TweetFollow Us on Twitter

The Process Tree

Volume Number: 19 (2003)
Issue Number: 8
Column Tag: Programming

Section 7

The Process Tree

by Rich Morin

Which processes do what

The initial design of Unix (by Ken Thompson, Dennis Ritchie, et al) was based on the idea that large jobs could be done by lots of little programs, working together. Part of the reason for this was that the available hardware had only minuscule amounts of RAM. Another part was the designers' dislike of large, monolithic programs.

Mac OS X inherits this modular approach. Most of its programs aren't "little", especially by the standards of early Unix, but there are certainly lots of them. On my freshly-booted desktop machine, I found 62:

% ps -ax | wc -l
      62

The command-line options (-ax) tell ps to show all processes, even if they belong to another user or have no controlling terminal. Using another of ps's many options, we can take a detailed look, concentrating on the commands and their parentage. Stretch a Terminal window really wide, then try:

% ps -axo pid,ppid,tt,user,command
  PID  PPID  TT  USER COMMAND
    1     0  ??  root /sbin/init
    2     1  ??  root /sbin/mach_init
   51     1  ??  root kextd
71     1  ??  root update
...
  539   536 std  root login -pf rdm
  540   539 std  rdm  -tcsh (tcsh)
1506   540 std  root ps -axo pid ppid tt user command
 674   536  p2  root login -pf rdm
 675   674  p2  rdm  -tcsh (tcsh)

The PID (Process ID) and PPID (Parent Process ID) columns allow us to guess at the "genealogy" of each process. If a process has PPID 1, for instance, its "parent" has PID 1. Note, however, that a PPID of 1 may also mean that the original parent process has terminated.

The TT ("terminal"; originally from teletype) column tells us the identity of the controlling terminal ("??" for none). Because most OSX applications have no controlling terminal, this field is insufficient to distinguish apps from background processes.

Fortunately, the USER (username) and COMMAND columns help to clear this up. Apps generally run with the username of the logged-in user; in addition, most apps have long path names which include directories such as "Applications". Also, the names of BSD-derived daemons often end in "d" (e.g., configd, cupsd).

If you're seriously interested in looking at processes (e.g., to figure out which one is bogging down your system :-), you should also investigate pstat(1), top(1), vm_stat(1). Apple's Process Viewer utility is also handy, but note that it may not report information in a manner that is consistent with the command-line tools. For example, it shows a process named "Window Manager", which ps(1) and top(1) do not list...

Background processes

When OSX starts up, it initiates a number of background processes (commonly referred to as "daemons", after the "attendant spirits" found in Greek mythology). Because these daemons have low Process IDs, they appear at the start of the listing.

Note: Although OSX uses a 32-bit value (pid_t) for process IDs, it "wraps" the IDs at ~32K, so a ps(1) listing taken from a long-running (and/or busy) system may show other processes with low IDs. Interestingly, FreeBSD does not seem to limit IDs in this manner.

Most daemons are started up by init(8), as part of the system start-up process. This accounts for the long list of processes whose PPID is 1. Scattered in this list, however, you may see a few processes with PPIDs of 2, indicating that they are children of mach_init(8). Finally, some applications (e.g., iChat) and daemons (e.g., loginwindow, WindowServer) start up their own daemons.

Here's an annotated list of some background processes that show up on my machine. Lacking any other organizing rationale, I'll use alphabetical order. If nothing else, that will make the list easy to navigate (:-):

    AppleFileServer - personal file sharing server; supports AppleTalk Filing Protocol (AFP) over Internet Protocol (IP).

    ATSServer - Apple Type Solution server; enables system-wide font management.

    autodiskmount(8) - checks and mounts disk-based file systems.

    automount - automatically mounts and unmounts network (NFS and AFP) file systems. See amd(8) for information on the traditional (NFS-only) variant of this daemon.

    configd - maintains dynamic configuration information about the computer and its environment (e.g. network).

    coreservicesd - core services daemon.

    crashreporterd - logs information about program crashes.

    cron(8) - executes scheduled commands. See also crontab(1,5).

    cupsd(8) - Common Unix Printing System daemon. Run "apropos cups" to see an extensive list of man pages.

