3

This question already has an answer here:

When I type ps -ef , there are lots of special kernel thread processes showing.

I am not interested in kernel threads; I am only interested in user process/thread.

Is there a way that I can hide the kernel threads?

marked as duplicate by Anthony Geoghegan, Romeo Ninov, roaima, Stephen Rauch, don_crissti Nov 20 '17 at 20:51

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

5

ps output can be filtered in may ways. To see your processes, you could filter by the user/uid. relevant man page below --

   U userlist      Select by effective user ID (EUID) or name.
                   This selects the processes whose effective user name or ID is in userlist. The effective user ID describes the user
                   whose file access permissions are used by the process (see geteuid(2)). Identical to -u and --user.

   -U userlist     Select by real user ID (RUID) or name.
                   It selects the processes whose real user name or ID is in the userlist list. The real user ID identifies the user
                   who created the process, see getuid(2).

   -u userlist     Select by effective user ID (EUID) or name.
                   This selects the processes whose effective user name or ID is in userlist. The effective user ID describes the user
                   whose file access permissions are used by the process (see geteuid(2)). Identical to U and --user.

To identify kernel vs user threads, it may depend on the kernel version. On my Ubuntu machine (3.5.0-30-generic), I can exclude kernel threads by excluding children of kthreadd (pid =2). The pid of kthreadd may differ on 2.6 kernels - however, you could just use the relevant pid. As an example, to get a list of all processes that don't have ppid =2, I do (for options to feed to -o, check the man page) --

 ps -o pid,ppid,comm,flags,%cpu,sz,%mem  --ppid 2 -N

You could also filter these using grep or awk. The other way (not using ps) to identify kernel threads is to check whether /proc//maps or /proc/cmdline is empty - both are empty for kernel threads. You'll need root privileges to do this.

  • 2
    However, this also hides processes running with some other user – Basile Starynkevitch Jan 29 '16 at 8:04
  • added note for kernel threads – jai_s Jan 29 '16 at 12:35
2

I filter the output with awk, using the fact the pid 2 is the parent of all kernel threads:

ps -fHuroot | awk '$3!=2'

This prints only lines where the third field (PPID) is not 2.

Not the answer you're looking for? Browse other questions tagged or ask your own question.