I have newly installed a redhat 7.4 on a physical server and only oracle database 12 C is running on it. I found there is more than 200 processes is "kworker", the number of process is keep increasing.

I would like to know what is this process is about and why my server is forking this process continually? It should be a kernel process, but it seems consuming a lot of process ID and CPU loading.

Thank you.

  • I also found there is a lot of "ksoftirqd" – Jay AU Nov 22 '17 at 14:42

kworker processes are kernel worker processes, and having many of them is likely to be harmless.

Kernel worker threads could be doing any number of things, as some random examples:

  • Doing page cache writebacks
  • Handling certain kinds of hardware events
  • Many, many other things

To know what any kworker is doing, you can look at /proc/<kworker_pid>/stack. For example:

$ cat /proc/$(pgrep -of kworker)/stack
[<ffffffff85c0c705>] acpi_ns_evaluate+0x1bc/0x23a
[<ffffffff85bffe09>] acpi_ev_asynch_execute_gpe_method+0x98/0xff
[<ffffffff85be4e30>] acpi_os_execute_deferred+0x10/0x20
[<ffffffff8588dc21>] process_one_work+0x181/0x370
[<ffffffff8588de5d>] worker_thread+0x4d/0x3a0
[<ffffffff85893f1c>] kthread+0xfc/0x130
[<ffffffff8588de10>] process_one_work+0x370/0x370
[<ffffffff85893e20>] kthread_create_on_node+0x70/0x70
[<ffffffff858791ba>] do_group_exit+0x3a/0xa0
[<ffffffff85e6a2b5>] ret_from_fork+0x25/0x30
[<ffffffffffffffff>] 0xffffffffffffffff

This kworker is acting on an ACPI event. You can tell this because it's inside its "processing" function, process_one_work, which eventually leads to functions related to processing ACPI events (like acpi_os_execute_deferred).

You'll probably find many have this stack, or something similar:

[<ffffffff9409a37d>] worker_thread+0xbd/0x400
[<ffffffff940a0355>] kthread+0x125/0x140
[<ffffffff946780c5>] ret_from_fork+0x25/0x30
[<ffffffffffffffff>] 0xffffffffffffffff

These kernel workers are simply sitting waiting for work to do.

Depending on your system configuration, it could well be normal to have many kworkers. Unless they are actively causing problems, I wouldn't worry about them.

  • I also found there is a lot of "ksoftirqd", is that also harmless? – Jay AU Nov 22 '17 at 14:42
  • @JayAU Yes. ksoftirqd handles software interrupts in much the same manner. – Chris Down Nov 22 '17 at 15:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.