    DirectoryService - directory server for Apple's Open Directory architecture.

    dynamic_pager - assists the kernel with managing swap files for virtual memory.

    httpd(8) - Apache hypertext transfer protocol server; may be replicated, for performance. Run "apropos http" to see an extensive list of man pages.

    inetd(8) - internet "super-server"; listens for connections on certain internet sockets. When a connection is found on one of its sockets, it decides what service the socket corresponds to, and invokes a program to service the request.

    kextd(8) - handles requests from the kernel to load kernel extensions (kexts).

    loginwindow - handles miscellaneous process- and session-monitoring functions (e.g., login, logout, restart, shutdown, and restarting of the Dock and Finder).

    lookupd(8) - caches directory service information (e.g., user accounts, groups, printers, e-mail aliases and distribution lists, computer names, Internet addresses).

    mDNSResponder - multicast-DNS responder; advertises network services (such as AFP file sharing) provided by this computer (part of Rendezvous).

    netinfod(8) - serves NetInfo information to the network. Run "apropos netinfo" to see an extensive list of man pages.

    nfsiod(8) - typically, several copies of this daemon will be running on any NFS client machine, servicing asynchronous I/O requests. This daemon improves NFS performance, but it is not required for correct operation. Run "apropos nfs" to see an extensive list of man pages (but ignore the bogus hits for config(5) and confstr(3) :-).

    ntpd(8:FreeBSD) - Network Time Protocol (NTP) daemon; sets and maintains the system time of day in synchronism with Internet standard time servers.

    pbs - pasteboard server (similar to the Clipboard in Mac OS 9); enables the exchange of data between applications. It is also the data-transfer mechanism used in dragging operations. (started by loginwindow).

    SecurityServer - oversees system authorization, authentication, and keychain access.

    slpd - Service Location Protocol (SLP) responder; advertises network services (such as AFP file sharing) provided by this computer.

    sshd(8) - with ssh(1), replaces rlogin(1) and rsh(1), providing secure encrypted communications between two untrusted hosts over an insecure network. Run "apropos ssh" to see an extensive list of man pages.

    syslogd(8) - reads and logs messages to the system console, log files, other machines, and/or users as specified by syslog.conf(5), its configuration file. See also syslog(3).

    SystemUIServer - displays items on the right-hand end of the menu bar; loads menu and dock extras as plug-ins (started by WindowServer).

    update(8) - helps protect the integrity of disk volumes by flushing volatile cached file system data to disk at thirty second intervals.

    WindowServer - responsible for rudimentary screen displays, window compositing and management, event routing, and cursor management. It coordinates low-level windowing behavior and enforces a fundamental uniformity in what appears on the screen.

Interactive Processes

Most apps are children of the WindowServer daemon. Their names should be quite familiar: Dock, Finder, iChat, Preview, Terminal. As noted above, some apps start up their own daemons. For example, iChat starts up iChatAgent (probably to handle communications).

The lineage for command-line programs is a bit more complex. Assuming that you're using Terminal, it should look something like this:

PID PPID  TT  USER COMMAND
173    1  ??  rdm  .../WindowServer ...
536  173  ??  rdm  .../Terminal ...
539  536  p1  root login -pf rdm
540  539  p1  rdm  -tcsh (tcsh)
873  540  p1  root top

As these lines show, init(8) started up WindowServer, which started up the Terminal. Then, to generate an interactive shell window, Terminal started up login, which started up tcsh(1). Finally, I ran top(1) from the command line.

Careful Reader will notice that the username for login and top is root, rather than rdm. Because these processes need to do some things which a normal user is not allowed to do, they have been created as setuid(2) executables:

% ls -l /usr/bin/{login,top}
-r-sr-xr-x 1 root wheel ... /usr/bin/login
-r-sr-xr-x 1 root wheel ... /usr/bin/top

Further Reading

In a traditional BSD system, the first place to look for information on commands and daemons would be the manual. Unfortunately, many OSX commands and daemons do not have accompanying manual pages. Even when man pages are present, they may not be up-to-date, let alone customized to reflect changes which Apple has made, other documentation it has developed, etc.

A comprehensive attack on this problem has been suggested by parties inside and outside of Apple, but (AFAIK) no significant effort has been made as yet. If you would like better manual pages, let ADC (etc.) know!

