Is there any way to hide kernel threads from ps command results?

Question

When I type ps -ef , there are lots of special kernel thread processes showing.

I am not interested in kernel threads; I am only interested in user process/thread.

Is there a way that I can hide the kernel threads?

Use top or htop or pstree – Basile Starynkevitch Jan 29 '16 at 08:05 — Basile Starynkevitch, Jan 29 '16 at 08:05

score 5 · Accepted Answer · edited Mar 07 '18 at 11:15

ps output can be filtered in may ways. To see your processes, you could filter by the user/uid. relevant man page below --

   U userlist      Select by effective user ID (EUID) or name.
                   This selects the processes whose effective user name or ID is in userlist. The effective user ID describes the user
                   whose file access permissions are used by the process (see geteuid(2)). Identical to -u and --user.

   -U userlist     Select by real user ID (RUID) or name.
                   It selects the processes whose real user name or ID is in the userlist list. The real user ID identifies the user
                   who created the process, see getuid(2).

   -u userlist     Select by effective user ID (EUID) or name.
                   This selects the processes whose effective user name or ID is in userlist. The effective user ID describes the user
                   whose file access permissions are used by the process (see geteuid(2)). Identical to U and --user.

To identify kernel vs user threads, it may depend on the kernel version. On my Ubuntu machine (3.5.0-30-generic), I can exclude kernel threads by excluding children of kthreadd (pid =2). The pid of kthreadd may differ on 2.6 kernels - however, you could just use the relevant pid. As an example, to get a list of all processes that don't have ppid =2, I do (for options to feed to -o, check the man page) --

 ps -o pid,ppid,comm,flags,%cpu,sz,%mem  --ppid 2 -N

You could also filter these using grep or awk. The other way (not using ps) to identify kernel threads is to check whether /proc//maps or /proc/cmdline is empty - both are empty for kernel threads. You'll need root privileges to do this.

However, this also hides processes running with some other user — Basile Starynkevitch, Jan 29 '16 at 08:04

score 3 · Answer 2 · answered Jan 29 '16 at 12:21

3

I filter the output with awk, using the fact the pid 2 is the parent of all kernel threads:

ps -fHuroot | awk '$3!=2'

This prints only lines where the third field (PPID) is not 2.

answered Jan 29 '16 at 12:21

Toby Speight

8,678

Is there any way to hide kernel threads from ps command results?

2 Answers2

Linked