I have a CentOS 8 (3.10) running on VirtualBox 6.0... And I have 2 questions about WCHAN

The 'ps' man page describes WCHAN as:

Blockquote nwchan WCHAN address of the kernel function where the process is sleeping (use wchan if you want the kernel function name). Running tasks will display a dash ('-') in this column.

Blockquote wchan WCHAN name of the kernel function in which the process is sleeping, a "-" if the process is running, or a "*" if the process is multi-threaded and ps is not displaying threads.

I haven't see the "*" yet, but I'll see a "?" in the output of the "ps" command with regularity. Usually associated with the rcu_sched kernel process, but the "?" does appear for other processes. I haven't found a definition for the "?"... What does it mean?

My 2nd question is about a discrepancy I'm seeing between the output of the 'ps' command and the 'System Monitor' GUI utility. Under the 'ps' command, I'll see several processes in a run state and will have a "-" under WCHAN. Yet under the "System Monitor", those same processes will be in a run state with a WCHAN code of "poll_schedule_timeout". From what I've read this indicates a process is waiting for I/O... Shouldn't these processes be in a sleep state?

enter image description here

  • No answer for 7 months? Uh... I tried to give some answers. Without knowing more details it is difficult to give an exact answer. Please check if it sounds reasonable for your issues.
    – reichhart
    Commented Oct 6, 2020 at 14:02

1 Answer 1


Question mark "?" in "ps" output

I didn't check the source code of "ps" on Linux but IMHO the "?" is used always when the value is unknown to "ps". Why it happens to you can't be answered without knowing more details.

But most common reason for that are missing permissions: The user of your "ps" process does not have the permissions to read the details of other processes. Details of other processes can be checked in e.g. /proc/PIDNUMBER/ directory - if you don't have permissions to see the details then also a "ps" process started by you would have the same permission issue.

Different output of "ps" and "System monitor"

Unfortunately this can't be answered exactly. Actually I would always expect a different output of two "ps" instances or "System Monitor" or any other tool for showing the current state of processes because with every fraction of a second the state of most processes of a system does change! Every time you run a tool like "ps" you get a snapshot of the state at this time.

Even if you would try to start two "ps" instances at the very same time the output would differ on almost every system because "ps" itself is just a process getting some time slices from the Linux/Unix kernel causing two "ps" processes to get data from other processes at different times and hence different values.

Theoretically if you have a system with e.g. 200 CPU cores and only 198 processes then two (new) "ps" processes could show the same output. Theoretically - if both processes are running on a CPU core of its own and started at the very same time!

Testing outputs:

Usually the state of a process is switching a lot. The only state which could be hold for some time is "stopped". This is shown as "T" (sTopped) in "ps". To compare here "ps" and "System Monitor" you can try to send a process a STOP signal with kill -STOP PIDNUMBER and then compare the output of both tools for this process. To continue execution of the process after comparing it simply send a "continue" signal to it with kill -CONT PIDNUMBER. As a process you can use something like e.g. "sleep 3600" which can be easily found (or "grep"ped) in "ps" output.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .