LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices

Reply
 
Search this Thread
Old 04-01-2009, 01:21 PM   #1
alirezan1
Member
 
Registered: Nov 2004
Location: Vancouver
Distribution: Ubunty, CentOS ,Mandriva, Gentoo, RedHat, Fedora, Knoppix
Posts: 147

Rep: Reputation: 15
square brackets in output of "ps aux" not matching output of "ps -ejH"


Hi guys,

I know it has been discussed on the forum before but it's still very unclear for me...

I read on one of the thread on LQ that processes in brackets [] are kernel threads...or processes that were started by init process...
first of all, are all the processes that were started by init process, kernel threads/processes? I'm abit confused about this one.

Also, why some of the processes that are not listed under "kthread" in the output of "ps -ejH", bracketed in the output of "ps aux"? Do they show different things or how does it work?

Thanks
 
Old 04-01-2009, 02:18 PM   #2
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 22,986
Blog Entries: 11

Rep: Reputation: 880Reputation: 880Reputation: 880Reputation: 880Reputation: 880Reputation: 880Reputation: 880
Quote:
Originally Posted by alirezan1 View Post
Hi guys,

I know it has been discussed on the forum before but it's still very unclear for me...

I read on one of the thread on LQ that processes in brackets [] are kernel threads...or processes that were started by init process...
first of all, are all the processes that were started by init process, kernel threads/processes? I'm abit confused about this one.

Also, why some of the processes that are not listed under "kthread" in the output of "ps -ejH", bracketed in the output of "ps aux"? Do they show different things or how does it work?

Thanks
Have you tried looking at the description of the individual flags
in the ps man-page?
 
Old 04-01-2009, 03:33 PM   #3
alirezan1
Member
 
Registered: Nov 2004
Location: Vancouver
Distribution: Ubunty, CentOS ,Mandriva, Gentoo, RedHat, Fedora, Knoppix
Posts: 147

Original Poster
Rep: Reputation: 15
Quote:
Originally Posted by Tinkster View Post
Have you tried looking at the description of the individual flags
in the ps man-page?
why do people do that all the time? Maybe I didn't understand or missed something in the man page...I have already mentioned that I'm confused about some stuff...

This is a forum where people ask for HELP...It's not like I've committed a crime....if you have the knowledge and the time, just respond to the question...why are you interrogating? If you do know just answer, if not BROWSE AWAY...

can someone help me with this?
 
Old 04-01-2009, 04:41 PM   #4
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 22,986
Blog Entries: 11

Rep: Reputation: 880Reputation: 880Reputation: 880Reputation: 880Reputation: 880Reputation: 880Reputation: 880
Well ... the best way of helping people is to enable them to help
themselves. Reading the man-page is always the best starting point.


If that's not your idea of help, just ignore my responses. And if
your idea of "getting help" is "being spoon-fed" - who knows, maybe I'll
just ignore your questions in the future...
 
Old 04-01-2009, 05:40 PM   #5
john test
Member
 
Registered: Jul 2008
Distribution: ubuntu 9.10
Posts: 527
Blog Entries: 1

Rep: Reputation: 35
Might try http://linux.about.com/od/commands/l/blcmdl1_ps.htm

Much clearer than the normal Man Page.

It points out that PS options/flags relate to Unix, BSD and GNU
Unix requires a leading hyphen
BSD omits the hyphen
GNU requires two hyphens
Just guessing that use of alternative options cause the differences in the bracketing that you have noted
 
Old 04-01-2009, 05:47 PM   #6
alirezan1
Member
 
Registered: Nov 2004
Location: Vancouver
Distribution: Ubunty, CentOS ,Mandriva, Gentoo, RedHat, Fedora, Knoppix
Posts: 147

Original Poster
Rep: Reputation: 15
Quote:
Originally Posted by john test View Post
Might try http://linux.about.com/od/commands/l/blcmdl1_ps.htm

Much clearer than the normal Man Page.

