Chapter 13 Study Guide 429

Answers to Chapter Questions

Chapter Pre-test

1.The ps command is used to identify running processes. It can be used with many different arguments to modify the way the output is displayed.

2.The /var/log/wtmp file contains the user login information. It is used by the last command to show the last logged in users.

3.Keeping maintenance documentation allows you to keep track of any hardware and software changes on your system. This is helpful when you must troubleshoot a problem that may be related to recent upgrades.

4.The kill command is used to terminate a process.

5.A core process must always be running so that the Linux system can work properly. If these services are terminated, the entire system may crash. Noncritical processes are usually applications or services, such as a Web or FTP servers, that can be stopped or started without crashing the system.

6.The init process is the most important process in a Linux system. It is the parent of all other system processes; it runs at boot time to mount drives and starts critical system services.

7.A PID is a unique process identification number that is assigned to every process running in a Linux system.

8.The command used to send a process to the background is bg.

9.The main log that tracks kernel and system errors is /var/log/messages.

10.The command to see real-time information on running processes and their resources is the top command.

Assessment Questions

1.B. The ps -ef | grep sendmail command lists all processes with a full listing and pipes the results to grep, which only displays the sendmail process and its attributes. For review, see the “Process administration” section.

2.D. The kill -9 command sends the kill signal to the process to force it to terminate. For review, see the “Process Control” section.

3.A. The log file that contains kernel boot messages is /var/log/dmesg. For review, see the “Monitoring Log Files” section.

4.C. The bg command sends a running process to the background. This is helpful if you need to get back to your shell prompt. For review, see the “Process Control” section.

5.A. The correct command to kill all httpd processes is killall httpd. For review, see the “Process Control” section.

430 Chapter 13 Study Guide

6.B. The best command to show a full listing of all running processes is ps -ef. For review, see the “Process administration” section.

7.D. Because the Web pages are working but not displaying properly, the maintenance logs should be checked to see if the server was upgraded over the weekend, thus causing the incompatibility. For review, see the “Maintaining Documentation” section.

8.C. The correct command is ps -au jsmith, which tells the ps command to display all processes owned by jsmith. For review, see the “Process administration” section.

9.B. The correct log file is /var/log/wtmp. You can output its data by using the last command. For review, see the “Monitoring Log Files” section.

10.D. The init process is the first process to be run. It is the parent process of all other Linux system processes, services, and daemons that are needed to run the system. For review, see the “Core services versus non-critical services” section.

11.A. The fg command immediately moves the program to the foreground. For review, see the “Process Control” section.

12.A. Killing a core process can potentially crash your system because many critical services rely on these core processes. For review, see the “Core services versus non-critical services” section.

13.C. The command tail -f /var/log/messages “follows” the log file and shows any new entries in real-time. For review, see the “Monitoring Log Files” section.

14.D. If the documentation has been kept up-to-date, it shows the RAID level that the hard drives were configured for. For review, see the “Maintaining Documentation” section.

15.B. PPID refers to the parent process identification number. For review, see the “PIDs, PPID” section.

16.A. The killall sendmail command terminates all instances of the sendmail process. For review, see the “Process Control” section.

17.C. The SIGHUP command is used to kill and restart a process. For review, see the “Process Control” section.

18.D. Any failed login attempts for root are logged into the /var/log/messages file. For review, see the “Monitoring Log Files” section.

19.B. The process should be immediately killed before it consumes so many resources that the server can’t run properly, and therefore crash. For review, see the “Process Control” section.

20.A. The top command is used to monitor processes and resources in real-time. For review, see the “Process Control” section.

Chapter 13 Study Guide 431

Scenarios

1.Your first step is to first determine what PID the parent httpd process is using. Because the Web server normally starts several httpd processes, you must use the ps command to determine which one is the parent:

ps -ef | grep httpd

The output is similar to the following:

root 853 1 8 10:58 ? 00:00:00 httpd nobody 856 853 0 10:58 ? 00:00:00 httpd nobody 857 853 0 10:58 ? 00:00:00 httpd nobody 858 853 0 10:58 ? 00:00:00 httpd nobody 859 853 0 10:58 ? 00:00:00 httpd nobody 860 853 0 10:58 ? 00:00:00 httpd nobody 861 853 0 10:58 ? 00:00:00 httpd nobody 862 853 0 10:58 ? 00:00:00 httpd nobody 863 853 0 10:58 ? 00:00:00 httpd

As you can see by the output, the first httpd process is the parent, as all other processes have a PPID of 853, which is the PID of parent process.

Next, you must kill the parent httpd process, and send it the SIGHUP signal so that it will reload its configuration file and restart the httpd services:

kill -HUP 853

If you enter another ps -ef | grep httpd command, you can verify that the services have been restarted because the start time will now reflect your current time.

2.You need to identify which process must be stopped. To narrow down the search, you can you use the ps command and search by user:

ps -au jsmith

After you have a list of his processes, you can then run the top program to compare the processes running, and verify which one is using the most resources.

After you have identified the problem process, you can use the kill command to terminate it. Because the user was unable to stop the process, you should probably force a kill signal to make sure that the process stops:

kill -9 [PID of process]

Now, to verify that it has stopped, run the ps command again on the user: ps -au jsmith