Linux Internals
Process Management
A Technical Reference Guide
Compiled By Amritanshu Prashar Date: July 10, 2025
Process Management Notes
A Technical Reference Guide
Compiled By Amritanshu Prashar
July 10, 2025
Linux Internals Process Management
Contents
1 Introduction 2
2 Types of Processes 2
3 Process Life Cycle 2
4 Process States 2
5 Process Table Symbols 2
6 Process Identification 2
7 Process Monitoring Commands 3
8 Creating a Zombie Process (Demo) 3
9 Managing Processes 3
10 Max Process Limit 3
11 Parent-Child Relationship 3
12 Process Life Cycle Diagram 4
13 PS Command and Process Monitoring 4
14 Jobs and Signal Handling 4
15 Persistent Background Jobs (nohup) 5
16 Top Command and Resource Monitoring 5
17 Process Priority and Nice Value 6
18 Resource Management 7
19 Chrooting 8
1
Linux Internals Process Management
Introduction
• A process is a task that your machine is currently working on.
Types of Processes
1. User Process: Initiated by a regular user; has no access to root or kernel processes.
2. Daemon Process: Runs in the background, typically started at boot time.
3. Kernel Process: Executes in kernel space and has access to kernel data structures. Requires
kernel recompilation for behavior change.
Process Life Cycle
• A process starts with a fork.
• Parent waits; child executes.
• Upon exit, child becomes a zombie until acknowledged by parent.
Process States
1. Running (R): Actively using the CPU.
2. Runnable (R): Ready to run but waiting for CPU.
3. Sleeping (S):
• Interruptible (s): Can be awakened by a signal.
• Uninterruptible (D): Waiting on I/O (e.g., disk, network).
4. Stopped (T): Process execution is halted.
5. Zombie (Z): Completed but waiting for parent acknowledgment.
Note: A few zombie processes are normal, but too many indicate a problem.
Process Table Symbols
• ¡: High priority
• N: Low priority
• L: Page locked in memory
• S: Session leader
• I: Multi-threaded
• +: Foreground process
Process Identification
• Every process has a PID (Process ID).
• PPID (Parent PID) tracks the creator process.
• PID 1 is reserved for init/systemd.
2
Linux Internals Process Management
Process Monitoring Commands
• echo $$ – Shows current shell PID
• ps -C bash – Find PID of bash
• pidof bash – Alternative way to get PID
• echo $PPID – Shows parent PID
• echo $$ $PPID – View both PIDs together
• echo $SHLVL – Show shell level
Creating a Zombie Process (Demo)
zombie.c Code
int main ( ) {
int p i d = f o r k ( ) ;
i f ( p i d > 0 ) // p a r e n t p r o c e s s
sleep (60);
e l s e i f ( p i d == 0 ) { // c h i l d p r o c e s s
p r i n t f ( ” Zombie p r o c e s s c r e a t e d ! ” ) ;
sleep (10);
exit (0);
} else {
p r i n t f ( ” Child p r o c e s s c r e a t i o n f a i l e d . ” ) ;
}
return 0 ;
}
Execution
• Compile and run: gcc zombie.c -o zombie && ./zombie
• Monitor: ps aux | grep defunct
Managing Processes
• sleep 20 & – Send to background
• kill PID – Terminate process
• Zombie processes cannot be killed manually.
Max Process Limit
• Check limit: cat /proc/sys/kernel/pid max
Parent-Child Relationship
1. echo $$ – Get parent PID
2. bash – Start child shell
3. echo $$ – Child PID (will be greater)
4. echo $$ $PPID – Show relationship
3
Linux Internals Process Management
Process Life Cycle Diagram
• Fork → Exec → Exit → Zombie
• Parent waits while child executes.
PS Command and Process Monitoring
• ps: Report a snapshot of current processes (not real-time like top).
• To view current terminal processes: ps
• Manual for ps: man ps
• All processes on all terminals: ps a
• Background processes: ps ax
• Detailed information (with background): ps aux
• Suspended jobs: ps -jt, ps -js
• Suspend a process: kill -STOP <PID>
• Sort by CPU usage: ps aux --sort=%cpu
• Sort by memory usage: ps aux --sort=%mem
• More detailed info (full command lines): ps auxww
• User-specific process view: ps -U amrit -f
• Filtered view with fields: ps axfo ppid,pcpu,command
• Hierarchical view: ps auxf
• Traditional full format: ps -ef
• Show PID only: pgrep sshd
• Tree structure view: pstree, with PID: pstree -p
• User-specific tree: pstree -p -U amrit
Jobs and Signal Handling
Basic Commands
• View background jobs: jobs
• Background job PIDs: jobs -p
• Bring job to foreground: fg 1
• Run job in background: command &
Signals Overview
• kill uses signals to terminate processes.
• Default signal: SIGTERM (15)
• List all signals: kill -l
• SIGHUP (1) – Re-read config
• SIGKILL (9) – Immediate termination (kernel-level, dangerous)
• SIGCONT (18) – Resume stopped process
• SIGSTOP (19) – Stop a process
4
Linux Internals Process Management
Signal Examples
• Send process to sleep: sleep 100 &
• Pause: kill -19 <PID>
• Resume: kill -18 <PID>
• Kill a process: kill <PID> or kill -15 %1
• Force kill: kill -9 %1
• Kill multiple by name: pkill sleep, killall sleep top
Persistent Background Jobs (nohup)
• Normally, background jobs (./script.sh &) terminate if the session ends.
• Use nohup to prevent termination:
– nohup ./script.sh &
– Output is redirected to nohup.out
– View output: cat nohup.out
Top Command and Resource Monitoring
• top: Real-time monitoring of system processes.
• Check version: top -v
Top Header Details
• Current Time
• System Uptime
• Number of Logged-In Users
• Load Average (1, 5, and 15 minutes)
CPU Usage Indicators
• us – User space
• sy – Kernel space
• ni – Nice value processes
• id – Idle time
• wa – Waiting for I/O
• hi – Hardware interrupts
• si – Software interrupts
• st – Steal time (virtualization)
5
Linux Internals Process Management
Column Descriptions
• PID – Process ID
• USER – Owner of the process
• PR – Priority
• NI – Nice value
• VIRT – Virtual memory used
• RES – Resident memory used
• %MEM – Memory usage percentage
• %CPU – CPU usage percentage
• SHR – Shared memory
• S – Process state
• TIME+ – CPU time since start
• COMMAND – Command name
Useful Top Shortcuts
• Kill a process: Press k, enter PID
• Sort by memory: M
• Sort by CPU: P
• Sort by PID: N
• Sort by running time: T
• Quit: q
• Locate string: L
• Show full command: top -c
• Threads view: H
• Filter by user: top -U amrit
• Monitor specific PID: top -p <PID>
• Start with CPU sort: top -o %CPU
Process Priority and Nice Value
• Priority Value = Nice Value + 20
• Linux priority range: 0–139 (0–99 for kernel, 100–139 for user)
• Nice value range: -20 (highest priority) to 19 (lowest priority)
• Only root users can assign negative nice values.
• Normal users can only increase their own nice values.
6
Linux Internals Process Management
Simulating CPU Load
• Create infinite loop file:
vim infinite.sh
#!/bin/bash
for (( ; ; ))
do
continue
done
chmod +x infinite.sh
sh infinite.sh &
• Running multiple loops increases CPU load.
• Equal priorities → CPU usage divided.
Controlling Process Priority
• Change priority of a running process:
renice -n 10 <PID>
renice -n -10 <PID>
• Set nice value before starting process:
nice -n -15 sh infinite.sh &
• Only root user or owning user can kill their own process.
Resource Management
• Memory management helps determine how much memory your computer needs to operate effi-
ciently.
• free command is used to display memory usage:
– free – Shows memory in KB
– free -m – Shows memory in MB
– free -g – Shows memory in GB
– free -h – Human-readable format
– free -s 3 – Refresh every 3 seconds
• watch – Repeats a command at intervals:
– watch -d -n 4 free
• iostat – Used for monitoring CPU and device I/O stats:
– Requires sysstat package
– iostat -d 2 8
• mpstat – Shows CPU stats; mpstat -P ALL for all CPUs
• sar – System activity report: sar 2 3
• lsof – Lists open files:
7
Linux Internals Process Management
– lsof -p <PID> – Files opened by a PID
– lsof -i :22 – Files on port 22
– lsof /mnt/ – Files in mount path
– lsof -u amrit – Files opened by user
• fuser – Displays which processes are using a file system:
– fuser -m -u /
– fuser -m -k -u /mnt
Chrooting
• Chroot provides an isolated environment to manage root files from a different mount point.
• Used when booting from Live OS or during system recovery:
– Boot with Live OS → Troubleshooting → Rescue a RedHat system
– Choose option 3 for shell access
• Verify shell with: echo $SHELL
• Use df -Th to check mounted filesystems
• Use lvscan to see LVM activation status
• Activate LVM:
vgchange -ay rhel
lvscan
• Create dummy files to test where they’re stored:
touch /file.txt
mkdir /chrootingamrit
• Mount actual root file system:
mount /dev/rhel/root /mnt
cd /mnt
ls
• Switch to real root environment:
chroot /mnt
• Chroot gives access to a new environment on the actual hardware root disk.
Thank You
This document was prepared to help learners understand process management in Linux with real
examples and hands-on references.
Compiled with dedication by Amritanshu Prashar.
