. The uptime command uses the first value to display the system uptime. Here’s how it’s done in C (source code of the uptime command):

FILE *fp = fopen("/proc/uptime", "r");
if (fp) {
    double uptime, idle_time;
    fscanf(fp, "%lf %lf", &uptime, &idle_time);
    fclose(fp);
    // Convert uptime to human-readable format
    printf("System Uptime: %.0f seconds\n", uptime);
}

In this example, fscanf is used to read the uptime and idle time values, which are then printed.

2. Load Averages: /proc/loadavg The system’s load averages, which show how heavily the system has been utilized over the past 1, 5, and 15 minutes, are stored in /proc/loadavg. The load averages are computed by the kernel and are a measure of the system’s workload.

The /proc/loadavg File The /proc/loadavg file contains a single line with the following format:

0.03 0.05 0.01 1/100 2000

0.03: The system’s load average for the last 1 minute. 0.05: The load average for the last 5 minutes. 0.01: The load average for the last 15 minutes. 1/100: The number of running processes (1) versus the total number of processes (100). 2000: The process ID (PID) of the last process that was executed. To read this information, uptime parses the /proc/loadavg file. Here’s an example of how this can be done in C:

FILE *fp = fopen("/proc/loadavg", "r");
if (fp) {
    float load1, load5, load15;
    int running, total;
    fscanf(fp, "%f %f %f %d/%d", &load1, &load5, &load15, &running, &total);
    fclose(fp);

    // Print load averages
    printf("Load averages: %.2f (1 min), %.2f (5 min), %.2f (15 min)\n", load1, load5, load15);
}

3. User Count: The who Command The uptime command also reports how many users are logged into the system. Internally, this is achieved by calling the who command, which lists all users currently logged in. uptime uses the who -q command to get the user count, which outputs the number of users.

For example, running who -q might return:

FILE *fp = popen("who -q", "r");
if (fp) {
    int user_count;
    fscanf(fp, "%d", &user_count);
    fclose(fp);

    // Print user count
    printf("Logged in users: %d\n", user_count);
}

4. Putting It All Together To summarize, the uptime command:

Reads the system uptime from /proc/uptime. Fetches the load averages from /proc/loadavg. Counts the number of logged-in users using who -q. The following C code snippet is a simplified version of how the uptime command works:

#include <stdio.h>
#include <stdlib.h>

int main() {
    FILE *fp;
    double uptime, idle_time;
    float load1, load5, load15;
    int running, total;

    // Get uptime and idle time
    fp = fopen("/proc/uptime", "r");
    if (fp) {
        fscanf(fp, "%lf %lf", &uptime, &idle_time);
        fclose(fp);
    }

    // Get load averages
    fp = fopen("/proc/loadavg", "r");
    if (fp) {
        fscanf(fp, "%f %f %f %d/%d", &load1, &load5, &load15, &running, &total);
        fclose(fp);
    }

    // Get user count
    fp = popen("who -q", "r");
    int user_count;
    if (fp) {
        fscanf(fp, "%d", &user_count);
        fclose(fp);
    }

    // Print the output
    printf("System Uptime: %.0f seconds\n", uptime);
    printf("Load averages: %.2f (1 min), %.2f (5 min), %.2f (15 min)\n", load1, load5, load15);
    printf("Logged in users: %d\n", user_count);

    return 0;
}

The uptime command, while simple, is the result of multiple internal mechanisms within Linux that provide system information. It reads key files in the /proc directory, executes external commands like who, and formats the data into an easily understandable output. Understanding how uptime works gives us insight into how Linux tracks system performance, load, and user activity.

Now you know what happens under the hood and understand the use of important files in /proc/