$ ps -ef
UID PID PPID C STIME TTY TIME CMD
root 1 0 0 Jan29 ? 00:00:36 /sbin/init
root 2 0 0 Jan29 ? 00:00:01 [kthreadd]
root 3 2 0 Jan29 ? 00:01:51 [ksoftirqd/0]
root 5 2 0 Jan29 ? 00:00:00 [kworker/0:0H]
root 7 2 0 Jan29 ? 00:03:54 [rcu_sched]
root 8 2 0 Jan29 ? 00:00:00 [rcu_bh]
root 9 2 0 Jan29 ? 00:00:00 [migration/0]
root 10 2 0 Jan29 ? 00:00:07 [watchdog/0]
root 11 2 0 Jan29 ? 00:00:00 [kdevtmpfs]
root 12 2 0 Jan29 ? 00:00:00 [netns]
root 13 2 0 Jan29 ? 00:00:00 [perf]
root 14 2 0 Jan29 ? 00:00:00 [khungtaskd]
root 15 2 0 Jan29 ? 00:00:00 [writeback]
root 16 2 0 Jan29 ? 00:00:00 [ksmd]
root 17 2 0 Jan29 ? 00:00:00 [khugepaged]
root 18 2 0 Jan29 ? 00:00:00 [crypto]
root 19 2 0 Jan29 ? 00:00:00 [kintegrityd]
root 20 2 0 Jan29 ? 00:00:00 [bioset]
root 21 2 0 Jan29 ? 00:00:00 [kblockd]
root 22 2 0 Jan29 ? 00:00:00 [ata_sff]
root 23 2 0 Jan29 ? 00:00:00 [md]
root 24 2 0 Jan29 ? 00:00:00 [devfreq_wq]
root 28 2 0 Jan29 ? 00:00:00 [kswapd0]
root 29 2 0 Jan29 ? 00:00:00 [vmstat]
root 30 2 0 Jan29 ? 00:00:00 [fsnotify_mark]
root 31 2 0 Jan29 ? 00:00:00 [ecryptfs-kthrea]
root 47 2 0 Jan29 ? 00:00:00 [kthrotld]
root 48 2 0 Jan29 ? 00:00:00 [acpi_thermal_pm]
root 49 2 0 Jan29 ? 00:00:00 [vballoon]
root 50 2 0 Jan29 ? 00:00:00 [bioset]
root 51 2 0 Jan29 ? 00:00:00 [bioset]
root 52 2 0 Jan29 ? 00:00:00 [bioset]
root 53 2 0 Jan29 ? 00:00:00 [bioset]
root 54 2 0 Jan29 ? 00:00:00 [bioset]
root 55 2 0 Jan29 ? 00:00:00 [bioset]
root 56 2 0 Jan29 ? 00:00:00 [bioset]
root 57 2 0 Jan29 ? 00:00:00 [bioset]
root 58 2 0 Jan29 ? 00:00:00 [bioset]
root 59 2 0 Jan29 ? 00:00:00 [scsi_eh_0]
root 60 2 0 Jan29 ? 00:00:00 [scsi_tmf_0]
root 61 2 0 Jan29 ? 00:00:00 [scsi_eh_1]
root 62 2 0 Jan29 ? 00:00:00 [scsi_tmf_1]
root 68 2 0 Jan29 ? 00:00:00 [ipv6_addrconf]
root 81 2 0 Jan29 ? 00:00:00 [deferwq]
root 82 2 0 Jan29 ? 00:00:00 [charger_manager]
root 83 2 0 Jan29 ? 00:00:00 [bioset]
root 124 2 0 Jan29 ? 00:00:00 [bioset]
root 125 2 0 Jan29 ? 00:00:00 [bioset]
root 126 2 0 Jan29 ? 00:00:00 [bioset]
root 127 2 0 Jan29 ? 00:00:00 [bioset]
root 129 2 0 Jan29 ? 00:00:00 [bioset]
root 130 2 0 Jan29 ? 00:00:00 [bioset]
root 131 2 0 Jan29 ? 00:00:00 [bioset]
root 132 2 0 Jan29 ? 00:00:00 [bioset]
root 133 2 0 Jan29 ? 00:00:00 [kpsmoused]
root 147 2 0 Jan29 ? 00:00:00 [ttm_swap]
root 236 2 0 Jan29 ? 00:00:00 [raid5wq]
root 271 2 0 Jan29 ? 00:00:00 [bioset]
root 297 2 0 Jan29 ? 00:00:18 [kworker/0:1H]
root 299 2 0 Jan29 ? 00:00:40 [jbd2/vda1-8]
root 300 2 0 Jan29 ? 00:00:00 [ext4-rsv-conver]
root 356 1 0 Jan29 ? 00:06:06 /lib/systemd/systemd-journald
root 382 2 0 Jan29 ? 00:00:00 [kauditd]
root 384 2 0 Jan29 ? 00:00:00 [iscsi_eh]
root 387 2 0 Jan29 ? 00:00:00 [ib_addr]
root 404 1 0 Jan29 ? 00:00:00 /sbin/lvmetad -f
root 406 2 0 Jan29 ? 00:00:00 [ib_mcast]
root 407 2 0 Jan29 ? 00:00:00 [ib_nl_sa_wq]
root 409 2 0 Jan29 ? 00:00:00 [ib_cm]
root 413 2 0 Jan29 ? 00:00:00 [iw_cm_wq]
root 414 2 0 Jan29 ? 00:00:00 [rdma_cm]
root 426 1 0 Jan29 ? 00:00:01 /lib/systemd/systemd-udevd
root 953 1 0 Jan29 ? 00:05:35 /usr/sbin/smbd -D
root 980 953 0 Jan29 ? 00:00:00 /usr/sbin/smbd -D
