Every Linux Process

Back in 1982 when I was a sysadmin on my first Unix box, a ps would show init, cron, lpd and a handful of gettys. It was a small, close-knit family. The other day I did a ps on a Linux machine and hundreds of processes were listed. Most were strangers to me. This was not acceptable, so I started this site to familiarize myself with the current generation of processes. I found that most aren’t really processes in the classic sense, but kernel threads. I hope you’ll find the below list of processes, descriptions and linked resources interesting and informative.

All Processes

These are the processes running on a default install of Ubuntu Server 18.04.4. The only non-default I took was to run sshd so I could log in and get this list.

ps -ef

/sbin/init maybe-ubiquity the one true process to start them all the maybe-ubiquity part is from GRUB
[kthreadd] kernel thread master for spawning off processes largely to manage hardware. Kthread processes are shown in [square brackets].
[kworker/0:0H] a kernel worker thread placeholder
[mm_percpu_wq] wow! really not a lot about the memory management per cpu work queue thread, other than cryptic messages in the kernel maintainers list
[ksoftirqd/0] a way of handling hardware interrupt requests outside a regular handler
[rcu_sched] the Read Copy Update scheduler that synchronizes data across writer and readers. Here’s the latest on RCU
[rcu_bh] a cousin of the rcu_sched above, it provides grace periods in the RCU subsystem.
[migration/0] Distributes processes across cores. One such process per core. [watchdog/0] Checks to ensure the system’s still running, and reboots if hung, hopefully.
[cpuhp/0] Process that supports physically adding and removing CPUs from the system.
[cpuhp/1] lscpu says this machine has 4 cores, so these one-per-core kernel threads are repeated with different /n suffixes
[watchdog/1] ditto
[migration/1] ditto
[ksoftirqd/1] ditto
[kworker/1:0H] ditto
[cpuhp/2] ditto
[watchdog/2] ditto
[migration/2] ditto
[ksoftirqd/2] ditto
[kworker/2:0H] ditto
[cpuhp/3] ditto
[watchdog/3] ditto
[migration/3] ditto
[ksoftirqd/3] ditto
[kworker/3:0H] ditto
[kdevtmpfs] this thread populates and maintains a device node tree
[netns] this maintains the network namespace
[rcu_tasks_kthre] clearly a part of the Read Copy Update subsystem, but I’ll be hanged if I can find ANYTHING about this thread on the web.
[kauditd] the kernel thread responsible for auditing security events
[kworker/1:1] another kernel thread placeholder, see above
[khungtaskd] looks for hung tasks every two minutes
[oom_reaper] cleans up processes that are Out Of Memory.
[writeback] handles slow writes to block devices
[kcompactd0] handles background memory compaction
[ksmd] kernel samepage merging daemon, used by the KVM hypervisor.
[khugepaged] keeps track of huge virtual memory pages efficiently
[crypto] provides an API interface to the kernel crypto module
[kintegrityd] checks the integrity of block devices by writing/reading data to and from them.
[kblockd] checks for congestion in I/O pipes
[kworker/3:1] another generic kernel thread, see above.
[kworker/2:1] ditto
[ata_sff] handles ATA Small Form Factor interfaces
[md] handles multiple device interfaces, e.g. RAID arrays
[edac-poller] handles memory error detection and correction
[devfreq_wq] apparently allows for the reuse of frequently-used kernel workqueues
[watchdogd] probably has something to do with the watchdog thread. This is another one with almost no documentation.
[kswapd0] The manager of virtual memory. An ancient and venerable subsystem.
[kworker/u33:0] Another generic kernel thread ready to be used. See above.
[ecryptfs-kthrea] This encrypts and decrypts data passing out to the filesystem.
[kthrotld] Controls bandwidth on a request queue by throttling requests
[acpi_thermal_pm] Provides an API interface to the ACPI to provider thermal management
[ipv6_addrconf] handles the IPv6 configuration workqueue
[kstrp] the Kernel Stream Processor
[kworker/2:2] another worker thread placeholder, see the first one above
[charger_manager] about what you’d expect: a battery charger manager
[scsi_eh_0] Linux boxes almost never have SCSI disks anymore. This is the handles errors from other types of disks that appear as SCSI
