Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

If I run the command ps or top, do they only list processes or do they list both services and processes? How do you tell whether a given row represents a process or service?

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

First of all, the term service is rarely used in a Linux environment. More common is the term daemon.

While both terms describe the same kind of application, the term service does have some properties attached to it by the use of the term in the Windows environment.

What distinguishes a daemon from a normal process is simply that a daemon is a background process and is not interacted with by the user. But what is most important is that the term daemon is just that, a term. There is, to my knowledge, no flag in Linux that tells it "This process is a daemon".

So daemons aren't in any way special. We just call a certain type of program a daemon. That's also why there is no distinction being made by ps or top.

But if you want to know which of your currently running processes is most likely what we think of when thinking of a daemon, try ps axjf:

oliver@ubuntuServer:~$ ps axjf
 PPID   PID  PGID   SID TTY      TPGID STAT   UID   TIME COMMAND
    0     2     0     0 ?           -1 S        0   0:00 [kthreadd]
    2     3     0     0 ?           -1 S        0   0:01  \_ [ksoftirqd/0]
    2     5     0     0 ?           -1 S        0   0:00  \_ [kworker/u:0]
    2     6     0     0 ?           -1 S        0   0:00  \_ [migration/0]
    2     7     0     0 ?           -1 S        0   0:00  \_ [migration/1]
    2     9     0     0 ?           -1 S        0   0:00  \_ [ksoftirqd/1]
    2    10     0     0 ?           -1 S        0   0:09  \_ [kworker/0:1]
    2    11     0     0 ?           -1 S        0   0:00  \_ [migration/2]
    2    12     0     0 ?           -1 S        0   0:00  \_ [kworker/2:0]
    2    13     0     0 ?           -1 S        0   0:00  \_ [ksoftirqd/2]
    2    14     0     0 ?           -1 S        0   0:00  \_ [migration/3]
    2    15     0     0 ?           -1 S        0   0:00  \_ [kworker/3:0]
    2    16     0     0 ?           -1 S        0   0:00  \_ [ksoftirqd/3]
    2    17     0     0 ?           -1 S<       0   0:00  \_ [cpuset]
    2    18     0     0 ?           -1 S<       0   0:00  \_ [khelper]
    2    19     0     0 ?           -1 S<       0   0:00  \_ [netns]
    2    20     0     0 ?           -1 S        0   0:00  \_ [kworker/u:1]
    2    21     0     0 ?           -1 S        0   0:00  \_ [sync_supers]
    2    22     0     0 ?           -1 S        0   0:00  \_ [bdi-default]
    2    23     0     0 ?           -1 S<       0   0:00  \_ [kintegrityd]
    2    24     0     0 ?           -1 S<       0   0:00  \_ [kblockd]
    2    25     0     0 ?           -1 S<       0   0:00  \_ [ata_sff]
    2    26     0     0 ?           -1 S        0   0:00  \_ [khubd]
    2    27     0     0 ?           -1 S<       0   0:00  \_ [md]
    2    28     0     0 ?           -1 S        0   0:00  \_ [khungtaskd]
    2    29     0     0 ?           -1 S        0   0:00  \_ [kworker/3:1]
    2    30     0     0 ?           -1 S        0   0:03  \_ [kswapd0]
    2    31     0     0 ?           -1 SN       0   0:00  \_ [ksmd]
    2    32     0     0 ?           -1 SN       0   0:00  \_ [khugepaged]
    2    33     0     0 ?           -1 S        0   0:00  \_ [fsnotify_mark]
    2    34     0     0 ?           -1 S        0   0:00  \_ [ecryptfs-kthrea]
    2    35     0     0 ?           -1 S<       0   0:00  \_ [crypto]
    2    43     0     0 ?           -1 S<       0   0:00  \_ [kthrotld]
    2    44     0     0 ?           -1 S        0   0:00  \_ [scsi_eh_0]
    2    45     0     0 ?           -1 S        0   0:00  \_ [scsi_eh_1]
    2    67     0     0 ?           -1 S        0   0:00  \_ [kworker/1:1]
    2    68     0     0 ?           -1 S        0   0:09  \_ [kworker/0:2]
    2   110     0     0 ?           -1 S        0   0:00  \_ [kworker/1:2]
    2   190     0     0 ?           -1 S        0   0:00  \_ [scsi_eh_2]
    2   208     0     0 ?           -1 S        0   0:00  \_ [kworker/2:1]
    2   218     0     0 ?           -1 S<       0   0:00  \_ [kdmflush]
    2   235     0     0 ?           -1 S<       0   0:00  \_ [kdmflush]
    2   243     0     0 ?           -1 S        0   0:13  \_ [jbd2/dm-0-8]
    2   244     0     0 ?           -1 S<       0   0:00  \_ [ext4-dio-unwrit]
    2   508     0     0 ?           -1 S<       0   0:00  \_ [kpsmoused]
    2 20477     0     0 ?           -1 S        0   0:00  \_ [flush-252:0]
    0     1     1     1 ?           -1 Ss       0   0:00 /sbin/init
    1   303   302   302 ?           -1 S        0   0:00 upstart-udev-bridge --daemon
    1   306   306   306 ?           -1 Ss       0   0:00 udevd --daemon
  306   438   306   306 ?           -1 S        0   0:00  \_ udevd --daemon
  306   445   306   306 ?           -1 S        0   0:00  \_ udevd --daemon
    1   562   541   541 ?           -1 Sl     101   0:04 rsyslogd -c5
    1   600   599   599 ?           -1 S        0   0:00 upstart-socket-bridge --daemon
    1   612   612   612 ?           -1 Ss     102   0:00 dbus-daemon --system --fork --activation=upstart

