If you issue the ps aux command, you will see something like the following:
USER PID %CPU %MEM SIZE RSS TTY STAT START TIME COMMAND root 1 0.1 8.0 1284 536 ? S 07:37 0:04 init [2] root 2 0.0 0.0 0 0 ? SW 07:37 0:00 (kflushd) root 3 0.0 0.0 0 0 ? SW 07:37 0:00 (kupdate) root 4 0.0 0.0 0 0 ? SW 07:37 0:00 (kpiod) root 5 0.0 0.0 0 0 ? SW 07:37 0:00 (kswapd) root 52 0.0 10.7 1552 716 ? S 07:38 0:01 syslogd -m 0 root 54 0.0 7.1 1276 480 ? S 07:38 0:00 klogd root 56 0.3 17.3 2232 1156 1 S 07:38 0:13 -bash root 57 0.0 7.1 1272 480 2 S 07:38 0:01 /sbin/agetty 38400 tt root 64 0.1 7.2 1272 484 S1 S 08:16 0:01 /sbin/agetty -L ttyS1 root 70 0.0 10.6 1472 708 1 R Sep 11 0:01 ps aux
This is a list of the processes running on the system. The information comes from the /proc filesystem that I mentioned in the previous section. Note that init is process number one. Processes 2, 3, 4 and 5 are kflushd, kupdate, kpiod and kswapd. There is something strange here though: notice that in both the virtual storage size (SIZE) and the Real Storage Size (RSS) columns, these processes have zeroes. How can a process use no memory?
These processes are the kernel daemons. Most of the kernel does not show up on process lists at all, and you can only work out what memory it is using by subtracting the memory available from the amount on your system. The kernel daemons are started after init, so they get process numbers like normal processes do. But their code and data lives in the kernel's part of the memory.
There are brackets around the entries in the command column because the /proc filesystem does not contain command line information for these processes.
So what are these kernel daemons for? Previous versions of this document had a plea for help, as I didn't know much about the kernel daemons. The following partial story has been patched together from various replies to that plea, for which I am most grateful. Further clues, references and corrections are most welcome!
Input and output is done via buffers in memory. This allows things to run faster. What programs write can be kept in memory, in a buffer, then written to disk in larger more efficient chunks. The daemons kflushd and kupdate handle this work: kupdate runs periodically (5 seconds?) to check whether there are any dirty buffers. If there are, it gets kflushd to flush them to disk.
Processes often have nothing to do, and ones that are running often don't need all of their code and data in memory. This means we can make better use of our memory, by shifting unused parts of running programs out to the swap partition(s) of the hard disk. Moving this data in and out of memory as needed is done by kpiod and kswapd. Every second or so, kswapd wakes up to check out the memory situation, and if something out on the disk is needed in memory, or there is not enough free memory, kpiod is called in.
There might also be a kapmd daemon running on your system if you have configured automatic power management into your kernel.
The program update allows you to configure kflushd and kswapd. Try update -h for some information.
Swap space is turned on by swapon and off by swapoff. The init script (/etc/rc.sysinit or /etc/rc.d/rc.sysinit) usually calls swapon as the system is coming up. I'm told that swapoff is handy for saving power on laptops.
Do an update -d, note the blatherings on the last line about ``threshold for buffer fratricide''. Now there's an intriguing concept, go investigate!
Change directory to /proc/sys/vm and cat the files there. See what you can work out.
The Linux Documentation Project's ``The Linux Kernel'' (see section The Linux Kernel for a url)
The Linux kernel source code, if you are brave enough! The kswapd code is in linux/mm/vmscan.c, and kflushd and kupdate are in linux/fs/buffer.c.