I'm reading the /proc
directory (or pseudo-fs) to find all processes. I'm getting the information I need from /proc/[pid]/status
but there's something else I need. Is there any way to figure out which processes are critical to system? for example using parent-pid or UID of the process?
By system process, I mean processes that would otherwise exist on a fresh installation of the OS, and before installing any application or services. This might not mean kernel threads, or system processes at all, but to sum it up, I mean processes, that their termination, would disrupt the fundamental structure of the system.
PS. I'm working on an android app, but since this part is done using pure Linux file system I asked it here and I don't suppose that there would be any different.
Best Answer
If you have
htop
you can press Shift+k to toggle the display of kernel threads. If you press F5 for tree mode, they should all appear as children ofkthreadd
.The Above answer from Identifying kernel threads
Another way to distinguish kernel threads from other process is to run
top -c
. From thetop
manual:Running
ps aux
also displays processes that were launched without a command in square brackets ( and will have an empty/proc/[pid]/cmdline
file ).Example:
See package
procps-3.2.8
file/proc/readproc.h
.