different process count ps vs /proc?

[Alex Dyas]

Hi all,

I'm confused.

I've always understood /proc to present a representation of all the running 
processes.  So for instance

# ls /proc | grep "^[0-9]" | wc -l

would give me a count of the processes running on the box.  And

# ps aux | wc -l

should give me the same count (give or take a few for ps headings and processes 
starting/stopping in between etc).

However, we have a box that shows a big discrepancy between the two, ~150 for 
/proc and ~80 for ps.  And I can't figure out why.

I thought at first the box had been compromised, maybe a hacked ps, but a 
reasonably extensive look around doesn't show anything odd.  Further more a 
'pstree -Gc' shows up a large number of processes that aren't in ps.  These seem 
to belong to Coldfusion (!).  Investigating /proc more thoroughly confirms this.

So, why the difference between ps and proc?  And what is so special about these 
processes that means they don't show up in ps?  Someone suggested they may be 
threads, not full blown processes, but in that case why do they show up in /proc?

Red Hat Linux release 9 (Shrike) , Linux foo 2.4.20-8smp #1 SMP Thu Mar 13 
17:45:54 EST 2003 i686 i686 i386 GNU/Linux

Cheers,

Alex..

-- 
-= Alex Dyas, DC Ops, PSINet Europe, Geneva =-