07
Processes & Signals
- Find which one burns CPU/RAM
- Stop a stuck process safely (TERM then KILL)
- Explain zombie vs running; avoid ps | grep self-match
Must-know cold
ps aux · ps aux --sort=-%mem | head · pgrep -ax namekill PID (SIGTERM) → wait → kill -9 PID (last resort)top / htop · STAT: R run/runnable S interruptible sleep D uninterruptible (often I/O) T stopped Z zombie- Prefer
pgrep -x / pgrep -f over ps aux | grep
Common signals
Definition: Frequently used signals. Numbers below are Linux x86/ARM (use names in scripts). KILL and STOP cannot be caught, blocked, or ignored.
| Signal | Number (Linux) | Meaning |
|---|
HUP | 1 | Hangup / controlling TTY gone; many daemons reload |
INT | 2 | Interrupt (Ctrl-C); can be caught |
QUIT | 3 | Quit (Ctrl-\); dump core by default |
KILL | 9 | Force kill; not catchable |
TERM | 15 | Polite terminate (default kill); can be caught |
CONT | 18 | Continue after STOP/TSTP |
STOP | 19 | Pause; not Ctrl-Z; not catchable |
TSTP | 20 | Terminal stop (Ctrl-Z); can be caught |
Commands
ps
Definition: Snapshot of running processes (PID, CPU, memory, command).
| Option | Argument | Meaning | Example |
|---|
aux | — | All users, user format, no-tty too | ps aux |
-ef | — | Full format; shows PPID | ps -ef |
-u | USER | Processes of USER | ps -u jenkins |
-p | PID | Only this PID | ps -p 1234 |
-o | COLS | Custom columns | ps -o pid,ppid,stat,cmd |
--sort | KEY | Sort (-%mem, -%cpu). %cpu is lifetime CPU/elapsed, not a live sample | ps aux --sort=-%cpu |
-C | NAME | By command name | ps -C nginx |
f / --forest | — | ASCII process tree | ps auxf |
-L | — | Show threads (with other opts) | ps -eLo pid,tid,comm |
Useful columns (-o): pid ppid user %cpu %mem rss stat etime cmd nlwp
Flag combos
| Combo | Meaning | Example |
|---|
ps aux --sort=-%mem | head -15 | Top RAM | Incident start |
ps aux --sort=-%cpu | head -15 | Highest lifetime %CPU | Live burn: top / htop |
ps -fp PID | Full line for one PID | |
ps -o pid,ppid,stat,wchan,cmd -p PID | State + wait channel | Hung process |
top
Definition: Live, refreshing view of process resource usage.
| Option | Argument | Meaning | Example |
|---|
| (none) | — | Live process view | top |
-b | — | Batch mode (scriptable) | top -b -n 1 |
-n | N | Number of iterations | top -b -n 1 |
-p | PID | Watch specific PID | top -p 1234 |
-u | USER | Only USER | top -u jenkins |
-d | SEC | Delay between refresh | top -d 2 |
-H | — | Show threads | top -H |
-o | FIELD | Sort field (Linux) | top -o %MEM |
Inside top:
P CPU sortM MEM sortk killq quit1 per-CPUc full cmd
Flag combos
| Combo | Meaning | Example |
|---|
top -b -n 1 | head -30 | Snapshot for ticket | Pasteable |
htop
Definition: Interactive process viewer (friendlier top). Optional package — install if missing.
| Option | Argument | Meaning | Example |
|---|
| (none) | — | Friendlier interactive top | htop |
-p | PID | Specific | htop -p 1,2 |
-u | USER | Filter user | htop -u root |
-t | — | Tree view | htop -t |
Flag combos
| Combo | Meaning | Example |
|---|
htop -u jenkins | Agent processes | CI host |
pgrep
Definition: Find process IDs by ERE against the process name (/proc/pid/stat, historically 15 chars) or, with -f, the full command line.
