Chapter 6: Linux Service & Daemon Management

🎯 Learning Objectives

Understand what a Linux process is[cite: 42].
Differentiate between a program and a process[cite: 42].
Learn common process states[cite: 42].
Understand PID and PPID[cite: 42].
Inspect running processes using common commands[cite: 42].

📋 Prerequisites

Complete Chapters 1–5 before starting this chapter[cite: 42].

1. Introduction

Every application you run becomes one or more processes[cite: 42]. Linux manages these processes, allocates CPU time, assigns memory and coordinates communication between applications and the kernel[cite: 42].

2. Program vs Process

A program is an executable file stored on disk[cite: 42]. A process is a running instance of that program[cite: 42].

Program ──► Execute ──► Running Process (Parent ──► Child)[cite: 42]

3. Process Lifecycle

Program starts[cite: 42].
Kernel assigns a Process ID (PID)[cite: 42].
Process requests CPU and memory[cite: 42].
Process finishes or is terminated[cite: 42].

4. Process States

State	Description
R	Running or ready to run[cite: 42].
S	Interruptible sleep[cite: 42].
D	Uninterruptible sleep (usually waiting on I/O operations)[cite: 42].
T	Stopped or traced[cite: 42].
Z	Zombie process[cite: 42].

5. Understanding PID & PPID

Audit process structures via ps -ef[cite: 42]:

Column	Meaning
UID	Owner of the process[cite: 42].
PID	Process ID[cite: 42].
PPID	Parent Process ID[cite: 42].
TTY	Terminal associated with the process[cite: 42].
TIME	CPU time used[cite: 42].
CMD	Executed command[cite: 42].

6. Viewing Running Processes

Common inspection utilities[cite: 42]:

ps: Display current shell processes[cite: 42].
ps -ef: List all processes using traditional UNIX options[cite: 42].
ps aux: List all processes using BSD syntax mapping[cite: 42].
pstree: Display parent-child process relationships as a clean visual tree[cite: 42].
pgrep sshd: Find target process IDs by matching names quickly[cite: 42].
pidof nginx: Show individual PIDs of a running software daemon[cite: 42].

7. Practical Examples

ps -ef | grep sshd
pgrep sshd
pidof systemd
pstree

These commands help locate services, verify whether applications are running and understand parent-child relationships[cite: 42].

8. Hands-on Practice

Run ps[cite: 42].
Display all processes using ps -ef[cite: 42].
Compare the output of ps aux[cite: 42].
Locate the SSH daemon using pgrep[cite: 42].
Display the process tree using pstree[cite: 42].

9. Common Mistakes

Confusing a binary program with an active running process[cite: 42].
Ignoring PPID variables while tracing runaway child tasks[cite: 42].
Assuming every sleeping process requires a task termination[cite: 42].
Killing a process without identifying its parent or purpose[cite: 42].

10. Process Signaling (kill, killall, pkill)

The kill command routes precise signals down to specific PIDs[cite: 42]. Always test SIGTERM gracefully before escalating[cite: 42].

Signal	Purpose
SIGTERM (15)	Gracefully terminate a process, allowing resource cleanup[cite: 42].
SIGKILL (9)	Force immediate termination at kernel layer[cite: 42].
SIGHUP (1)	Reload configuration without a full process drop[cite: 42].
SIGSTOP (19)	Pause a running process[cite: 42].
SIGCONT (18)	Resume a stopped process[cite: 42].

11. Shell Job Control & Priorities

Append & to push long operations to background task lanes cleanly[cite: 42]. Manage jobs inside your current session via `jobs`, `bg`, and `fg`[cite: 42]. Keep tasks alive after console logouts using nohup command &[cite: 42]. Tune system CPU prioritization weights systematically via nice and renice[cite: 42].

12. Service Control via systemd (systemctl)

Modern Linux servers orchestrate application daemons and baseline environment initialization targets via systemd[cite: 42]. Core management states are toggled via `systemctl` controls[cite: 42]:

systemctl status sshd    # Audit service status
systemctl start sshd     # Launch background daemon
systemctl stop sshd      # Stop active processes
systemctl restart sshd   # Stop and restart service immediately
systemctl enable sshd    # Configure service to auto-start on boot

13. System Monitoring & Diagnostics

Analyze CPU metrics, RAM tracking arrays, and live thread tasks via `top` and interactive `htop` viewers[cite: 42]. Audit continuous resource pools via `vmstat` and `free -h`[cite: 42]. Look up active uptime counters and rolling metric load averages via uptime[cite: 42].

14. Central Log Inspections (journalctl)

Query centralized journal logs natively via journalctl instead of browsing single directories manually during live incidents[cite: 42]. Use `journalctl -u sshd -n 50 --no-pager` to quickly isolate recent error strings[cite: 42].

15. Production Troubleshooting Workflow

Problem Context	Possible Cause	Useful Commands
High CPU load	Runaway process thread fault	top, ps, renice[cite: 42]
High Memory usage	Application memory leak	free -h, vmstat[cite: 42]
Service Failed state	Configuration parameters error	systemctl status, journalctl -u[cite: 42]

Commands Covered in This Chapter

systemctl - Control systemd system and service manager[cite: 42]
journalctl - Query and display logs from journald[cite: 42]
systemd-analyze - Analyze and debug systemd startup timings[cite: 42]
ps - Report rolling process status parameters[cite: 42]
top / htop - Live system tasks and resource viewers[cite: 42]
kill / pkill / killall - Route standard signaling flags to processes[cite: 42]
nice / renice - Adjust process scheduling priorities[cite: 42]
free / vmstat - Monitor global memory logs and I/O pools[cite: 42]