It points out that PS options/flags relate to Unix, BSD and GNU
Unix requires a leading hyphen
BSD omits the hyphen
GNU requires two hyphens
Just guessing that use of alternative options cause the differences in the bracketing that you have noted
Thanks but I've already tried that and it still shows the same thing. Like, say, nfsd in output of "aux" is bracketed, but in output of "ejH" is not listed under kthread:
Quote:
ps -aux output:
root 1970 0.0 0.0 0 0 ? S< 13:37 0:00 [nfsd4]
root 1971 0.0 0.0 0 0 ? S 13:37 0:00 [nfsd]
root 1972 0.0 0.0 0 0 ? S 13:37 0:00 [nfsd]
root 1973 0.0 0.0 0 0 ? S 13:37 0:00 [nfsd]
root 1974 0.0 0.0 0 0 ? S 13:37 0:00 [nfsd]
root 1975 0.0 0.0 0 0 ? S 13:37 0:00 [nfsd]
root 1976 0.0 0.0 0 0 ? S 13:37 0:00 [nfsd]
root 1977 0.0 0.0 0 0 ? S 13:37 0:00 [nfsd]
root 1978 0.0 0.0 0 0 ? S 13:37 0:00 [nfsd]
Quote:
ps -ejH
PID PGID SID TTY TIME CMD
1 1 1 ? 00:00:11 init
2 1 1 ? 00:00:00 migration/0
3 1 1 ? 00:00:00 ksoftirqd/0
4 1 1 ? 00:00:00 migration/1
5 1 1 ? 00:00:00 ksoftirqd/1
6 1 1 ? 00:00:00 migration/2
7 1 1 ? 00:00:00 ksoftirqd/2
8 1 1 ? 00:00:00 migration/3
9 1 1 ? 00:00:00 ksoftirqd/3
10 1 1 ? 00:00:00 events/0
11 1 1 ? 00:00:00 events/1
12 1 1 ? 00:00:00 events/2
13 1 1 ? 00:00:00 events/3
14 1 1 ? 00:00:00 khelper
15 1 1 ? 00:00:00 kthread
36 1 1 ? 00:00:00 kblockd/0
37 1 1 ? 00:00:00 kblockd/1
38 1 1 ? 00:00:00 kblockd/2
39 1 1 ? 00:00:00 kblockd/3
40 1 1 ? 00:00:00 cqueue/0
41 1 1 ? 00:00:00 cqueue/1
42 1 1 ? 00:00:00 cqueue/2
43 1 1 ? 00:00:00 cqueue/3
59 1 1 ? 00:00:00 pdflush
60 1 1 ? 00:00:00 pdflush
61 1 1 ? 00:00:00 kswapd0
62 1 1 ? 00:00:00 aio/0
63 1 1 ? 00:00:00 aio/1
64 1 1 ? 00:00:00 aio/2
65 1 1 ? 00:00:00 aio/3
638 1 1 ? 00:00:00 kcryptd/0
639 1 1 ? 00:00:00 kcryptd/1
640 1 1 ? 00:00:00 kcryptd/2
641 1 1 ? 00:00:00 kcryptd/3
642 1 1 ? 00:00:00 ksnapd
643 1 1 ? 00:00:00 kmirrord
854 1 1 ? 00:00:00 scsi_eh_0
1528 1 1 ? 00:00:00 scsi_wq_0
1922 1 1 ? 00:00:00 kjournald
2035 1 1 ? 00:00:00 kjournald
2428 1 1 ? 00:00:00 kjournald
1966 1 1 ? 00:00:00 rpciod/0
1967 1 1 ? 00:00:00 rpciod/1
1968 1 1 ? 00:00:00 rpciod/2
1969 1 1 ? 00:00:00 rpciod/3
1970 1 1 ? 00:00:00 nfsd4
675 1 1 ? 00:00:00 md0_raid1
693 1 1 ? 00:00:00 md100_raid1
1047 1 1 ? 00:00:00 kjournald
1201 1 1 ? 00:00:00 md1_raid1
1218 1 1 ? 00:00:00 md101_raid1
1372 1 1 ? 00:00:00 kjournald
1875 1 1 ? 00:00:00 md3_raid1
1892 1 1 ? 00:00:00 md103_raid1
2067 1 1 ? 00:00:00 kjournald
2411 1 1 ? 00:00:01 md2_raid1
2429 1 1 ? 00:00:00 md102_raid1
2635 1 1 ? 00:00:00 kjournald
688 688 688 ? 00:00:00 udevd
1717 1717 1717 ? 00:00:00 portmap
1768 1768 1768 ? 00:00:00 xinetd
1843 1778 1600 ? 00:00:00 procmond
1845 1778 1600 ? 00:00:00 syslogd_client
1846 1778 1600 ? 00:00:00 hwmond
1847 1778 1600 ? 00:00:00 dkmond
1851 1851 1851 ? 00:00:00 login
2393 2393 2393 ttyS0 00:00:00 bash
1212 1212 2393 ttyS0 00:00:00 ps
2131 2131 2131 ? 00:00:00 syslogd
2137 2137 2137 ? 00:00:00 klogd
1965 1 1 ? 00:00:00 lockd
1971 1 1 ? 00:00:00 nfsd
1972 1 1 ? 00:00:00 nfsd
1973 1 1 ? 00:00:00 nfsd
1974 1 1 ? 00:00:00 nfsd
1975 1 1 ? 00:00:00 nfsd
1976 1 1 ? 00:00:00 nfsd
1977 1 1 ? 00:00:00 nfsd
1978 1 1 ? 00:00:00 nfsd
1982 1982 1982 ? 00:00:00 rpc.mountd
2002 2002 2002 ? 00:00:00 rpc.idmapd
807 1 1 ? 00:00:08 drbd0_worker
1311 1 1 ? 00:00:09 drbd1_worker
2003 1 1 ? 00:00:08 drbd3_worker
2555 1 1 ? 00:00:00 drbd0_receiver
2561 1 1 ? 00:00:00 drbd3_receiver
2530 1 1 ? 00:01:09 drbd2_worker
2536 1 1 ? 00:00:25 drbd2_receiver
funny thing is, nfsd4 is under kthread and is also bracketed...I don't get it.
 
