416 Part V Maintaining the Linux System

Process control

Sometimes, a Linux system administrator may want to use certain commands in order to manually control processes. For example, the administrator may want to stop and restart a process, or shut down programs that are taking up too many resources.

Occasionally, a system administrator will have to manually control processes that have lapsed into a frozen state — meaning, they won’t respond to conventional means of control. This tends to happen more often in a programming environment where a process may go out of control, and constantly use up resources until they have been depleted, which may cause the server to crash.

Foreground and background operation

A process can run either in the foreground or the background. When a process is running in the foreground, it is operating in your current shell, and any output or input is sent directly to that process. When a process is running in the background, it is still running, using resources, and completing its task, but it provides output or allows input from the current shell.

For example, to run a program from your shell, you simply type its name and hit Enter. At this point, you aren’t able to get back to your current shell without stopping the process. To immediately put the process into the background at startup, append an ampersand (&) to the command. The difference between foreground and background processes is easily shown with this example:

/home/root# tail -f /var/log/messages

This command allows you to follow any additions to the /var/log/messages file, which is the main log file for your system. When the program is run, you won’t be able to return to your shell until the program is stopped. This process is running in the foreground. To immediately put the program in the background, use the following command:

/home/root# tail -f /var/log/messages &

After using this command, the program will run in the background. Follow these steps to further manipulate the operation of the process:

1.After you press Enter, you are immediately returned to your shell prompt.

2.To return the application to the foreground, you can use [ctrl-z] to suspend the process, and then use the fg command to bring it back to the foreground.

3.If you have a process running in the foreground, and you need to return to your shell, you can use [ctrl-z] to suspend the process. Then, type bg to run the program in the background.

4.To end the process completely, use the [ctrl-c] command.

Chapter 13 Process Management 417

PIDs, PPID

5.7 Identify, execute and kill processes (ps, kill, killall)

Each process has its own unique PID that is assigned by the Linux system. This number represents the process when using various process control commands. The PPID, or parent process identification, is the identifier of the process that is the parent to the current process. Knowing the PPID is very beneficial because many parent processes have several child processes, and killing the parent process will stop all of the child processes in the chain.

It is very easy to mistake the PPID with the PID of a process in a ps command output listing. Killing the PPID of a process might kill a major parent process that will also terminate any child processes.

To see a list of all your processes — including PID numbers — you can use the ps -e command. Here is a sample output:

1055 tty1 00:00:00 ps

418 Part V Maintaining the Linux System

To stop a certain process, use the kill command. To use this command, you need to know the PID number of the process that you want to terminate. For example, you can stop the sendmail process, which is PID 522, by issuing the following command:

kill 522

To ensure that the process has indeed ended, enter the ps -e command to examine the currently running processes, and to see if sendmail is still running.

Sometimes, a process won’t stop even after receiving the kill command. If this happens, you will have to add an extra argument to force a kill signal to the process. To do this, use the following command:

kill -9 522

Signals are different types of commands that you can use with the kill command to change the state of a process. You can list the different types of signals that you can send by using the kill -l command. The output is listed here:

1) SIGHUP 2) SIGINT 3) SIGQUIT 4) SIGILL

5) SIGTRAP 6) SIGIOT 7) SIGBUS 8) SIGFPE

9) SIGKILL 10) SIGUSR1 11) SIGSEGV 12) SIGUSR2

13) SIGPIPE 14) SIGALRM 15) SIGTERM 17) SIGCHLD

18) SIGCONT 19) SIGSTOP 20) SIGTSTP 21) SIGTTIN

22) SIGTTOU 23) SIGURG 24) SIGXCPU 25) SIGXFSZ

26) SIGVTALRM 27) SIGPROF 28) SIGWINCH 29) SIGIO

30) SIGPWR 31) SIGSYS

The most commonly used signals are 1 and 9, SIGHUP, and SIGKILL. Use the kill -9 command to force a kill to a process that won’t stop after you’ve issued a conventional kill command. The signal HUP tells the process to restart. For example, if you need to restart your Sendmail program, which has a PID of 522, issue the following command:

kill -HUP 522

Use the killall command to kill multiple processes that use the same name. For example, an Apache Web server usually runs several httpd processes. In order to kill the process properly, you have to find which httpd process is the parent process. To make it easier, you can use the killall command to stop all of the httpd processes by using the following command:

killall httpd

The top command is another useful command for monitoring current processes. When you run this command, it shows all the current processes and their current resource usage in real time. The administrator can quickly see which program or process is taking up too much CPU time or memory space. Figure 13-1 shows the output of the top command.