8. Kernel Daemons

If you issue the ps aux command, you will see something like the following:

USER       PID %CPU %MEM  SIZE   RSS TTY STAT START   TIME COMMAND
root         1  0.1  8.0  1284   536   ? S    07:37   0:04 init [2] 
root         2  0.0  0.0     0     0   ? SW   07:37   0:00 (kflushd)
root         3  0.0  0.0     0     0   ? SW   07:37   0:00 (kupdate)
root         4  0.0  0.0     0     0   ? SW   07:37   0:00 (kpiod)
root         5  0.0  0.0     0     0   ? SW   07:37   0:00 (kswapd)
root        52  0.0 10.7  1552   716   ? S    07:38   0:01 syslogd -m 0 
root        54  0.0  7.1  1276   480   ? S    07:38   0:00 klogd 
root        56  0.3 17.3  2232  1156   1 S    07:38   0:13 -bash 
root        57  0.0  7.1  1272   480   2 S    07:38   0:01 /sbin/agetty 38400 tt
root        64  0.1  7.2  1272   484  S1 S    08:16   0:01 /sbin/agetty -L ttyS1
root        70  0.0 10.6  1472   708   1 R   Sep 11   0:01 ps aux 

This is a list of the processes running on the system. The information comes from the /proc filesystem that I mentioned in the previous section. Note that init is process number one. Processes 2, 3, 4 and 5 are kflushd, kupdate, kpiod and kswapd. There is something strange here though: notice that in both the virtual storage size (SIZE) and the Real Storage Size (RSS) columns, these processes have zeroes. How can a process use no memory?

These processes are the kernel daemons. Most of the kernel does not show up on process lists at all, and you can only work out what memory it is using by subtracting the memory available from the amount on your system. The kernel daemons are started after init, so they get process numbers like normal processes do. But their code and data lives in the kernel's part of the memory.

There are brackets around the entries in the command column because the /proc filesystem does not contain command line information for these processes.

So what are these kernel daemons for? Previous versions of this document had a plea for help, as I didn't know much about the kernel daemons. The following partial story has been patched together from various replies to that plea, for which I am most grateful. Further clues, references and corrections are most welcome!

Input and output is done via buffers in memory. This allows things to run faster. What programs write can be kept in memory, in a buffer, then written to disk in larger more efficient chunks. The daemons kflushd and kupdate handle this work: kupdate runs periodically (5 seconds?) to check whether there are any dirty buffers. If there are, it gets kflushd to flush them to disk.

Processes often have nothing to do, and ones that are running often don't need all of their code and data in memory. This means we can make better use of our memory, by shifting unused parts of running programs out to the swap partition(s) of the hard disk. Moving this data in and out of memory as needed is done by kpiod and kswapd. Every second or so, kswapd wakes up to check out the memory situation, and if something out on the disk is needed in memory, or there is not enough free memory, kpiod is called in.

There might also be a kapmd daemon running on your system if you have configured automatic power management into your kernel.

8.1 Configuration

The program update allows you to configure kflushd and kswapd. Try update -h for some information.

Swap space is turned on by swapon and off by swapoff. The init script (/etc/rc.sysinit or /etc/rc.d/rc.sysinit) usually calls swapon as the system is coming up. I'm told that swapoff is handy for saving power on laptops.

8.2 Exercises

Do an update -d, note the blatherings on the last line about ``threshold for buffer fratricide''. Now there's an intriguing concept, go investigate!

Change directory to /proc/sys/vm and cat the files there. See what you can work out.

8.3 More Information

The Linux Documentation Project's ``The Linux Kernel'' (see section The Linux Kernel for a url)

The Linux kernel source code, if you are brave enough! The kswapd code is in linux/mm/vmscan.c, and kflushd and kupdate are in linux/fs/buffer.c.