Linux: is it possible to see only kernel space threads/process

linux-kernelprocess

I know there are two "levels" of programs: User space and kernel space.

My question is: I want to see only kernel programs,or better: programs on kernel space.

Is this approach correct?

ps -ef|grep "\["

root         1     0  0 20:23 ?        00:00:00 init [4]
root         2     0  0 20:23 ?        00:00:00 [kthreadd]
root         3     2  0 20:23 ?        00:00:00 [ksoftirqd/0]
root         5     2  0 20:23 ?        00:00:00 [kworker/0:0H]
root         7     2  0 20:23 ?        00:00:06 [rcu_sched]
root         8     2  0 20:23 ?        00:00:00 [rcu_bh]
root         9     2  0 20:23 ?        00:00:00 [migration/0]
root        10     2  0 20:23 ?        00:00:00 [migration/1]
root        11     2  0 20:23 ?        00:00:00 [ksoftirqd/1]
root        13     2  0 20:23 ?        00:00:00 [kworker/1:0H]
root        14     2  0 20:23 ?        00:00:00 [migration/2]
....

Best Answer

Kernel processes (or "kernel threads") are children of PID 2 (kthreadd), so this might be more accurate:

ps --ppid 2 -p 2 -o uname,pid,ppid,cmd,cls

Add --deselect to invert the selection and see only user-space processes.

(This question was pretty much an exact inverse of this one.)

In 2.4.* and older kernels, this PID 2 convention did not exist yet.

Related Question