Back in 1982 when I was a sysadmin on my first Unix box, a
ps would show init, cron, lpd and a handful of gettys. It was a small, close-knit family. The other day I did a
ps on a Linux machine and hundreds of processes were listed. Most were strangers to me. This was not acceptable, so I started this site to familiarize myself with the current generation of processes. I found that most aren’t really processes in the classic sense, but kernel threads. I hope you’ll find the below list of processes, descriptions and linked resources interesting and informative.
These are the processes running on a default install of Ubuntu Server 18.04.4. The only non-default I took was to run sshd so I could log in and get this list.
/sbin/init maybe-ubiquity the one true
process to start them all the
maybe-ubiquity part is from GRUB
kernel thread master for spawning off processes largely to manage hardware. Kthread processes are shown in [square brackets].
kernel worker thread placeholder
[mm_percpu_wq] wow! really not a lot about the memory management per cpu work queue thread, other than
cryptic messages in the kernel maintainers list
[ksoftirqd/0] a way of
handling hardware interrupt requests outside a regular handler
Read Copy Update scheduler that synchronizes data across writer and readers.
Here’s the latest on RCU
[rcu_bh] a cousin of the rcu_sched above, it provides
grace periods in the RCU subsystem.
Distributes processes across cores. One such process per core.
[watchdog/0] Checks to
ensure the system’s still running, and reboots if hung, hopefully.
[cpuhp/0] Process that supports
physically adding and removing CPUs from the system.
lscpu says this machine has 4 cores, so these one-per-core kernel threads are repeated with different /n suffixes
[kdevtmpfs] this thread
populates and maintains a device node tree
[netns] this maintains the
[rcu_tasks_kthre] clearly a part of the Read Copy Update subsystem, but I’ll be hanged if I can find ANYTHING about this thread on the web.
[kauditd] the kernel thread responsible for
auditing security events
[kworker/1:1] another kernel thread placeholder, see above
looks for hung tasks every two minutes
[oom_reaper] cleans up
processes that are Out Of Memory.
slow writes to block devices
[kcompactd0] handles background
kernel samepage merging daemon, used by the KVM hypervisor.
[khugepaged] keeps track of
huge virtual memory pages efficiently
provides an API interface to the kernel crypto module
checks the integrity of block devices by writing/reading data to and from them.
checks for congestion in I/O pipes
[kworker/3:1] another generic kernel thread, see above.
ATA Small Form Factor interfaces
multiple device interfaces, e.g. RAID arrays
memory error detection and correction
[devfreq_wq] apparently allows for the
reuse of frequently-used kernel workqueues
[watchdogd] probably has something to do with the
watchdog thread. This is another one with almost no documentation.
manager of virtual memory. An ancient and venerable subsystem.
[kworker/u33:0] Another generic kernel thread ready to be used. See above.
encrypts and decrypts data passing out to the filesystem.
[kthrotld] Controls bandwidth on a request queue by
[acpi_thermal_pm] Provides an API interface to the ACPI to provider
[ipv6_addrconf] handles the IPv6
Kernel Stream Processor
[kworker/2:2] another worker thread placeholder, see the first one above
[charger_manager] about what you’d expect: a
battery charger manager
[scsi_eh_0] Linux boxes almost never have SCSI disks anymore. This is the handles errors from
other types of disks that appear as SCSI
[scsi_tmf_0] handles disk
Task Mangement Functions
[scsi_eh_1] same as above for the next disk
[e1000e] Handles the
Intel Gigabit Ethernet devices
[i915/signal:0] Handles the
Intel i915 Graphics drivers
[kworker/3:1H] another placeholder thread
[raid5wq] Probably a RAID5 driver, can’t find any info on it.
[jbd2/sda2-8] Updates the
writeback conversion work from the ext4 filesystem.
[kworker/0:1H] another placeholder thread
[kworker/1:1H] another placeholder thread
[kworker/2:1H] another placeholder thread
/lib/systemd/systemd-journald and into userland! this is the process that
collects logging data
[iscsi_eh] Can’t find much info on this one either, probably the
iSCSI error handler
/sbin/lvmetad -f The Logical Volume Manager
metadata caching process
[ib-comp-wq] Found one reference to it in the kernel mailing list. It has to do with the InfiniBand driver, and it’s now
[ib-comp-unb-wq] Dealing with the
InfiniBand Multicast groups
[ib_nl_sa_wq] No info on this one, either. Some InfiniBand WorkQueue
Remote Direct Memory Access, usually part of InfiniBand
/lib/systemd/systemd-udevd The part of systemd that handles
devices coming and going
/lib/systemd/systemd-timesyncd The systemd way of
synchronizing the system clock to an external timekeeper. The supposedly better replacement for ntpd.
[irq/27-mei_me] One of the daemons that handles
/lib/systemd/systemd-networkd The part of the systemd juggernaut that
/lib/systemd/systemd-resolved The systemd
Domain Name Service resolution manager
/usr/sbin/atd -f One of the few old-timers left: The
at daemon that handles one-time delayed job execution
/usr/bin/lxcfs /var/lib/lxcfs/ Manages
filesystems for fuse containers
/usr/sbin/rsyslogd -n The
remote system logger daemon.
/usr/bin/python3 /usr/bin/networkd-dispatcher --run-startup-triggers Handles
changes to the systemd-networkd
/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only The
Dbus message bus daemon without which there would be no systemd functionality
/usr/sbin/cron -f An old subsystem I’ve used for decades: the
cron daemon for regularly scheduled tasks
/usr/lib/accountsservice/accounts-daemon Provides Dbus interface to
modifiying account information
/usr/sbin/thermald --no-daemon --dbus-enable The user-land deamon to
monitor the system’s heat
/lib/systemd/systemd-logind About what it appears it
handles the login process. Gone are the gettys.
Distributes IRQs among the processors
/usr/lib/policykit-1/polkitd --no-debug Facilitates letting
unprivileged processes talk to privileged ones.
/usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown --wait-for-signal Keeps the
system from shutting down while software is being updated
/bin/login -p -- The actual
login process that manages a user login
[loop0] Not much information about this either. Possibly a
loopback filesystem thread?
[kworker/0:6] another placeholder thread
/usr/lib/snapd/snapd The runner for the
/lib/systemd/systemd --user The user-land
heart of systemd
helper process for the Pluggable Authentication Module system
-bash What I’m using now, the
/usr/sbin/sshd -D The
Secure Shell server process
[kworker/1:2] another placeholder thread
ps -ef List the status of
I guess my biggest takeaway from this is that despite the voluminous documentation available about Linux, there’s still a half-dozen or so kernel threads that remain almost completely undocumented.