Next Previous Contents

## 8. Kernel Daemons

If you issue the `ps aux` command, you will see something like the following:

    USER       PID %CPU %MEM  SIZE   RSS TTY STAT START   TIME COMMAND
    root         1  0.1  8.0  1284   536   ? S    07:37   0:04 init [2]
    root         2  0.0  0.0     0     0   ? SW   07:37   0:00 (kflushd)
    root         3  0.0  0.0     0     0   ? SW   07:37   0:00 (kupdate)
    root         4  0.0  0.0     0     0   ? SW   07:37   0:00 (kpiod)
    root         5  0.0  0.0     0     0   ? SW   07:37   0:00 (kswapd)
    root        52  0.0 10.7  1552   716   ? S    07:38   0:01 syslogd -m 0
    root        54  0.0  7.1  1276   480   ? S    07:38   0:00 klogd
    root        56  0.3 17.3  2232  1156   1 S    07:38   0:13 -bash
    root        57  0.0  7.1  1272   480   2 S    07:38   0:01 /sbin/agetty 38400 tt
    root        64  0.1  7.2  1272   484  S1 S    08:16   0:01 /sbin/agetty -L ttyS1
    root        70  0.0 10.6  1472   708   1 R   Sep 11   0:01 ps aux

This is a list of the processes running on the system. The information comes from the `/proc` filesystem that I mentioned in the previous section. Note that `init` is process number one. Processes 2, 3, 4 and 5 are kflushd, kupdate, kpiod and kswapd. There is something strange here though: notice that in both the virtual storage size (SIZE) and the Real Storage Size (RSS) columns, these processes have zeroes. How can a process use no memory?

These processes are the kernel daemons. Most of the kernel does not show up on process lists at all, and you can only work out what memory it is using by subtracting the memory available from the amount on your system. The kernel daemons are started after init, so they get process numbers like normal processes do. But their code and data lives in the kernel's part of the memory.

There are brackets around the entries in the command column because the `/proc` filesystem does not contain command line information for these processes.

So what are these kernel daemons for? Previous versions of this document had a plea for help, as I didn't know much about the kernel daemons. The following partial story has been patched together from various replies to that plea, for which I am most grateful. Further clues, references and corrections are most welcome!

Input and output is done via buffers in memory. This allows things to run faster. What programs write can be kept in memory, in a buffer, then written to disk in larger more efficient chunks. The daemons `kflushd` and `kupdate` handle this work: `kupdate` runs periodically (5 seconds?) to check whether there are any dirty buffers. If there are, it gets `kflushd` to flush them to disk.

Processes often have nothing to do, and ones that are running often don't need all of their code and data in memory. This means we can make better use of our memory, by shifting unused parts of running programs out to the swap partition(s) of the hard disk. Moving this data in and out of memory as needed is done by `kpiod` and `kswapd`. Every second or so, `kswapd` wakes up to check out the memory situation, and if something out on the disk is needed in memory, or there is not enough free memory, `kpiod` is called in.

There might also be a `kapmd` daemon running on your system if you have configured automatic power management into your kernel.

## 8.1 Configuration

The program `update` allows you to configure `kflushd` and `kswapd`. Try `update -h` for some information.

Swap space is turned on by `swapon` and off by `swapoff`. The init script (`/etc/rc.sysinit` or `/etc/rc.d/rc.sysinit`) usually calls `swapon` as the system is coming up. I'm told that `swapoff` is handy for saving power on laptops.

## 8.2 Exercises

Do an `update -d`, note the blatherings on the last line about ``threshold for buffer fratricide''. Now there's an intriguing concept, go investigate!

Change directory to `/proc/sys/vm` and `cat` the files there. See what you can work out.

## 8.3 More Information

The Linux Documentation Project's ``The Linux Kernel'' (see section The Linux Kernel for a url)

The Linux kernel source code, if you are brave enough! The `kswapd` code is in `linux/mm/vmscan.c`, and `kflushd` and `kupdate` are in `linux/fs/buffer.c`.

Next Previous Contents