In the meanwhile, here are some places where I found useful information for this section:

http://www.westwind.com/reference/OS-X/background-processes.html

http://developer.apple.com/techpubs/macosx/Essentials/SystemOverview/ BootingLogin/chapter_4_section_5.html


Rich Morin has been using computers since 1970, Unix since 1983, and Mac-based Unix since 1986 (when he helped Apple create A/UX 1.0). When he isn't writing this column, Rich runs Prime Time Freeware (www.ptf.com), a publisher of books and CD-ROMs for the Free and Open Source software community. Feel free to write to Rich at rdm@ptf.com.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

Apple macOS Sierra 10.12.3 - The latest...
With Apple macOS Sierra, Siri makes its debut on Mac, with new features designed just for the desktop. Your Mac works with iCloud and your Apple devices in smart new ways, and intelligent... Read more
Lyn 1.8.5 - Lightweight image browser an...
Lyn is a fast, lightweight image browser and viewer designed for photographers, graphic artists, and Web designers. Featuring an extremely versatile and aesthetically pleasing interface, it delivers... Read more
iClock Pro 3.4.7 - Customize your menuba...
iClock Pro is a menu bar replacement clock for Apple's default clock. iClock Pro is an update, total rewrite and improvement to the popular iClock. Have the day, date and time in different fonts and... Read more
Opera 42.0.2393.137 - High-performance W...
Opera is a fast and secure browser trusted by millions of users. With the intuitive interface, Speed Dial and visual bookmarks for organizing favorite sites, news feature with fresh, relevant content... Read more
Apple Security Update 2016-003 Supplemen...
Apple Security Update is recommended for all users and improves the security of OS X. For detailed information about the security content of this update, please visit: http://support.apple.com/kb/... Read more
Apple iOS 10.2.1 - The latest version of...
iOS 10 is the biggest release of iOS ever. A massive update to Messages brings the power of the App Store to your conversations and makes messaging more personal than ever. Find your route with... Read more
BetterTouchTool 1.992 - Customize Multi-...
BetterTouchTool adds many new, fully customizable gestures to the Magic Mouse, Multi-Touch MacBook trackpad, and Magic Trackpad. These gestures are customizable: Magic Mouse: Pinch in / out (zoom... Read more
Viber 6.5.5 - Send messages and make cal...
Viber lets you send free messages and make free calls to other Viber users, on any device and network, in any country! Viber syncs your contacts, messages and call history with your mobile device, so... Read more
Lyn 1.8.5 - Lightweight image browser an...
Lyn is a fast, lightweight image browser and viewer designed for photographers, graphic artists, and Web designers. Featuring an extremely versatile and aesthetically pleasing interface, it delivers... Read more
Apple iOS 10.2.1 - The latest version of...
iOS 10 is the biggest release of iOS ever. A massive update to Messages brings the power of the App Store to your conversations and makes messaging more personal than ever. Find your route with... Read more

Clash Royale gets some serious balance u...
| Read more »
Ironhide Game Studio prepares for a busy...
Kingdom Rush breathed fresh life into the tired tower defense genre way back in 2012. The game was a robust challenge that somehow managed to lift you up, rather than leaving you feeling crushed and hopeless. The rich array of unit types and... | Read more »
Collect pets and sling arrows in Arcane...
Mobile gaming is a crowded market, but regular updates are a good way to keep us attention-short players keen. The brand new content in Arcane Online is a prime example. Published by Japanese developer Gala, Arcane Online is a fantasy MMO that... | Read more »
Super Mario Run dashes onto Android in M...
Super Mario Run was one of the biggest mobile launches in 2016 before it was met with a lukewarm response by many. While the game itself plays a treat, it's pretty hard to swallow the steep price for the full game. With that said, Android users... | Read more »
WarFriends Beginner's Guide: How to...
Chillingo's new game, WarFriends, is finally available world wide, and so far it's a refreshing change from common mobile game trends. The game's a mix of tower defense, third person shooter, and collectible card game. There's a lot to unpack here... | Read more »
Super Gridland (Entertainment)
Super Gridland 1.0 Device: iOS Universal Category: Entertainment Price: $1.99, Version: 1.0 (iTunes) Description: Match. Build. Survive. "exquisitely tuned" - Rock Paper Shotgun No in-app purches, and no ads! | Read more »
Red's Kingdom (Games)
Red's Kingdom 1.0 Device: iOS Universal Category: Games Price: $4.99, Version: 1.0 (iTunes) Description: Mad King Mac has kidnapped your father and stolen your golden nut! Solve puzzles and battle goons as you explore and battle your... | Read more »
Turbo League Guide: How to tame the cont...
| Read more »
Fire Emblem: Heroes coming to Google Pla...
Nintendo gave us our first look at Fire Emblem: Heroes, the upcoming mobile Fire Emblem game the company hinted at last year. Revealed at the Fire Emblem Direct event held today, the game will condense the series' tactical RPG combat into bite-... | Read more »
ReSlice (Music)
ReSlice 1.0 Device: iOS Universal Category: Music Price: $9.99, Version: 1.0 (iTunes) Description: Audio Slice Machine Slice your audio samples with ReSlice and create flexible musical atoms which can be triggered by MIDI notes or... | Read more »