Old 04-01-2009, 06:35 PM   #7
john test
Member
 
Registered: Jul 2008
Distribution: ubuntu 9.10
Posts: 527
Blog Entries: 1

Rep: Reputation: 35
Is this what you are looking for?

Kernel Threads
Kernel threads consist of a set of registers, a stack, and a few corresponding kernel data structures. When kernel threads are used, the operating system will have a descriptor for each thread belonging to a process and it will schedule all the threads. Unlike processes, all threads within a process share the same address space. Similar to processes, when a kernel thread makes a blocking call, only that thread blocks. All modern machines support kernel threads, most often via the POSIX threads interface ``pthreads''. Some dedicated parallel machines support kernel threads poorly or not at all. For example, the Blue Gene/L microkernel does not support pthreads.

The purported advantage of kernel threads over processes is faster creation and context switching compared with processes. For shared-memory multiprocessor architectures, the kernel is able to dispatch threads of one process on several processors, which leads to automatic load balancing within the nodes. For parallel programming, threads allow different parts of the parallel program to communicate by directly accessing each others' memory, which allows very efficient, fine-grained communication.

Kernel threads share a single copy of the entire address space, including regions such as global data that may cause conflicts if used by multiple threads simultaneously. Threads can also cause unintentional data sharing, which leads to corruption and race conditions. To avoid this unintentional sharing, programs must often be modified to either lock or access separate copies of common data structures. Several very widely used language features are unsafe when used with threads, such as the use of global and static variables, or the idiom of returning a reference to a static buffer. Especially with large existing codebases with many global variables, this makes kernel threads very difficult to use because in most implementations of kernel threads, it is not possible to assign each thread a private set of global variables.

Kernel threads are considered ``lightweight,'' and one would expect the number of threads to only be limited by address space and processor time. Since every thread needs only a stack and a small data structure describing the thread, in principle this limit should not be a problem. But in practice, we found that many platforms impose hard limits on the maximum number of pthreads that can be created in a process. Table 2 in Section 4 shows the practical limitations on pthreads on several stock systems.

In particular, operating system kernels tend to see kernel threads as a special kind of process rather than a unique entity. For example, in the Solaris kernel threads are called ``light weight processes'' (LWP's). Linux actually creates kernel threads using a special variation of fork called ``clone,'' and until recently gave each thread a separate process ID. Because of this heritage, in practice kernel threads tend to be closer in memory and time cost to processes than user-level threads, although recent work has made some progress in closing the gap, including K42 [5] and the Native POSIX Threading Library (NPTL) and Linux O(1) scheduler.
 
Old 04-01-2009, 11:34 PM   #8
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 12,355

Rep: Reputation: 1043Reputation: 1043Reputation: 1043Reputation: 1043Reputation: 1043Reputation: 1043Reputation: 1043Reputation: 1043
Quote:
Originally Posted by alirezan1 View Post
I read on one of the thread on LQ that processes in brackets [] are kernel threads...or processes that were started by init process...
I have seen this mentioned too - I suspect it is mis-interpretation of the data. And now it's been repeated so often as to become "fact".
I haven't looked at the code, so I can't say for sure.
Here is a quote from the "man ps" on one of my Arch systems that appears relevant
Quote:
Sometimes the process args will be unavailable; when this is happens, ps will instead print the executable name in brackets.
Try your commands with the "c" option and you'll see the difference.

