Re: Detecting threads vs processes with ps or /proc

[Robert Love <rml@tech9.net>]

On Fri, 2002-12-06 at 14:56, Nick LeRoy wrote:

> I was considerring doing something like this as well.  From your
> experience,  does it work reliably?

It never fails to detect threads (no false negatives).

It does sometimes detect child processes that forked but did not exec as
threads (false positives).  The failure case is when a program forks,
does not call exec, and the children go on to execute the exact same
code (so they look and act just like threads, but they have unique
addresses spaces).

One thing to note: if you can modify the kernel and procps, you can just
export the value of task->mm out of /proc.  It is a gross hack, and
perhaps a security issue, but that will work 100%.  Same ->mm implies
thread.

> Do you need to apply a small 'fudge factor' (aka 
> VMsize.1 ~= VMsize.2)?

No, they need to be exact.  The stats are pulled from the same structure
in the kernel so they need to be perfect.

> > It is the default behavior.  Flag `-m' turns it off.
> >
> > See thread_group() and flag_threads().
> 
> I assume these are functions in the tools themselves?

Yep.  Both ps and top have support.  There is a patch on the website
that added the feature, so you can take a look at that.

Red Hat 8.0 has support in their version of procps 2.0.7, too. 
Otherwise it was added in 2.0.8.  The current version is 2.0.10.

We have a mailing list at procps-list@redhat.com where this sort of
discussion is welcome.

	Robert Love