root 981 1 0 Jan29 ? 00:00:00 /sbin/dhclient -1 -v -pf /run/dhclient.eth0.pid -lf /var/lib/dhcp/dhclient.eth0.leases -I -df /var/lib/dhcp/dhclient6.eth0.l
root 1052 953 0 Jan29 ? 00:00:04 /usr/sbin/smbd -D
root 1067 1 0 Jan29 ? 00:00:00 /usr/sbin/acpid
root 1076 1 0 Jan29 ? 00:00:01 /lib/systemd/systemd-logind
message+ 1078 1 0 Jan29 ? 00:00:00 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation
syslog 1080 1 0 Jan29 ? 00:01:49 /usr/sbin/rsyslogd -n
root 1082 1 0 Jan29 ? 00:02:06 /usr/lib/accountsservice/accounts-daemon
root 1084 1 0 Jan29 ? 00:00:11 /usr/sbin/cron -f
daemon 1088 1 0 Jan29 ? 00:00:00 /usr/sbin/atd -f
root 1173 1 0 Jan29 ? 00:00:44 /sbin/iscsid
root 1224 1 0 Jan29 ? 00:03:38 /sbin/iscsid
root 1246 1 0 Jan29 ? 00:00:00 /sbin/mdadm --monitor --pid-file /run/mdadm/monitor.pid --daemonise --scan --syslog
root 1254 1 0 Jan29 ? 00:01:51 /usr/sbin/sshd -D
root 1262 1 0 Jan29 ? 00:00:00 /usr/lib/policykit-1/polkitd --no-debug
root 1353 1 0 Jan29 ttyS0 00:00:00 /sbin/agetty --keep-baud 115200 38400 9600 ttyS0 vt220
root 1354 1 0 Jan29 tty1 00:00:00 /sbin/agetty --noclear tty1 linux
root 1369 1 0 Jan29 ? 00:00:21 /usr/sbin/nmbd -D
ntp 1389 1 0 Jan29 ? 00:01:27 /usr/sbin/ntpd -p /var/run/ntpd.pid -g -u 111:117
root 1601 1 0 Jan29 ? 00:00:24 barad_agent
root 1607 1601 0 Jan29 ? 00:24:09 barad_agent
root 1608 1601 0 Jan29 ? 01:57:37 barad_agent
root 2363 1254 0 Feb22 ? 00:00:00 sshd: ubuntu [priv]
ubuntu 2414 2363 0 Feb22 ? 00:00:00 sshd: ubuntu@pts/1
ubuntu 2415 2414 0 Feb22 pts/1 00:00:00 -bash
root 4657 2 0 10:50 ? 00:00:00 [kworker/u2:1]
ubuntu 5516 22141 0 10:55 pts/0 00:00:00 ./app
root 6728 953 0 11:02 ? 00:00:00 /usr/sbin/smbd -D
root 6822 1608 0 11:03 ? 00:00:00 /bin/sh -c ntpdate -b -d ntpupdate.tencentyun.com 2>&1 | grep 'step time server' | sed -r 's/.*offset(.*)sec.*/\1/'
root 6823 6822 0 11:03 ? 00:00:00 ntpdate -b -d ntpupdate.tencentyun.com
root 6824 6822 0 11:03 ? 00:00:00 grep step time server
root 6825 6822 0 11:03 ? 00:00:00 sed -r s/.*offset(.*)sec.*/\1/
ubuntu 6842 2415 0 11:03 pts/1 00:00:00 ps -ef
root 12554 2 0 05:19 ? 00:00:00 [kworker/0:2]
ubuntu 19343 1 0 Feb22 ? 00:00:00 /lib/systemd/systemd --user
ubuntu 19344 19343 0 Feb22 ? 00:00:00 (sd-pam)
root 21455 2 0 06:10 ? 00:00:01 [kworker/0:1]
root 22054 1254 0 09:22 ? 00:00:00 sshd: ubuntu [priv]
ubuntu 22140 22054 0 09:22 ? 00:00:00 sshd: ubuntu@pts/0
ubuntu 22141 22140 0 09:22 pts/0 00:00:00 -bash
root 25087 2 0 06:30 ? 00:00:01 [kworker/u2:0]
root 29367 1 0 Feb02 ? 00:00:11 /usr/local/qcloud/stargate/bin/sgagent -d
root 30120 1254 0 Feb23 ? 00:00:00 sshd: ubuntu [priv]
ubuntu 30172 30120 0 Feb23 ? 00:00:00 sshd: ubuntu@pts/2
ubuntu 30175 30172 0 Feb23 pts/2 00:00:00 -bash
root 30313 1 0 Feb09 ? 01:12:04 /usr/local/qcloud/YunJing/YDEyes/YDService
root 30347 30313 0 Feb09 ? 00:22:18 /usr/local/qcloud/YunJing/YDEdr
root 30380 1 0 Feb09 ? 00:00:59 /usr/local/qcloud/YunJing/YDLive/YDLive
我们可以通过 ps -ef 命令查看当前系统启动的进程,我们会发现有三类进程。
你会发现,PID 1 的进程就是我们的 init 进程 systemd,PID 2 的进程是内核线程 kthreadd,这两个我们在内核启动的时候都见过。
其中用户态的不带中括号,内核态的带中括号。接下来进程号依次增大,但是你会看所有带中括号的内核态的进程,祖先都是 2 号进程。
而用户态的进程,祖先都是 1 号进程。tty 那一列,是问号的,说明不是前台启动的,一般都是后台的服务。
pts 的父进程是 sshd,bash 的父进程是 pts,ps -ef 这个命令的父进程是 bash。这样整个链条都比较清晰了。