There is a flag in /proc/<pid>/stat that indicates whether that process is a kernel thread, so I'd be inclined to believe the option that supports process hierarchy (-H).
 
Old 04-02-2009, 01:17 PM   #9
alirezan1
Member
 
Registered: Nov 2004
Location: Vancouver
Distribution: Ubunty, CentOS ,Mandriva, Gentoo, RedHat, Fedora, Knoppix
Posts: 147

Original Poster
Rep: Reputation: 15
Quote:
Originally Posted by syg00 View Post
I have seen this mentioned too - I suspect it is mis-interpretation of the data. And now it's been repeated so often as to become "fact".
I haven't looked at the code, so I can't say for sure.
Here is a quote from the "man ps" on one of my Arch systems that appears relevantTry your commands with the "c" option and you'll see the difference.

There is a flag in /proc/<pid>/stat that indicates whether that process is a kernel thread, so I'd be inclined to believe the option that supports process hierarchy (-H).
awesome! Thanks...
 
Old 07-21-2009, 11:50 PM   #10
nemesis9
LQ Newbie
 
Registered: Jul 2009
Location: Arizona
Distribution: Redhat Fedora
Posts: 20

Rep: Reputation: 1
brackets is for args unavailable

Quote:
Originally Posted by syg00 View Post
Sometimes the process args will be unavailable; when this is happens, ps will instead print the executable name in brackets.
This is correct, try execl(program_path, NULL) and you will see your process listed in brackets.
 
Old 07-10-2010, 01:14 PM   #11
exceed1
Member
 
Registered: Mar 2008
Location: oslo
Distribution: debian,redhat
Posts: 199

Rep: Reputation: 31
two explainations from respected and experience authors and administrators...

Uh, what is actually the correct explaination here? I mean, i have read in books that the processes in brackets are kernel threads, but other books says that processes in brackets have the brackets because they are processes which has been swapped out because they are not in active use by the system at that time... so does anyone know for sure what the answer to this actually is? both statements are coming from people with a high knowledge of linux and networking and they have like 19-20 years experience .. i also thought they were kernel threads, but now when a person with 19 years experience which has also written the books on sendmail, qmail, postfix and a dozen other books says that its because the processes are swapped out because they are inactive im getting a little unsure about this...

what do you guys say?
 
Old 07-13-2010, 02:58 PM   #12
exceed1
Member
 
Registered: Mar 2008
Location: oslo
Distribution: debian,redhat
Posts: 199

Rep: Reputation: 31
bumping the thread, noone knows this for sure? ..i know there are many very skilled people here
 
Old 07-13-2010, 05:52 PM   #13
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 12,355

Rep: Reputation: 1043Reputation: 1043Reputation: 1043Reputation: 1043Reputation: 1043Reputation: 1043Reputation: 1043Reputation: 1043
Might have been true at one time, but now Linux doesn't swap tasks out. That function disappeared years ago - before I even started using Linux.
Pity Linus didn't rename the swap partition/file at the same time.
 
Old 07-14-2010, 03:11 AM   #14
exceed1
Member
 
Registered: Mar 2008
Location: oslo
Distribution: debian,redhat
Posts: 199

Rep: Reputation: 31
Quote:
Originally Posted by syg00 View Post
Might have been true at one time, but now Linux doesn't swap tasks out. That function disappeared years ago - before I even started using Linux.
Pity Linus didn't rename the swap partition/file at the same time.
Ok, the book were they say that processes in square brackets are processes swapped out is from 2008, but i guess they`re wrong then..
 
Old 07-14-2010, 04:17 AM   #15
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 12,355

Rep: Reputation: 1043Reputation: 1043Reputation: 1043Reputation: 1043Reputation: 1043Reputation: 1043Reputation: 1043Reputation: 1043
Don't believe everything you read. Including here.
I found the changelog for that function disappearing once - if I get bored I might go looking again.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Courious "unknown" entries in "netstat" output Sheridan Linux - Networking 5 09-01-2009 09:09 AM
"failed to execute child process" "Input/output error" fl.bratu Fedora 4 12-15-2008 04:03 AM
Feeding the output of "diff" or "cat" command to dpkg --purge kushalkoolwal Debian 9 06-19-2008 07:27 AM
Standard commands give "-bash: open: command not found" even in "su -" and "su root" mibo12 Linux - General 4 11-11-2007 10:18 PM
LXer: Displaying "MyComputer", "Trash", "Network Servers" Icons On A GNOME Desktop LXer Syndicated Linux News 0 04-02-2007 08:31 AM


All times are GMT -5. The time now is 04:54 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration