Skip to main content

Process Management

A process is simply an executing instance of a program. Managing these processes is a fundamental task for the Linux kernel and system administrators.

Process Attributes​

Every process in Linux is identified and managed by several attributes:

  • PID (Process ID): A unique numerical identifier assigned by the kernel.
  • PPID (Parent Process ID): The PID of the process that created (spawned) this process.
  • User/Group ID: The identity under which the process is running, which dictates its permissions.
  • State: The current condition of the process.

Process States​

A process transitions through various states during its lifecycle:

  1. Running (R): The process is actively executing on a CPU or is waiting in the queue to be executed.
  2. Sleeping (S / D): The process is waiting for something.
    • Interruptible Sleep (S): Waiting for an event or signal (e.g., waiting for user input or network data). It can be woken up by a signal.
    • Uninterruptible Sleep (D): Waiting for a specific hardware condition, typically disk I/O. It cannot be killed or interrupted until the I/O completes.
  3. Stopped (T): The process has been suspended (e.g., by pressing Ctrl+Z in the terminal). It is completely halted but kept in memory.
  4. Zombie (Z): The process has terminated, but its parent process has not yet read its exit status. A zombie is dead and consumes no CPU or memory, but it occupies a slot in the process table. If the parent dies, zombies are adopted and cleaned up by systemd (PID 1).

Foreground vs. Background​

When working in a terminal:

  • Foreground: A command running in the foreground blocks the terminal until it finishes.
  • Background: You can run a command in the background by appending an ampersand & to it (e.g., tar -czf backup.tar.gz /var/www &). This returns the prompt immediately while the command runs.

You can manage these jobs using shell built-ins:

  • jobs: Lists background tasks in the current terminal.
  • fg %jobnumber: Brings a background job to the foreground.
  • bg %jobnumber: Resumes a stopped job in the background.

Process Priorities (Nice Values)​

The kernel scheduler decides which process gets CPU time. You can influence this using "nice" values.

  • Nice values range from -20 (highest priority) to +19 (lowest priority). The default is 0.
  • It's called "nice" because a high positive value means the process is being nice and letting other processes use the CPU.
  • Use nice -n <value> command to start a process with a specific priority.
  • Use renice -n <value> -p <PID> to change the priority of an already running process. (Only root can decrease a nice value / increase priority).

Sending Signals​

Administrators communicate with processes by sending them signals, usually using the kill command. Despite the name, kill is used for all signaling, not just terminating processes.

Common signals:

  • SIGTERM (15): The default signal sent by kill <PID>. It asks the process to terminate gracefully, allowing it to save state and clean up.
  • SIGKILL (9): Sent using kill -9 <PID>. This forcefully and immediately terminates the process. The process has no chance to clean up. Use this only as a last resort.
  • SIGHUP (1): Often used to tell a daemon (like Nginx) to reload its configuration files without stopping the service.
  • SIGINT (2): The signal sent when you press Ctrl+C. Interrupts a foreground process.

Monitoring Tools​

  • ps: Reports a snapshot of current processes. (e.g., ps aux to see all processes).
  • top / htop: Interactive real-time process viewers.
  • pgrep <name>: Finds the PID of a process by its name.

Best Practices​

  • Avoid kill -9: Always try kill -15 (SIGTERM) first. Using kill -9 (SIGKILL) on a database can lead to data corruption because it cannot sync data to disk before terminating.
  • Understand Load Average: Tools like uptime and top show the load average (e.g., 0.5, 0.7, 0.6). This represents the average number of processes in the Running (R) or Uninterruptible Sleep (D) state over the last 1, 5, and 15 minutes. A load average higher than your total number of CPU cores indicates the system is overloaded.