Understanding Linux Kernel Processes: 10 Essential System Daemons Explained

<code>In daily operations, running the ps command often reveals many "odd" processes, most of which are system kernel processes. Because many are unfamiliar with them, this introductory post lists and explains common system processes to improve understanding of operating system processes.</code>

Introduction

During routine operations, administrators frequently encounter mysterious system processes that consume resources. Business teams often ask, "What is this xxx process and why does it appear?" These kernel processes are displayed in brackets and perform auxiliary system functions such as writing caches to disk, while unbracketed processes are user‑initiated (e.g., php, nginx).

Common Linux Kernel Processes

kswapd0

kjournald

pdflush

kthreadd

migration

watchdog

events

kblockd

aio

rpciod

1. kswapd0

The system periodically wakes kswapd to check memory pressure. If memory is not tight, it sleeps. kswapd uses two thresholds, pages_low and pages_high . When free pages fall below pages_low , kswapd scans memory and releases pages in batches of 32 until pages_high is reached.

Linux uses kswapd for virtual memory management so that recently accessed pages stay in memory while less active pages are paged out to disk.

2. kjournald

journal : records all filesystem metadata changes; the slowest journaling mode.

Logs all filesystem data and metadata changes. It is the slowest of the three ext3 journaling modes, minimizing the chance of losing changes.

ordered : default mode; logs metadata changes and flushes file data before committing metadata.

Only logs changes to filesystem metadata, but flushes file data updates to disk before making metadata changes. This is the default ext3 journaling mode.

writeback : fastest mode; logs only modified metadata and relies on the standard filesystem write process to write data to disk.

Only logs changes to filesystem metadata but relies on the standard filesystem write process to write file data changes to disk. This is the fastest ext3 journaling mode.

3. pdflush

pdflush synchronizes memory contents with the filesystem.

When a file is modified in memory, pdflush writes it back to disk. When dirty pages exceed 10% of memory, pdflush backs them up. The threshold is configurable via vm.dirty_background_ratio in /etc/sysctl.conf , defaulting to 10%.

4. kthreadd

This single kernel thread manages the scheduling of other kernel threads.

Created during kernel initialization, it runs a loop executing functions from the kthread_create_list global list. New kernel threads are added via kthread_create , which wakes kthreadd. kthreadd cannot be terminated.

5. migration

There are 32 migration threads (migration/0‑migration/31), one per CPU core, handling process migration operations.

Part of the 2.6 kernel load‑balancing system. Each thread runs as a real‑time SCHED_FIFO process, sleeping when no migration requests are pending and waking to handle them. It interfaces with CPU binding and power‑management functions.

6. watchdog

Also 32 threads (watchdog/0‑watchdog/31), one per core, monitoring system health and automatically rebooting on failure.

When the /dev/watchdog device is opened, if no write occurs within a configured interval (e.g., 1 minute), the hardware watchdog or software timer triggers a system reboot. Each write resets the timer.

7. events

32 event threads (events/0‑events/31) process kernel events such as power loss or file changes, dispatching them to interested listeners.

8. kblockd

32 block‑device threads (kblockd/0‑kblockd/31) manage block devices, periodically activating block‑device drivers.

9. aio

32 asynchronous I/O threads (aio/0‑aio/31) replace user‑space processes for I/O handling, supporting user‑mode AIO and should not be stopped.

10. rpciod

32 RPC daemon threads (rpciod/0‑rpciod/31) provide remote procedure call services, commonly used when starting NFS services.

Conclusion

Processes are a fundamental concept in operating systems; all running data is represented as processes. In Linux, any triggered event is defined as a process, making processes the sole implementation mechanism for Linux programs.