How does Linux tell threads apart from child processes?

From a task_struct perspective, a process’s threads have the same thread group leader (group_leader in task_struct), whereas child processes have a different thread group leader (each individual child process).

This information is exposed to user space via the /proc file system. You can trace parents and children by looking at the ppid field in /proc/${pid}/stat or .../status (this gives the parent pid); you can trace threads by looking at the tgid field in .../status (this gives the thread group id, which is also the group leader’s pid). A process’s threads are made visible in the /proc/${pid}/task directory: each thread gets its own subdirectory. (Every process has at least one thread.)

In practice, programs wishing to keep track of their own threads would rely on APIs provided by the threading library they’re using, instead of using OS-specific information. Typically on Unix-like systems that means using pthreads.

1. This runs the top command with some extra options:

   top -H -b -n 1
   

   • The -H argument instructs top to display each individual thread. Normally top summarizes all threads under their parent process.
   • The -b argument makes top run in batch mode – the information is gathered, displayed, and then dumped to stdout as opposed to running in an interactive mode and refreshing the data displayed.
   • With the -b option, the user must tell top how many times to run, this is done with the -n argument and a final argument with how many times to run.

   So top -H -b -n 1 instructs the system to “run top, display individual threads, run in batch mode, and only run once”.

2. The ps command reports a snapshot of currently running processes.

   ps -eLf
   

   The -eLf argument (can be used as -e -L -f as well) breaks down as follows:

   • e tells ps to display all processes regardless of who owns them or their current status – active, sleeping, paused, waiting for I/O, etc.
   • L tells ps to show individual threads
   • the f tells ps to format the output as a full-format listing, and in conjunction with the L argument the NLWP (number of threads) and LWP (thread ID) columns are added to the output.