10 Essential Linux Kernel Processes Every Sysadmin Should Know

In daily operations, running ps often reveals many unfamiliar processes, most of which are kernel threads. This article introduces ten common system processes to help you understand their functions and impact on Linux performance.

1. kswapd0

The system periodically wakes kswapd to check memory pressure. If memory is not tight, it sleeps. kswapd uses two thresholds, pages_low and pages_high. When free pages drop below pages_low, kswapd scans memory and releases pages in batches of 32 until the free page count reaches pages_high.

Linux uses kswapd for virtual memory management such that pages that have been recently accessed are kept in memory and less active pages are paged out to disk. Linux manages memory in units called pages. The kswapd process regularly decreases the ages of unreferenced pages, and eventually they are paged out to disk.

2. kjournald

The journaling daemon records all filesystem metadata changes; it is the slowest of the three ext3 journaling modes.

Logs all filesystem data and metadata changes. The slowest of the three ext3 journaling modes, this journaling mode minimizes the chance of losing the changes you have made to any file in an ext3 filesystem.

ordered : the default mode; it logs only metadata changes and flushes file data to disk before updating metadata.

Only logs changes to filesystem metadata, but flushes file data updates to disk before making changes to associated filesystem metadata. This is the default ext3 journaling mode.

writeback : the fastest mode; it also logs only modified metadata but relies on the standard filesystem write process to write data to disk.

Only logs changes to filesystem metadata but relies on the standard filesystem write process to write file data changes to disk. This is the fastest ext3 journaling mode.

3. pdflush

pdflush synchronizes memory contents with the filesystem. When dirty pages exceed 10% of memory, pdflush writes them back to disk. The threshold is configurable via vm.dirty_background_ratio in /etc/sysctl.conf.

For example, when a file is modified in memory, pdflush is responsible for writing it back to disk. Whenever dirty pages exceed the configured ratio (default 10%), pdflush backs them up to the disk.

4. kthreadd

This single kernel thread manages the scheduling of all other kernel threads. It is created during kernel initialization and continuously runs a function that processes the global kthread_create_list chain, spawning and cleaning up kernel threads as needed.

During kernel initialization, kthreadd is created and runs a loop that executes the function kthread_create_list . It can create new kernel threads via kthread_create , which are added to the list and later removed after execution. The thread cannot be terminated.

5. migration

There are 32 migration threads, one per CPU core (migration/0 … migration/31). They handle process migration and are part of the load‑balancing subsystem introduced in the 2.6 kernel.

Each migration thread is bound to a specific CPU, runs as a real‑time SCHED_FIFO task, and sleeps when there are no pending migration requests. When awakened, it processes the migration queue, which is essential for CPU load balancing.

6. watchdog

Watchdog consists of 32 threads (watchdog/0 … watchdog/31), each monitoring system health. If the system becomes unresponsive, the watchdog triggers a reboot. It includes both a kernel watchdog module and a user‑space watchdog program.

When the watchdog device (/dev/watchdog) is opened, it expects periodic write operations. If no write occurs within the configured interval (e.g., one minute), the hardware watchdog or software timer resets the system.

7. events

Events also have 32 threads (events/0 … events/31). They convert various hardware and software events—such as power loss or file changes—into kernel events and dispatch them to interested threads.

8. kblockd

kblockd comprises 32 threads, each managing block devices on a CPU core. They periodically activate block‑device drivers, ensuring that block devices remain functional.

9. aio

aio consists of 32 threads that replace user‑space processes for managing asynchronous I/O, enabling user‑mode AIO without blocking.

10. rpciod

rpciod also has 32 threads and acts as a daemon for remote procedure call services. It is commonly used when starting NFS services.

Conclusion

Processes are a fundamental concept in operating systems; every piece of data running on a system exists as a process. In Linux, any event is represented as a process, making processes the sole implementation mechanism for programs.