[scsi_tmf_0] handles disk Task Mangement Functions
[scsi_eh_1] same as above for the next disk
[scsi_tmf_1] ditto
[scsi_eh_2] ditto
[scsi_tmf_2] ditto
[scsi_eh_3] ditto
[scsi_tmf_3] ditto
[scsi_eh_4] ditto
[scsi_tmf_4] ditto
[scsi_eh_5] ditto
[scsi_tmf_5] ditto
[e1000e] Handles the Intel Gigabit Ethernet devices
[i915/signal:0] Handles the Intel i915 Graphics drivers
[i915/signal:1] ditto
[i915/signal:2] ditto
[kworker/3:1H] another placeholder thread
[raid5wq] Probably a RAID5 driver, can’t find any info on it.
[jbd2/sda2-8] Updates the filesystem journal
[ext4-rsv-conver] Handles writeback conversion work from the ext4 filesystem.
[kworker/0:1H] another placeholder thread
[kworker/1:1H] another placeholder thread
[kworker/2:1H] another placeholder thread
/lib/systemd/systemd-journald and into userland! this is the process that collects logging data
[iscsi_eh] Can’t find much info on this one either, probably the iSCSI error handler
/sbin/lvmetad -f The Logical Volume Manager metadata caching process
[ib-comp-wq] Found one reference to it in the kernel mailing list. It has to do with the InfiniBand driver, and it’s now cpu-bound
[ib-comp-unb-wq] Dealing with the InfiniBand WorkQueue
[ib_mcast] Handling InfiniBand Multicast groups
[ib_nl_sa_wq] No info on this one, either. Some InfiniBand WorkQueue
[rdma_cm] Remote Direct Memory Access, usually part of InfiniBand
/lib/systemd/systemd-udevd The part of systemd that handles devices coming and going
/lib/systemd/systemd-timesyncd The systemd way of synchronizing the system clock to an external timekeeper. The supposedly better replacement for ntpd.
[irq/27-mei_me] One of the daemons that handles IRQ interrupts
/lib/systemd/systemd-networkd The part of the systemd juggernaut that handles networking
/lib/systemd/systemd-resolved The systemd Domain Name Service resolution manager
/usr/sbin/atd -f One of the few old-timers left: The at daemon that handles one-time delayed job execution
/usr/bin/lxcfs /var/lib/lxcfs/ Manages filesystems for fuse containers
/usr/sbin/rsyslogd -n The remote system logger daemon.
/usr/bin/python3 /usr/bin/networkd-dispatcher --run-startup-triggers Handles changes to the systemd-networkd
/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only The Dbus message bus daemon without which there would be no systemd functionality
/usr/sbin/cron -f An old subsystem I’ve used for decades: the cron daemon for regularly scheduled tasks
/usr/lib/accountsservice/accounts-daemon Provides Dbus interface to modifiying account information
/usr/sbin/thermald --no-daemon --dbus-enable The user-land deamon to monitor the system’s heat
/lib/systemd/systemd-logind About what it appears it handles the login process. Gone are the gettys.
/usr/sbin/irqbalance --foreground Distributes IRQs among the processors
/usr/lib/policykit-1/polkitd --no-debug Facilitates letting unprivileged processes talk to privileged ones.
/usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown --wait-for-signal Keeps the system from shutting down while software is being updated
/bin/login -p -- The actual login process that manages a user login
[loop0] Not much information about this either. Possibly a loopback filesystem thread?
[kworker/0:6] another placeholder thread
[kworker/0:7] ditto
/usr/lib/snapd/snapd The runner for the Snap packages
/lib/systemd/systemd --user The user-land heart of systemd
(sd-pam) a helper process for the Pluggable Authentication Module system
-bash What I’m using now, the Bourne-again Shell
/usr/sbin/sshd -D The Secure Shell server process
[kworker/1:2] another placeholder thread
[kworker/3:2] ditto
[kworker/u32:0] ditto
[kworker/u32:2] ditto
[kworker/u32:1] ditto
[kworker/1:0] ditto
[kworker/3:0] ditto
ps -ef List the status of all processes

I guess my biggest takeaway from this is that despite the voluminous documentation available about Linux, there’s still a half-dozen or so kernel threads that remain almost completely undocumented.


This was also an excuse to learn the JAMStack. This site was edited in vim, locally generated by Hugo Server, pushed up to github, from there picked up by Netlify. It uses the Academic theme. This site made by me, Brent Laminack.