This is part of the output of a relatively fresh Ubuntu server installation. The output should be hierarchical, which should make it easier to identify system processes.

Like in this part of the same ps output. You can clearly see, the chain started with the sshd (the SSH daemon), into which I logged in and created a user session for myself. In that, bash was started and in bash I have a background vi process and my ps I just executed.

 8053 20352 20352 20352 ?           -1 Ss       0   0:00  \_ sshd: oliver [priv]
20352 20378 20352 20352 ?           -1 S     1000   0:00      \_ sshd: oliver@pts/0
20378 20379 20379 20379 pts/0    20570 Ss    1000   0:00          \_ -bash
20379 20569 20569 20379 pts/0    20570 T     1000   0:00              \_ vi
20379 20570 20570 20379 pts/0    20570 R+    1000   0:00              \_ ps axjf

So, looking at those two pieces of ps output, you should be able to clearly distinguish between daemons and user processes.

share|improve this answer
    
Thanks. Is it fair or safe to assume then that every application is part of a daemon or can a process run without a daemon? –  PeanutsMonkey Mar 13 '12 at 18:04
    
There will always be something else that starts a process. At the very least, that's the kernel. So, I guess, the answer to your question is dependent on if you consider the kernel to be a daemon. –  Oliver Salzburg Mar 13 '12 at 18:09
    
When you say it is dependent whether I consider the kernel a daemon, do you mean to say that the use of the term daemon is loose? –  PeanutsMonkey Mar 13 '12 at 19:38
    
In my personal opinion, yes. –  Oliver Salzburg Mar 13 '12 at 19:44
    
Some of the sources I read today define a daemon as a process whose parent has the pid 1 (which would be the init process). But what about a process that I would spawn into the background (some applications have --daemon options)? Is that not a daemon? In my personal opinion the term is applied somewhat loosely. –  Oliver Salzburg Mar 13 '12 at 19:52
add comment

Services are processes, so yes, both are listed by ps. They are just not distinguished clearly. A service is a process that listens for requests or connections.

You can use netstat to list processes that are listening (and which are therefore part of a service)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.