| Option | Argument | Meaning | Example |
|---|
| (none) | PATTERN | PIDs whose name matches the ERE (ssh also hits sshd) | pgrep nginx |
-x | PATTERN | Exact name (or exact cmdline with -f) | pgrep -x nginx |
-a | PATTERN | PID + full command line (pgrep only) | pgrep -a java |
-f | PATTERN | Match full cmdline, not only the 15-char name | pgrep -f agent.jar |
-u | USER | Effective UID | pgrep -u jenkins |
-l | PATTERN | PID + process name | pgrep -l sshd |
-c | PATTERN | Count matches | pgrep -c java |
-n | PATTERN | Newest only | pgrep -n python |
-o | PATTERN | Oldest only | pgrep -o python |
-d | DELIM | Delimiter between PIDs | pgrep -d, java |
Flag combos
| Combo | Meaning | Example |
|---|
pgrep -af jenkins | See matching command lines | |
pgrep -x nginx | Exact comm, not a substring/regex surprise | |
ps -fp $(pgrep -d, nginx) | Full ps for matches | |
pkill
Definition: Send a signal to processes matched by name/pattern.
| Option | Argument | Meaning | Example |
|---|
| (none) | PATTERN | Signal matching processes (default TERM) | pkill sleep |
-f | PATTERN | Full cmdline match | pkill -f 'sleep 999' |
-u | USER | Effective UID | pkill -u bob |
-signal | PATTERN | Signal by name/number | pkill -TERM java |
-9 | PATTERN | SIGKILL | pkill -9 -f stuck |
-c | PATTERN | Print match count — still sends the signal (procps) | Not a dry-run |
-n / -o | PATTERN | Newest/oldest only | pkill -n worker |
Flag combos
| Combo | Meaning | Example |
|---|
pkill -TERM -f 'worker.js' | Polite by cmdline | Prefer before -9 |
pkill -u malware | All of user (careful) | |
kill
Definition: Send a signal to a process by PID (default SIGTERM).
| Option | Argument | Meaning | Example |
|---|
| (none) | PID | Send SIGTERM (15) | kill 1234 |
-s | SIG PID | Signal by name | kill -s TERM 1234 |
-SIG | PID | Signal shorthand | kill -TERM 1234 |
-9 | PID | SIGKILL | kill -9 1234 |
-l | — | List signals | kill -l |
-0 | PID | Signal 0: success if the PID exists and you may signal it | kill -0 1234 |
Flag combos
| Combo | Meaning | Example |
|---|
kill PID; sleep 2; kill -0 PID || echo gone | TERM then probe (EPERM also fails -0) | |
kill -9 PID | Last resort | After TERM fails |
pstree
Definition: Show running processes as a parent/child tree.
| Option | Argument | Meaning | Example |
|---|
| (none) | — | Process tree | pstree |
-p | — | Show PIDs | pstree -p |
-s | PID | Parents of PID | pstree -sp 1234 |
-u | — | Show uid transitions | pstree -u |
-a | — | Command line args | pstree -a |
Flag combos
| Combo | Meaning | Example |
|---|
pstree -sp PID | Who owns this child tree | Before killing children |
jobs
Definition: Manage shell background/foreground jobs and hangup-resistant tasks (bg, fg, nohup).
| Command / option | Argument | Meaning | Example |
|---|
cmd & | — | Run in background | sleep 300 & |
jobs | — | List shell jobs | jobs -l |
jobs -l | — | Include PIDs | jobs -l |
fg | %N | Foreground job N | fg %1 |
bg | %N | Resume stopped job in background | bg %1 |
disown | %N | Detach job from shell | disown %1 |
nohup cmd | — | Ignore SIGHUP and redirect TTY stdout/stderr (default nohup.out). Does not setsid / daemonize | nohup ./job & |
nohup cmd >f 2>&1 & | — | Redirect properly | Preferred |
Flag combos
| Combo | Meaning | Example |
|---|
nohup ./run.sh >run.log 2>&1 & | Survive logout (still not systemd) | Lab only |
Common recipes
| Goal | Command |
|---|
| Top memory | ps aux --sort=-%mem | head -15 |
| Top CPU | ps aux --sort=-%cpu | head -15 |
| Find by name | pgrep -ax nginx |
| Graceful kill | kill $(pgrep -x myapp) |
| Force kill | kill -9 PID after TERM |
| Tree | pstree -sp PID |
| Live view | top or htop |
| Exists and signalable? | kill -0 PID && echo yes |
Pitfalls
kill -9 first → skips cleanup (locks, temp files) — last resort.- Ctrl-Z is
SIGTSTP, not SIGSTOP. SIGSTOP/SIGKILL cannot be caught.
pgrep/pkill patterns are EREs against the short comm unless you use -x or -f. pgrep ssh matches sshd.pkill -c still delivers the signal; it is not a dry-run. List signals with kill -l, not pkill -l.- Linux
killall name signals every process with that comm. On some Unixes killall means “kill everything.” Prefer a PID or pkill -x.
- Zombie (
Z): fix/restart the parent; kill -9 on the zombie does nothing.
D state: uninterruptible sleep (often I/O/NFS); the process may not die until the kernel wait ends.kill -0 fails with EPERM if the PID exists but you cannot signal it — that is not “dead.”ps %CPU is lifetime CPU/elapsed, not the live burn top shows.- Production long-running services →
systemctl stop, not raw kill (see sheet 08).
Process actions map to C system calls, CLI commands, and POSIX signals across four phases: lifecycle, signals, job control, observability.
Creation & lifecycle
| Verb | C syscall / tool | What it does |
|---|
| Fork | fork() | Clones the parent into a child with duplicate FDs and memory state. |
| Exec | execve() | Replaces the current process image with a new binary (same PID). |
| Spawn | posix_spawn() | Combines fork + exec in one operation. |
| Daemonize | daemon() / setsid | Double-fork / new session, detach from the controlling TTY. nohup is not this — it only ignores SIGHUP and redirects output. |
| Orphan | — | Parent exits first; child is adopted by init (PID 1) or systemd. |
| Reap | wait() / waitpid() | Parent reads the child’s exit status and frees the process-table slot. |
| Zombie | — | Terminated process whose exit status has not yet been reaped. |
Signal & termination
| Verb | Signal / command | What it does |
|---|
| Signal | kill -<SIG> <PID> | Asynchronous event from the kernel to a process. |
| Interrupt | SIGINT (2) / Ctrl-C | Default is terminate; can be caught or ignored. |
| Hangup | SIGHUP (1) | Controlling TTY gone; daemons often reload config. |
| Terminate | SIGTERM (15) | Polite exit; time to close files and sockets. |
| Kill (force) | SIGKILL (9) | Immediate kernel destroy; cannot be caught. |
| Quit | SIGQUIT (3) / Ctrl-\ | Terminate and dump core for debugging. |
Job control & state
| Verb | Command / signal | What it does |
|---|
| Suspend / pause | SIGTSTP (20) / Ctrl-Z | Job-control stop; can be caught. SIGSTOP (19) also stops, but cannot be caught and is not Ctrl-Z. |
| Resume | SIGCONT (18) / bg / fg | Continues a STOP/TSTP’d process (bg/fg send CONT as needed). |
| Renice / prioritize | nice / renice | Changes niceness (−20 highest … 19 lowest). |
| Pin / affine | taskset | Locks a process to specific CPU cores. |
| Limit / throttle | cgroups / ulimit | Caps RAM, CPU, or open file descriptors. |
Inspection & observability
| Verb | Command / tool | What it does |
|---|
| Inspect / query | ps, pgrep, pidof | Reads /proc/[pid]/ for state, owner, cmdline. |
| Monitor / top | top, htop, btop | Continuous sample of CPU, memory, threads. |
| Trace | strace, ltrace | Logs syscalls or library calls. |
| Attach | gdb -p <PID> | Debugger/profiler via ptrace(). |
For more details, try man <command> in your terminal.