Linux: is it possible to see only kernel space threads/process?
Clash Royale CLAN TAG#URR8PPP
up vote
25
down vote
favorite
7
I know there are two "levels" of programs: User space and kernel space.
My question is: I want to see only kernel programs,or better: programs on kernel space.
Is this approach correct?
ps -ef|grep "["
root 1 0 0 20:23 ? 00:00:00 init [4]
root 2 0 0 20:23 ? 00:00:00 [kthreadd]
root 3 2 0 20:23 ? 00:00:00 [ksoftirqd/0]
root 5 2 0 20:23 ? 00:00:00 [kworker/0:0H]
root 7 2 0 20:23 ? 00:00:06 [rcu_sched]
root 8 2 0 20:23 ? 00:00:00 [rcu_bh]
root 9 2 0 20:23 ? 00:00:00 [migration/0]
root 10 2 0 20:23 ? 00:00:00 [migration/1]
root 11 2 0 20:23 ? 00:00:00 [ksoftirqd/1]
root 13 2 0 20:23 ? 00:00:00 [kworker/1:0H]
root 14 2 0 20:23 ? 00:00:00 [migration/2]
....
linux-kernel process
asked Dec 15 '17 at 22:23
elbarna
3,81893577
add a comment |Â
up vote
25
down vote
favorite
7
I know there are two "levels" of programs: User space and kernel space.
My question is: I want to see only kernel programs,or better: programs on kernel space.
Is this approach correct?
ps -ef|grep "["
root 1 0 0 20:23 ? 00:00:00 init [4]
root 2 0 0 20:23 ? 00:00:00 [kthreadd]
root 3 2 0 20:23 ? 00:00:00 [ksoftirqd/0]
root 5 2 0 20:23 ? 00:00:00 [kworker/0:0H]
root 7 2 0 20:23 ? 00:00:06 [rcu_sched]
root 8 2 0 20:23 ? 00:00:00 [rcu_bh]
root 9 2 0 20:23 ? 00:00:00 [migration/0]
root 10 2 0 20:23 ? 00:00:00 [migration/1]
root 11 2 0 20:23 ? 00:00:00 [ksoftirqd/1]
root 13 2 0 20:23 ? 00:00:00 [kworker/1:0H]
root 14 2 0 20:23 ? 00:00:00 [migration/2]
....
linux-kernel process
asked Dec 15 '17 at 22:23
elbarna
3,81893577
5
>is possible to see kernel space programs? ... Yes! You simply need the correct astronomical filter on your CCD... ;-)
– RubberStamp
Dec 15 '17 at 22:27
2
lsmod ? en.wikipedia.org/wiki/Lsmod
– steve
Dec 15 '17 at 22:40
5
@steve Kernel space programs are really strictly tangential to modules. Not all modules have processes, and not all processes are modules.
– Chris Down
Dec 15 '17 at 23:50
3
The question is wrong: you want to see kernel processes (or kernel threads, or kernel tasks) not kernel programs.... There is only one program involved: the kernel (and kernel modules are added into the kernel).
– Basile Starynkevitch
Dec 16 '17 at 13:26
I will correct now
– elbarna
Dec 17 '17 at 20:09
add a comment |Â
up vote
25
down vote
favorite
7
up vote
25
down vote
favorite
7
7
I know there are two "levels" of programs: User space and kernel space.
My question is: I want to see only kernel programs,or better: programs on kernel space.
Is this approach correct?
ps -ef|grep "["
root 1 0 0 20:23 ? 00:00:00 init [4]
root 2 0 0 20:23 ? 00:00:00 [kthreadd]
root 3 2 0 20:23 ? 00:00:00 [ksoftirqd/0]
root 5 2 0 20:23 ? 00:00:00 [kworker/0:0H]
root 7 2 0 20:23 ? 00:00:06 [rcu_sched]
root 8 2 0 20:23 ? 00:00:00 [rcu_bh]
root 9 2 0 20:23 ? 00:00:00 [migration/0]
root 10 2 0 20:23 ? 00:00:00 [migration/1]
root 11 2 0 20:23 ? 00:00:00 [ksoftirqd/1]
root 13 2 0 20:23 ? 00:00:00 [kworker/1:0H]
root 14 2 0 20:23 ? 00:00:00 [migration/2]
....
linux-kernel process
asked Dec 15 '17 at 22:23
elbarna
3,81893577
I know there are two "levels" of programs: User space and kernel space.
