Hacker News Reader

Comment by josephcsible | Hacker News Reader

I wonder what the parent PID of these processes is.

That's what the "kthreadd" kernel process is for.

Try this command:

  ps axo pid,ppid,comm | less

The kernel-created processes will all have "kthreadd" as their Parent Process ID (PPID). Typically init and kthreadd are the only processes with a PPID of 0.

Yep, and aiui kthreadd on Linux always has a PID of 2. If you are ever trying to filter out kernel processes from ps output (and usermode helpers, apparently), you can check if the pid is 2 or ppid is 2.

init has a ppid of 0, which effectively is a special value that means the kernel. These processes probably also do the same thing (and thus, ppid=0 is a good way to detect kernel-started processes).

The other kernel workers get spawned by `kthreadd`, which has PPID = 0, PID = 2 under systemd.

I think they could be spawned with ppid 1 as well.

Reply on news.ycombinator.com