Creating, monitoring and killing processes
Seeing what is running and making it stop: ps and top, foreground and background jobs, the signals kill actually sends, and how to keep a process alive after you log out.
Lesson 5 of 8 in objective 103. GNU and Unix commands, part of LPIC-1 Exam 101-500.
Looking at processes
ps has two incompatible option styles and both are in use. ps aux is the BSD spelling and ps -ef the UNIX one; both list every process on the system with its owner, PID and command. ps alone shows only your own processes on this terminal, which surprises people. The parent PID column is what shows the tree, and pstree draws it directly.
top is the live view, refreshing every few seconds and sortable interactively; it also shows load average, memory and per-process CPU. uptime prints just the load averages — one, five and fifteen minutes — and free prints memory, where the number that matters is "available" rather than "free", because Linux deliberately uses spare memory as cache. watch runs any command repeatedly so you can watch its output change.
Jobs, foreground and background
Appending & starts a command in the background and the shell prints its job number and PID. Ctrl-Z suspends the foreground job, bg resumes it in the background, fg brings it back, and jobs lists what this shell is managing. Job numbers are per-shell and are referred to as %1, %2 — they are not PIDs, and confusing the two is a reliable exam trap.
A background job still dies when its shell exits, because the shell sends it a hangup. nohup runs a command immune to that signal and redirects its output to nohup.out; disown removes an already-running job from the shell's table. A terminal multiplexer — screen or tmux — is the fuller answer: the session keeps running on the machine and you reattach to it later.
Signals, and what kill really does
kill sends a signal; it does not necessarily kill anything. The default is SIGTERM (15), which asks a process to shut down and can be caught, so the process can clean up. SIGKILL (9) cannot be caught or ignored and is enforced by the kernel, which is why it is the last resort rather than the first: a process killed with 9 gets no chance to flush its files. SIGHUP (1) means the terminal went away, and many daemons repurpose it to mean "reload your configuration". Ctrl-C sends SIGINT (2).
kill takes a PID. killall takes a command name and signals every matching process. pkill matches on patterns and attributes, and pgrep does the same match but only prints the PIDs. kill -l lists the signal names and numbers.
Worth carrying in
- ps aux
- Every process, BSD style.
ps -efis the equivalent UNIX spelling. - pstree
- The process tree, showing parentage directly.
- jobs / fg %1 / bg %1
- Shell job control. Job numbers are not PIDs.
- kill -15 PID
- SIGTERM: ask politely. The default.
- kill -9 PID
- SIGKILL: cannot be caught, no cleanup.
- kill -1 PID
- SIGHUP: terminal gone, or "reload your configuration" by convention.
- killall name
- Signal every process with that command name.
- pgrep / pkill
- Find or signal processes by pattern and attribute.
- nohup cmd &
- Immune to hangup; output to nohup.out.
- free -h
- Memory. Read "available", not "free".
What the exam does with this
- SIGTERM 15 is catchable and default; SIGKILL 9 is not catchable. Know both numbers and both names.
- kill %1 acts on a job, kill 1 acts on PID 1. The percent sign is the whole difference.
nohup, disown and screen all survive a logout, but onlynohupmust be decided before the command starts.
- Objective
- 103. GNU and Unix commands
- Share of the exam
- 43.33% (the whole objective)
- Questions in this lesson
- 20
- Signed for by a person
- 0
Partly checked. None of the 20 questions here has been read against the cited source by a person. 20 questions have been checked against their cited clause by an automated pass — which is not the same thing, and is not a signature.
Only questions a person has signed for are used in mock exams here. That is the whole difference between the two kinds of checking above.
How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.
Drill this lesson
A lesson is one sitting: the trainer draws a short run from these questions alone and spaces the ones you get wrong.
Practise Creating, monitoring and killing processes
Questions in this lesson
- You run `kill 3120` with no other options. Which signal does the process receive? machine-checked
- You know only the program name and want to terminate every running process called `httpd`. Which command does that in one step? machine-checked
- You edited a daemon's configuration file and want the running daemon to reread it without restarting. Which signal is conventionally used? machine-checked
- You press Ctrl+Z while a long-running command occupies the foreground of your bash shell. What happens? machine-checked
- A backup script must keep running after you close your SSH session. You have not started it yet. Which invocation is designed for exactly this? machine-checked
- Which command re-runs `df -h` every 5 seconds and redraws the result in place? machine-checked
- In the standard `uptime` output, what are the three numbers reported at the end of the line? machine-checked
- Which TWO commands send a signal to processes selected by their NAME rather than by a numeric PID? machine-checked
- Which THREE approaches keep a long-running command alive after you disconnect an SSH session? machine-checked
- A process with PID 4021 is ignoring SIGTERM. Type the complete command that forcibly terminates it with the signal that cannot be caught or ignored. machine-checked
- Type the command, including the option, that reports total, used and free memory with the units scaled to human-readable sizes such as Gi and Mi. machine-checked
- Type the ps command, using the traditional BSD-style options and no leading dash, that lists every process on the system in the user-oriented format including processes without a controlling terminal. machine-checked
- In a bash shell, `jobs` reports job 1 running in the background and job 2 stopped. You want job 2 to take over the terminal so you can interact with it. Which command does that? machine-checked
- A server is short of memory and you want a process list whose heaviest memory consumers appear first. Which command produces that ordering directly from ps? machine-checked
- From the directory /srv/import you run `nohup ./load.sh &` and redirect nothing. The script writes progress messages to standard output. Where do those messages go? machine-checked
- You are watching a live top display and want the task list re-sorted so that the processes using the most memory are at the top. Which single key does that? machine-checked
- Type the command, including its option, that lists the current shell's jobs and shows the process ID of each job alongside the usual job number and command. machine-checked
- `ps -ef` shows a process in state Z whose command is displayed as `<defunct>`. Sending it SIGKILL changes nothing. What is happening, and what removes the entry? machine-checked
- Select the TWO statements that are true about SIGKILL and SIGSTOP. machine-checked
- Your SSH connection dropped while a long compile was running inside GNU screen. After logging in again, `screen -ls` lists one session marked (Detached). Which command puts you back into it? machine-checked
Practise Creating, monitoring and killing processes
The rest of objective 103
- Working on the command line
- Filtering text streams
- Basic file management
- Streams, pipes and redirection
- Creating, monitoring and killing processes — you are here
- Process execution priorities
- Searching text with regular expressions
- Editing files from the terminal