My question is: I want to see only kernel programs,or better: programs on kernel space.
Is this approach correct?
ps -ef|grep "["
root 1 0 0 20:23 ? 00:00:00 init [4]
root 2 0 0 20:23 ? 00:00:00 [kthreadd]
root 3 2 0 20:23 ? 00:00:00 [ksoftirqd/0]
root 5 2 0 20:23 ? 00:00:00 [kworker/0:0H]
root 7 2 0 20:23 ? 00:00:06 [rcu_sched]
root 8 2 0 20:23 ? 00:00:00 [rcu_bh]
root 9 2 0 20:23 ? 00:00:00 [migration/0]
root 10 2 0 20:23 ? 00:00:00 [migration/1]
root 11 2 0 20:23 ? 00:00:00 [ksoftirqd/1]
root 13 2 0 20:23 ? 00:00:00 [kworker/1:0H]
root 14 2 0 20:23 ? 00:00:00 [migration/2]
....
linux-kernel process
asked Dec 15 '17 at 22:23
elbarna
3,81893577
edited Dec 17 '17 at 20:09
asked Dec 15 '17 at 22:23
elbarna
3,81893577
asked Dec 15 '17 at 22:23
elbarna
3,81893577
asked Dec 15 '17 at 22:23
elbarna
3,81893577
3,81893577
5
>is possible to see kernel space programs? ... Yes! You simply need the correct astronomical filter on your CCD... ;-)
– RubberStamp
Dec 15 '17 at 22:27
2
lsmod ? en.wikipedia.org/wiki/Lsmod
– steve
Dec 15 '17 at 22:40
5
@steve Kernel space programs are really strictly tangential to modules. Not all modules have processes, and not all processes are modules.
– Chris Down
Dec 15 '17 at 23:50
3
The question is wrong: you want to see kernel processes (or kernel threads, or kernel tasks) not kernel programs.... There is only one program involved: the kernel (and kernel modules are added into the kernel).
– Basile Starynkevitch
Dec 16 '17 at 13:26
I will correct now
– elbarna
Dec 17 '17 at 20:09
add a comment |Â
5
>is possible to see kernel space programs? ... Yes! You simply need the correct astronomical filter on your CCD... ;-)
– RubberStamp
Dec 15 '17 at 22:27
2
lsmod ? en.wikipedia.org/wiki/Lsmod
– steve
Dec 15 '17 at 22:40
5
@steve Kernel space programs are really strictly tangential to modules. Not all modules have processes, and not all processes are modules.
– Chris Down
Dec 15 '17 at 23:50
3
The question is wrong: you want to see kernel processes (or kernel threads, or kernel tasks) not kernel programs.... There is only one program involved: the kernel (and kernel modules are added into the kernel).
– Basile Starynkevitch
Dec 16 '17 at 13:26
I will correct now
– elbarna
Dec 17 '17 at 20:09
5
5
>is possible to see kernel space programs? ... Yes! You simply need the correct astronomical filter on your CCD... ;-)
– RubberStamp
Dec 15 '17 at 22:27
>is possible to see kernel space programs? ... Yes! You simply need the correct astronomical filter on your CCD... ;-)
– RubberStamp
Dec 15 '17 at 22:27
2
2
lsmod ? en.wikipedia.org/wiki/Lsmod
– steve
Dec 15 '17 at 22:40
lsmod ? en.wikipedia.org/wiki/Lsmod
– steve
Dec 15 '17 at 22:40
5
5
@steve Kernel space programs are really strictly tangential to modules. Not all modules have processes, and not all processes are modules.
– Chris Down
Dec 15 '17 at 23:50
@steve Kernel space programs are really strictly tangential to modules. Not all modules have processes, and not all processes are modules.
– Chris Down
Dec 15 '17 at 23:50
3
3
The question is wrong: you want to see kernel processes (or kernel threads, or kernel tasks) not kernel programs.... There is only one program involved: the kernel (and kernel modules are added into the kernel).
– Basile Starynkevitch
Dec 16 '17 at 13:26
The question is wrong: you want to see kernel processes (or kernel threads, or kernel tasks) not kernel programs.... There is only one program involved: the kernel (and kernel modules are added into the kernel).