Price Scanner via MacPrices.net

Deal alert! 13-inch 2.0GHz MacBook Pros for $...
B&H Photo has the new 2016 13″ 2.0GHz non-Touch Bar MacBook Pros in stock today and on sale for $225 off MSRP. Shipping is free, and B&H charges NY sales tax only: - 13″ 2.0GHz MacBook Pro... Read more
Free LibreOffice Portable 5.2.4 Complete Offi...
PortableApps.com and The Document Foundation have announce the release of LibreOffice Portable 5.2.4. LibreOffice Portable is an Open Source full-featured office suite — including a word processor,... Read more
Apple Planning Three New Tablets For 2017 – D...
Digitimes’ Rebecca Kuo and Joseph Tsai say that unnamed insider sources report Apple having three new tablets in the pipeline for 2017 release: a 9.7-inch model with a friendly price range, a new mid... Read more
Roundup of 15-inch Touch Bar MacBook Pro sale...
B&H Photo has the new 2016 15″ Apple Touch Bar MacBook Pros in stock today and on sale for up to $150 off MSRP. Shipping is free, and B&H charges NY sales tax only: - 15″ 2.7GHz Touch Bar... Read more
Apple refurbished iPad Pros available for up...
Apple has Certified Refurbished 9″ and 12″ Apple iPad Pros available for up to $160 off the cost of new iPads. An Apple one-year warranty is included with each model, and shipping is free: - 32GB 9″... Read more
16GB iPad Air 2, Apple refurbished, available...
Apple has Certified Refurbished 16GB iPad Air 2s available for $319 including free shipping. A standard Apple one-year is included. Their price is $60 off original MSRP for this model. Read more
Apple iMacs on sale for up to $120 off MSRP
B&H Photo has 21″ and 27″ Apple iMacs on sale for up to $120 off MSRP, each including free shipping plus NY sales tax only: - 27″ 3.3GHz iMac 5K: $2199 $100 off MSRP - 27″ 3.2GHz/1TB Fusion iMac... Read more
Apple refurbished Apple TVs available for up...
Apple has Certified Refurbished 32GB and 64GB Apple TVs available for up to $30 off the cost of new models. Apple’s standard one-year warranty is included with each model, and shipping is free: -... Read more
Save up to $350 with Apple Certified Refurbis...
Apple has Certified Refurbished 2015 21″ & 27″ iMacs available for up to $350 off MSRP. Apple’s one-year warranty is standard, and shipping is free. The following models are available: - 21″ 3.... Read more
2015 12-inch Retina MacBooks, Apple refurbish...
Apple has Certified Refurbished 2015 12″ Retina MacBooks available for up to $410 off original MSRP. Apple will include a standard one-year warranty with each MacBook, and shipping is free. The... Read more

Jobs Board

*Apple* & PC Desktop Support Technician...
Apple & PC Desktop Support Technician job in Manhattan, NY Introduction: We have immediate job openings for several Desktop Support Technicians with one of our most Read more
*Apple* & PC Desktop Support Technician...
Apple & PC Desktop Support Technician job in Stamford, CT We have immediate job openings for several Desktop Support Technicians with one of our most well-known Read more
*Apple* Retail - Multiple Positions - Apple,...
Job Description: Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
*Apple* Site Security Manager - Apple (Unite...
# Apple Site Security Manager Job Number: 54692472 Culver City, California, United States Posted: Jan. 19, 2017 Weekly Hours: 40.00 **Job Summary** The Apple Read more
*Apple* macOS Systems Integration Administra...
…most exceptional support available in the industry. SCI is seeking an Junior Apple macOS systems integration administrator that will be responsible for providing Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.