1

The command ps aux | grep ] will list all the running kernel threads (the kernel threads that are crated by the kernel, and the kernel threads that are crated by someone else).

Is there a way to list the kernel threads that are created by the kernel only?

user343344
  • 211

1 Answers1

2

Kernel threads are always created by the kernel, and they’re always in process group 0, so you can filter on that:

ps -e -o pid,ppid,pgid,args | awk '$3 == 0'

(There doesn’t seem to be a way of filtering on process group id in ps; in theory one could filter on session 0 but ps doesn’t like that.)

You can also look for processes whose parent is kthreadd, the kernel thread dæmon:

ps --pid 2 --ppid 2 -o pid,ppid,pgid,args

(including pid 2 and its children).

Stephen Kitt
  • 434,908
  • "Kernel threads are always created by the kernel" By "Kernel" do you mean the kernel and the kernel modules or just the kernel by itself (because I think kthread_create() is used by kernel modules to create kernel threads)? – user343344 Mar 25 '19 at 17:26
  • Yes, both the kernel and kernel modules; I tend not to distinguish them since most modules can be built in, and once loaded, modules are effectively part of the kernel. – Stephen Kitt Mar 25 '19 at 17:50
  • You could perhaps distinguish between threads started by the “core” kernel from those started by modules by looking at etimes in ps. – Stephen Kitt Mar 25 '19 at 17:57