– Basile Starynkevitch
Dec 16 '17 at 13:26
I will correct now
– elbarna
Dec 17 '17 at 20:09
I will correct now
– elbarna
Dec 17 '17 at 20:09
add a comment |Â
2 Answers
2
active
oldest
votes
up vote
40
down vote
accepted
Kernel processes (or "kernel threads") are children of PID 2 (kthreadd), so this might be more accurate:
ps --ppid 2 -p 2 -o uname,pid,ppid,cmd,cls
Add --deselect to invert the selection and see only user-space processes.
(This question was pretty much an exact inverse of this one.)
In 2.4.* and older kernels, this PID 2 convention did not exist yet.
answered Dec 15 '17 at 23:29
telcoM
10.8k11232
Is it always true ? See the fourth comment in this question: stackoverflow.com/q/12213445/1971003
– Guy Avraham
Aug 19 at 12:52
It is possible that in early 2.6.* kernels the conversion to the "child of PID 2" convention was not quite complete. As HighKing indicates there, the name of PID 2 had also not fully stabilized tokthreaddby 2.6.18. If you're interested in exact details, go to kernel.org and use the git browser interface to drill down into the early history ofkernel/kthread.cfile.
– telcoM
Aug 19 at 13:13
add a comment |Â
up vote
4
down vote
Kernel threads do not use RAM at all (or at least are displayed not to use any):
ps -eo cmd,vsize,rss | grep -E ' 0 +0$'
answered Dec 15 '17 at 23:32
Patrick Mevzek
2,0381721
add a comment |Â
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
40
down vote
accepted
Kernel processes (or "kernel threads") are children of PID 2 (kthreadd), so this might be more accurate:
ps --ppid 2 -p 2 -o uname,pid,ppid,cmd,cls
Add --deselect to invert the selection and see only user-space processes.
(This question was pretty much an exact inverse of this one.)
In 2.4.* and older kernels, this PID 2 convention did not exist yet.
answered Dec 15 '17 at 23:29
telcoM
10.8k11232
Is it always true ? See the fourth comment in this question: stackoverflow.com/q/12213445/1971003
– Guy Avraham
Aug 19 at 12:52
It is possible that in early 2.6.* kernels the conversion to the "child of PID 2" convention was not quite complete. As HighKing indicates there, the name of PID 2 had also not fully stabilized tokthreaddby 2.6.18. If you're interested in exact details, go to kernel.org and use the git browser interface to drill down into the early history ofkernel/kthread.cfile.
– telcoM
Aug 19 at 13:13
add a comment |Â
up vote
40
down vote
accepted
Kernel processes (or "kernel threads") are children of PID 2 (kthreadd), so this might be more accurate:
ps --ppid 2 -p 2 -o uname,pid,ppid,cmd,cls
Add --deselect to invert the selection and see only user-space processes.
(This question was pretty much an exact inverse of this one.)
In 2.4.* and older kernels, this PID 2 convention did not exist yet.
answered Dec 15 '17 at 23:29
telcoM
10.8k11232
Is it always true ? See the fourth comment in this question: stackoverflow.com/q/12213445/1971003
– Guy Avraham
Aug 19 at 12:52
It is possible that in early 2.6.* kernels the conversion to the "child of PID 2" convention was not quite complete. As HighKing indicates there, the name of PID 2 had also not fully stabilized tokthreaddby 2.6.18. If you're interested in exact details, go to kernel.org and use the git browser interface to drill down into the early history ofkernel/kthread.cfile.
– telcoM
Aug 19 at 13:13
add a comment |Â
up vote
40
down vote
accepted
up vote
40
down vote
accepted
Kernel processes (or "kernel threads") are children of PID 2 (kthreadd), so this might be more accurate:
ps --ppid 2 -p 2 -o uname,pid,ppid,cmd,cls
Add --deselect to invert the selection and see only user-space processes.
(This question was pretty much an exact inverse of this one.)
In 2.4.* and older kernels, this PID 2 convention did not exist yet.
answered Dec 15 '17 at 23:29
telcoM
10.8k11232
Kernel processes (or "kernel threads") are children of PID 2 (kthreadd), so this might be more accurate:
ps --ppid 2 -p 2 -o uname,pid,ppid,cmd,cls
Add --deselect to invert the selection and see only user-space processes.
(This question was pretty much an exact inverse of this one.)
