Chapter 13 Process Management 411

Linux is a multi-user, multi-tasking operating system. Every time you run a program under Linux, you begin what is known as a process. A process is another

name for a program that is run by a particular user. Depending on the processing and memory resources on your particular machine, a large number of processes can run simultaneously. Linux administrators must know what processes are running on their systems, and to what extent the processes are affecting system performance. This chapter deals with the subject of how to view, manage, stop, and start these processes.

The Linux administrator must also maintain system logs. The logs can provide excellent troubleshooting information by reporting system errors, user logins, and any unusual behavior that may affect the system. This chapter shows you where to find the different types of logs and how to interpret their data. Finally, this chapter also discusses the importance of documenting and maintaining the information on your Linux system and its performance.

Linux Processes

At any given time, your Linux system is constantly running several processes. These processes run concurrently and are simultaneously executed by the CPU. They also don’t interfere with each other; for example, if one process crashes or ends abnormally, it won’t affect any other process in the system. Some processes can spawn other processes, which are called child processes. If you stop a child process, the parent process will continue. However, if you stop the parent process, each child process is also stopped. A process uses several system resources when running, including the following:

CPU: Runs the instructions for the process.

Memory: Holds the process and any data that it is using.

File Systems: Allows access to required physical files, and also allocates temporary storage for processing.

Physical Devices: Allows processes to access physical devices, such as monitors, hard drives, and printers.

The system tracks each process for its usage of these resources, and allocates these resources as needed to the process that needs them the most. Some processes are given priority over others, while the other processes must “wait their turn” to use the CPU.

A process can be in one of the following states:

Running: The process is currently assigned to a CPU and running.

Ready: The process is waiting to be assigned to a CPU.

412 Part V Maintaining the Linux System

Waiting: The process is waiting for a particular resource to become available.

Zombie: The process has stopped but is still consuming resources; also often referred to as a “dead” process.

Stopped: The process is in a stopped state.

The CPU uses a special identification number called a PID, or Process ID, which tracks each process. This number allows the administrator to more easily differentiate between processes while managing the system. The PID can also be used in conjunction with several commands to change the state of a process.

Core services versus non-critical services

5.6 Differentiate core services from non-critical services (e.g., ps, PID, PPID, init, timer)

Several core processes are integral to the Linux system because they run critical programs that the Linux kernel needs in order to function properly. These processes are run at boot time, and are usually referred to as “daemons.”

For the exam, be careful to differentiate the core services from regular application and user processes.

Init

The most important service in a Linux system is provided by init. Init starts when the system boots, and continues the boot process by performing various startup jobs, such as checking and mounting file systems, and starting services and daemons. When the system is shut down, the init process stops all other processes, unmounts the file systems, and halts the system.

All processes are spawned from init. Many Linux startup services and daemons are spawned from the init process. The command pstree gives you a list of all the processes in a “tree” format, so you can easily discern the parent and child processes. This is the sample output from the pstree command:

init-+-apmd |-atd |-crond |-gpm

|-identd---identd---3*[identd] |-inetd

|-kflushd |-klogd |-kpiod |-kswapd |-kupdate

|-lockd---rpciod |-login---bash---pstree |-lpd

Chapter 13 Process Management 413

|-mdrecoveryd |-5*[mingetty] |-portmap |-pump |-rpc.statd |-sendmail |-syslogd ‘-xfs

Getty

The getty process provides logins from terminals. The init program starts a separate instance of getty for each terminal on which logins are allowed. When the user types his or her name and password, the getty process begins the login program to authenticate the user.

Syslog

The syslog process allows the kernel and many other system programs to produce warnings, errors, and other messages. Syslog is configured to write these events to a file where the administrator can retrieve them at a later date.

Cron

The cron program schedules system tasks and other periodic maintenance programs. The cron program reads a configuration file, and then executes various programs and services at specified times.

Non-critical processes

Processes that are not part of the Linux system are considered non-critical, and are usually programs and applications, such as Web servers and FTP servers. Stopping and starting these processes won’t affect the core functionality of the system.

When killing processes, be sure that you are not terminating a special core process, because you may cause your system to crash.

Process administration

The administrator can use several different commands to manage processes. The following sections detail these commands.

The ps command lists currently running processes. With the ps command, you can check the status of all running processes. You can also customize the way you view the list by using special arguments.

Using the ps command without any arguments only shows the running processes of the current user.

414 Part V Maintaining the Linux System

PID TTY TIME CMD

637 tty1 00:00:00 bash

913 tty1 00:00:00 ps

This example shows the user bash shell running, and the ps command that was just run. The PID shows the process identification number for that process. The TTY column defines which terminal the process was run from. The time lists how long the process has been active.

To see all running processes, use the ps -e command. If you are running as root, the ps command shows all running processes by default. The output looks something like this:

1055 tty1 00:00:00 ps

This example shows all the processes that are currently running on the system. The notable processes include the core services, such as inetd, init, syslogd, and crond. The several mingetty processes refer to the number of terminal sessions

Chapter 13 Process Management 415

available for this instance of Linux. The current user is on tty1, which is why you see the login, bash, and ps processes listed as originating from the terminal tty1.

ps a

This command is similar to ps -e, but this argument displays all processes that originated from that particular TTY or terminal. For example:

PID TTY TIME CMD

976 tty1 00:00:00 login

977 tty1 00:00:00 bash

1055 tty1 00:00:00 ps

ps –u

This command displays all processes run by a particular user. For example, to see all processes run by the user root, use this command: ps -u root.

ps –au

This command displays all processes listed by username.

ps -f

This command displays a more detailed listing of process information, including the owner’s ID, the start time of the process, and the parent process ID (PPID). For example:

ps –ef

This is the most common command used to list processes. It displays all processes by using the full listing format.

ps | more

The ps command can be piped through other commands to aid in displaying the information. Sometimes, a process list can scroll by too quickly because of all the entries, so you can pipe it through the more command to list it screen by screen.

ps > file.txt

You can use this command to send the output of the ps command to a text file to be stored for later viewing, or to print it to a printer.

Be sure to know and be able to use some of the more popular attributes of the ps command.