Processes & Signals
A process is a program running, with a number, a parent, an owner and a state. Signals are how you talk to one, and the process table is where you read what happened.
An interactive Linux lesson: 25 steps, about 32 minutes, on a live simulation in your browser.
You are on call for web01, the machine that runs the shop. Tonight a job will refuse to stop, a dead process will refuse to disappear and something will eat a whole CPU. Each of those is a question about processes, so start with what one is.
/usr/bin/ps is a program: a file on disk, 50462 bytes, doing nothing. Type ps and the kernel loads that file into memory and runs it. That running copy is a process, and the kernel gives it a number, the pid.
What you will learn
A program, running
- A program is a file. A process runs.: A program is a file. A process is one run of it: the kernel's record of that program in memory, with a pid.
- Four facts about every process: Every process has a pid, a parent, an owner and a state. Every process question starts by reading those four.
Reading the process table
- ps aux, column by column: Most processes are asleep most of the time. S means waiting, R means wanting CPU, and only R costs you anything.
- ps -ef, and choosing your own columns
- top, read as a snapshot: top is ps taken again and again. The Tasks line counts states, and a healthy machine is almost entirely asleep.
Where processes come from
- One tree, rooted at pid 1: The process table is one tree. Pid 1 is the root, and every other process was started by the one above it.
- Born in two steps: fork, then exec: fork copies the parent under a new pid; exec swaps the program inside that pid. Every process is a modified copy of its parent.
Signals are messages
- kill sends a request: A signal is a numbered message delivered by the kernel. kill PID sends SIGTERM, which is a request to exit.
- The process that ignores SIGTERM: SIGTERM can be caught or ignored. kill tells you the message was delivered, never that it was obeyed.
- Drill: the signal that cannot be refused
- Freeze it: SIGSTOP and SIGCONT: SIGSTOP freezes a process in place and SIGCONT resumes it. Nothing is lost in between, and the process cannot refuse either.
- Exit status: what a process says as it dies: Exit status 0 means success, anything else means failure. $? holds the last one, and scripts decide with it.
Foreground, background, hangup
- Foreground, and & for background: Foreground means the shell is waiting for the child. & means it is not. The process itself is the same either way.
- Ctrl+Z, bg and fg: Ctrl+Z is SIGTSTP, bg is SIGCONT, fg is the shell deciding to wait. Job control is signals plus waiting.
- Close the laptop: A background job still belongs to your terminal. When the terminal goes, SIGHUP arrives, and the default reaction is to exit.
- nohup: start it deaf to SIGHUP
Zombies and orphans
- Break it: a worker dies, and stays: A zombie is a dead child whose exit status nobody has collected. It holds a pid and a table entry and nothing else.
- Kill the zombie: You cannot kill what is already dead. A zombie is fixed at its parent: the parent reaps it, or the parent goes.
- Orphans are adopted by pid 1: When a parent dies, pid 1 adopts its children and reaps the dead ones. That is what finally removes a zombie.
The one eating the CPU
- Break it: the machine feels slow: Load average says whether something is wrong. top's first row says who. Read both before touching anything.
- Turn it down: nice and renice: Nice is a share under contention, not a speed limit. Users can only raise it; root can lower it.
- /proc: where ps and top get it all: /proc/PID is the kernel's live record of one process. ps, top and pgrep are formatters of those files.
- Drill: stop the runaway
Recap & playground
- Cheat sheet
- Playground