In 2.4.* and older kernels, this PID 2 convention did not exist yet.
answered Dec 15 '17 at 23:29
telcoM
10.8k11232
edited Dec 16 '17 at 12:10
answered Dec 15 '17 at 23:29
telcoM
10.8k11232
answered Dec 15 '17 at 23:29
telcoM
10.8k11232
answered Dec 15 '17 at 23:29
telcoM
10.8k11232
10.8k11232
Is it always true ? See the fourth comment in this question: stackoverflow.com/q/12213445/1971003
– Guy Avraham
Aug 19 at 12:52
It is possible that in early 2.6.* kernels the conversion to the "child of PID 2" convention was not quite complete. As HighKing indicates there, the name of PID 2 had also not fully stabilized tokthreaddby 2.6.18. If you're interested in exact details, go to kernel.org and use the git browser interface to drill down into the early history ofkernel/kthread.cfile.
– telcoM
Aug 19 at 13:13
add a comment |Â
Is it always true ? See the fourth comment in this question: stackoverflow.com/q/12213445/1971003
– Guy Avraham
Aug 19 at 12:52
It is possible that in early 2.6.* kernels the conversion to the "child of PID 2" convention was not quite complete. As HighKing indicates there, the name of PID 2 had also not fully stabilized tokthreaddby 2.6.18. If you're interested in exact details, go to kernel.org and use the git browser interface to drill down into the early history ofkernel/kthread.cfile.
– telcoM
Aug 19 at 13:13
Is it always true ? See the fourth comment in this question: stackoverflow.com/q/12213445/1971003
– Guy Avraham
Aug 19 at 12:52
Is it always true ? See the fourth comment in this question: stackoverflow.com/q/12213445/1971003
– Guy Avraham
Aug 19 at 12:52
It is possible that in early 2.6.* kernels the conversion to the "child of PID 2" convention was not quite complete. As HighKing indicates there, the name of PID 2 had also not fully stabilized to
kthreadd by 2.6.18. If you're interested in exact details, go to kernel.org and use the git browser interface to drill down into the early history of kernel/kthread.c file.– telcoM
Aug 19 at 13:13
It is possible that in early 2.6.* kernels the conversion to the "child of PID 2" convention was not quite complete. As HighKing indicates there, the name of PID 2 had also not fully stabilized to
kthreadd by 2.6.18. If you're interested in exact details, go to kernel.org and use the git browser interface to drill down into the early history of kernel/kthread.c file.– telcoM
Aug 19 at 13:13
add a comment |Â
up vote
4
down vote
Kernel threads do not use RAM at all (or at least are displayed not to use any):
ps -eo cmd,vsize,rss | grep -E ' 0 +0$'
answered Dec 15 '17 at 23:32
Patrick Mevzek
2,0381721
add a comment |Â
up vote
4
down vote
Kernel threads do not use RAM at all (or at least are displayed not to use any):
ps -eo cmd,vsize,rss | grep -E ' 0 +0$'
answered Dec 15 '17 at 23:32
Patrick Mevzek
2,0381721
add a comment |Â
up vote
4
down vote
up vote
4
down vote
Kernel threads do not use RAM at all (or at least are displayed not to use any):
ps -eo cmd,vsize,rss | grep -E ' 0 +0$'
answered Dec 15 '17 at 23:32
Patrick Mevzek
2,0381721
Kernel threads do not use RAM at all (or at least are displayed not to use any):
ps -eo cmd,vsize,rss | grep -E ' 0 +0$'
answered Dec 15 '17 at 23:32
Patrick Mevzek
2,0381721
edited Dec 16 '17 at 2:23
answered Dec 15 '17 at 23:32
Patrick Mevzek
2,0381721
answered Dec 15 '17 at 23:32
Patrick Mevzek
2,0381721
answered Dec 15 '17 at 23:32
Patrick Mevzek
2,0381721
2,0381721
add a comment |Â
add a comment |Â
Â
draft saved
draft discarded
Â
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f411159%2flinux-is-it-possible-to-see-only-kernel-space-threads-process%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
5
>is possible to see kernel space programs? ... Yes! You simply need the correct astronomical filter on your CCD... ;-)
– RubberStamp
Dec 15 '17 at 22:27
2
lsmod ? en.wikipedia.org/wiki/Lsmod
– steve
Dec 15 '17 at 22:40
5
@steve Kernel space programs are really strictly tangential to modules. Not all modules have processes, and not all processes are modules.
– Chris Down
Dec 15 '17 at 23:50
3
The question is wrong: you want to see kernel processes (or kernel threads, or kernel tasks) not kernel programs.... There is only one program involved: the kernel (and kernel modules are added into the kernel).
– Basile Starynkevitch
Dec 16 '17 at 13:26
I will correct now
– elbarna
Dec 17 '17 at 20:09