Hmm, one of the pretier things you could do if ya screenshot is to use htop and its tree view which shows what spawning process executed what -> obvious what is "father" of the kswapd :)