BTW, i was asking this as i'm in the process of writing a comprehensive tutorial on linux kernel threads and this was just something i was curious about. On Sat, 22 Jun 2013, Randy MacLeod wrote: > > http://unix.stackexchange.com/questions/22121/what-do-the-brackets-around-processes-mean > > mentioned the man page is useful: > > Sometimes the process args will be unavailable; when this happens, > ps will instead print the executable name in brackets. (alias cmd, command). > > I guess that doesn't really answer what ps is _doing_ so let's see... > > Some other sites suggested that kernel threads can be identified by following the ppid > until you get to 1 (init) user thread or 0 kernel. > > looking at the output of: > strace -f -o /tmp/ps ps -p 2 u > wasn't much help and neither was: > ltrace -f -o /tmp/lps ps -p 2 u > > so I guess the next step would be to download procps http://procps.sourceforge.net/download.html > compile it in debug mode and set some breakpoints. > > // Randy heh, great minds think alike ... i already downloaded the procps tarball and was perusing it, but i still haven't nailed the snippet of code that does the actual recognition of a kernel thread to add those square brackets. i'm aware there are a number of ways to tell, i just haven't located which particular way is used by "ps". still looking ... rday -- ======================================================================== Robert P. J. Day Ottawa, Ontario, CANADA http://crashcourse.ca Twitter: http://twitter.com/rpjday LinkedIn: http://ca.linkedin.com/in/rpjday ========================================================================