silly question about ps (/usr/bin/ps)

itz2000 · 02-20-2009, 01:24 PM

ps aux will give me the following results :

Code:

donkey@Peanut:~/kvm$ ps aux
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.0    772   304 ?        Ss   18:19   0:03 init [3]
root       112  0.0  0.0      0     0 ?        S<   18:19   0:00 [kacpid]
root       247  0.0  0.0      0     0 ?        S<   18:19   0:00 [kswapd0]
root       291  0.0  0.0      0     0 ?        S<   18:19   0:00 [aio/0]
root       308  0.0  0.0      0     0 ?        S<   18:19   0:00 [nfsiod]
root      1050  0.0  0.0      0     0 ?        S<   18:19   0:00 [iscsi_eh]
root      1132  0.0  0.0      0     0 ?        S<   18:19   0:00 [scsi_eh_2]
root      1135  0.0  0.0      0     0 ?        S<   18:19   0:00 [scsi_eh_3]
root      1162  0.0  0.0      0     0 ?        S<   18:19   0:00 [exec-osm/0]
root      1168  0.0  0.0      0     0 ?        S<   18:19   0:00 [block-osm/0]
donkey    2865  0.0  0.0   3188  1476 ?        S    18:20   0:00 /usr/libexec/ga
donkey    2870  0.0  0.0   1684   384 tty1     S    18:20   0:00 kwrapper ksmser
donkey    2872  0.0  0.6  25780 10056 ?        S    18:20   0:00 ksmserver [kdei
donkey    2873  0.0  0.8  28452 12624 ?        S    18:20   0:00 kwin [kdeinit]
donkey    2874  0.0  0.9  30460 14904 ?        R    18:20   0:01 kwin [kdeinit]
donkey    2888  0.0  0.6  26028  9684 ?        S    18:20   0:00 khotkeys [kdein
donkey    2890  0.0  0.7  27940 12188 ?        S    18:20   0:00 kxkb [kdeinit]

I would like to know what is the [program] --> what does the [] means? also, what is the [program /0] means : what does /0 means? and why some programs appear as : program [another-program] --> (in [another-program])... why doesn't all the [program] has /0 in the end?

Thanks!

Simon Bridge · 02-21-2009, 06:22 AM

It's been a while but IIRC:
When a command name appears in brackets - this means that ps could not find out what command was actually run to get the process going, but that name is what got stored by the kernel. i.e. it's an educated guess.

When it says [program-name/0] (notice - no spaces) there is more than one instance of that command in the list. The next one is [program-name/1] and so on.

Where you got program[another-program] ... you'll find that "another-program" = kdeinit ... which is associated with other KDE processes. Which makes me wonder if I really "RC" in that IIRC before.

unSpawn · 02-21-2009, 06:49 AM

Running a '/bin/ps axf -eo ppid,sid,pid,cmd --sort=pid' "forest" view might paint a cleaner picture. With respect to the first case (as mentioned by Simon Bridge) low PID processes having process names between brackets, on a 2.6 kernel you should see PID 2 being kthreadd and all the processes being children of PID 2, having PPID == 2. Those are in-kernel processes. On a 2.4 kernel there is no kthreadd so those process names just appear bracketed and often with a low PID. With respect to the third case, with userland processes you might also find bracketed contents provide process information. Like: 'init [$RUNLEVEL]' or 'sshd: $LOGNAME [privilege separation thread]'.