A hidden process, what it is?

Question

[root@datacenteronline ~]# ssh root@192.168.1.172
Last login: Wed Apr 17 09:55:45 2013 from 192.168.1.187
[root@localhost ~]# ls /proc/ | grep 2266
[root@localhost ~]# cd /proc/2266
[root@localhost 2266]# ls
attr             cpuset   limits      net            root       statm
autogroup        cwd      loginuid    numa_maps      sched      status
auxv             environ  maps        oom_adj        schedstat  syscall
cgroup           exe      mem         oom_score      sessionid  task
clear_refs       fd       mountinfo   oom_score_adj  smaps      wchan
cmdline          fdinfo   mounts      pagemap        stack
coredump_filter  io       mountstats  personality    stat
[root@localhost 2266]# ls -al /proc/2266
total 0
dr-xr-xr-x   7 apache apache 0 Apr 17 09:45 .
dr-xr-xr-x 266 root   root   0 Apr 17 09:11 ..
dr-xr-xr-x   2 apache apache 0 Apr 17 09:45 attr
-rw-r--r--   1 root   root   0 Apr 17 09:45 autogroup
-r--------   1 root   root   0 Apr 17 09:45 auxv
-r--r--r--   1 root   root   0 Apr 17 09:45 cgroup
--w-------   1 root   root   0 Apr 17 09:45 clear_refs
-r--r--r--   1 root   root   0 Apr 17 09:45 cmdline
-rw-r--r--   1 root   root   0 Apr 17 09:45 coredump_filter
-r--r--r--   1 root   root   0 Apr 17 09:45 cpuset
lrwxrwxrwx   1 root   root   0 Apr 17 09:45 cwd -> /
-r--------   1 root   root   0 Apr 17 09:45 environ
lrwxrwxrwx   1 root   root   0 Apr 17 09:45 exe -> /usr/local/apache2/bin/httpd
dr-x------   2 root   root   0 Apr 17 09:45 fd
dr-x------   2 root   root   0 Apr 17 09:45 fdinfo
-r--------   1 root   root   0 Apr 17 09:45 io
-rw-------   1 root   root   0 Apr 17 09:45 limits
-rw-r--r--   1 root   root   0 Apr 17 09:45 loginuid
-r--r--r--   1 root   root   0 Apr 17 09:45 maps
-rw-------   1 root   root   0 Apr 17 09:45 mem
-r--r--r--   1 root   root   0 Apr 17 09:45 mountinfo
-r--r--r--   1 root   root   0 Apr 17 09:45 mounts
-r--------   1 root   root   0 Apr 17 09:45 mountstats
dr-xr-xr-x   6 apache apache 0 Apr 17 09:45 net
-r--r--r--   1 root   root   0 Apr 17 09:45 numa_maps
-rw-r--r--   1 root   root   0 Apr 17 09:45 oom_adj
-r--r--r--   1 root   root   0 Apr 17 09:45 oom_score
-rw-r--r--   1 root   root   0 Apr 17 09:45 oom_score_adj
-r--r--r--   1 root   root   0 Apr 17 09:45 pagemap
-r--r--r--   1 root   root   0 Apr 17 09:45 personality
lrwxrwxrwx   1 root   root   0 Apr 17 09:45 root -> /
-rw-r--r--   1 root   root   0 Apr 17 09:45 sched
-r--r--r--   1 root   root   0 Apr 17 09:45 schedstat
-r--r--r--   1 root   root   0 Apr 17 09:45 sessionid
-r--r--r--   1 root   root   0 Apr 17 09:45 smaps
-r--r--r--   1 root   root   0 Apr 17 09:45 stack
-r--r--r--   1 root   root   0 Apr 17 09:45 stat
-r--r--r--   1 root   root   0 Apr 17 09:45 statm
-r--r--r--   1 root   root   0 Apr 17 09:45 status
-r--r--r--   1 root   root   0 Apr 17 09:45 syscall
dr-xr-xr-x  29 apache apache 0 Apr 17 09:45 task
-r--r--r--   1 root   root   0 Apr 17 09:45 wchan

Cound anyone tell me what it is?

is ls an alias for something? does /bin/ls -1 | grep 2266 behave the same way? — Frederik Deweerdt, Apr 17 '13 at 02:38

camh · Accepted Answer · 2013-04-17T04:42:20.503

12

This is likely to be a thread. In Linux, threads have a different process ID to the other threads in the process. When you look at the PID column in ps, you're actually looking at the thread group ID (TGID), which is common amongst all threads in a process. This is for historical reasons due to the way threads evolved in Linux.

For example, on my system, chromium has a number of threads in a process (multiple processes too):

$ ps -efL | grep chromium
[UID       PID  PPID   LWP  C NLWP STIME TTY          TIME CMD]
[...]
camh     10927  5182 10927  0    4 11:07 ?        00:00:00 /usr/lib/chromium/chromium ...
camh     10927  5182 10929  0    4 11:07 ?        00:00:00 /usr/lib/chromium/chromium ...
camh     10927  5182 10930  0    4 11:07 ?        00:00:00 /usr/lib/chromium/chromium ...
camh     10927  5182 10933  0    4 11:07 ?        00:00:00 /usr/lib/chromium/chromium ...

The second column is the TGID (although it is labelled as PID) and the forth column is LWP (light-weight process).

$ ls /proc | grep 10927
10927
$ ls /proc | grep 10929
$ cd /proc/10929
$ head -n 5 status
Name:   Chrome_ChildIOT
State:  S (sleeping)
Tgid:   10927
Pid:    10929
PPid:   5182

You can see that process 10929 does not show up in /proc, but you can cd to it. If you look in the status file, you'll see that it is part of "process" (thread group) 10927, and from the output above, that process does appear in /proc.

edited Apr 17 '13 at 04:42

answered Apr 17 '13 at 04:23

camh

39,069

1

BTW: your ps … | grep … line won't actually print out the header... I wish grep had an option to always print the first line! I think I'll ask a question about that. – derobert Apr 17 '13 at 04:33
... actually, it's already been asked: http://unix.stackexchange.com/questions/47918/how-to-grep-a-specific-line-and-the-first-line-of-a-file – derobert Apr 17 '13 at 04:35
@derobert: I know. I added it later as I felt it was useful. I wondered how long it would be before someone pointed it out. You were quick :) – camh Apr 17 '13 at 04:35
Indeed, quite useful. I suggest using that final sed command from the question I posted instead. That actually prints the header line... And is a nice solution! – derobert Apr 17 '13 at 04:38
I'll use editorial conventions and put the non-literal output in brackets, so as to not confuse the point. – camh Apr 17 '13 at 04:42

score 3 · Answer 2 · answered Apr 17 '13 at 06:10

It's an apache thread.

You can tell from this:

lrwxrwxrwx   1 root   root   0 Apr 17 09:45 exe -> /usr/local/apache2/bin/httpd

The Linux kernel documentation for the proc filesystem apparently doesn't explain why the thread ID is a directory but hidden from ls.

However, the threads are seen in /proc/<pid>/task/<threadid>.

A hidden process, what it is?

2 Answers2

Linked

Related