Chapter 6: Processes, Signals & systemd

1. Introduction

Every application you run becomes one or more processes. Linux manages these processes, allocates CPU time, assigns memory and coordinates communication between applications and the kernel.

2. Program vs Process

A program is an executable file stored on disk. A process is a running instance of that program.

Program ──► Execute ──► Running Process (Parent ──► Child)
                

3. Process Lifecycle

1. Program starts.
2. Kernel assigns a Process ID (PID).
3. Process requests CPU and memory.
4. Process finishes or is terminated.

4. Process States

5. Understanding PID & PPID

Audit process structures via ps -ef:

6. Viewing Running Processes

Common inspection utilities:

• ps: With no options, list only the processes attached to your current terminal session.
• ps -ef: List all processes using traditional UNIX options.
• ps aux: List all processes using BSD syntax mapping.
• pstree: Display parent-child process relationships as a clean visual tree.
• pgrep sshd: Find target process IDs by matching names quickly.
• pidof nginx: Show individual PIDs of a running software daemon.

7. Practical Examples

ps -ef | grep sshd
pgrep sshd
pidof systemd
pstree

These commands help locate services, verify whether applications are running and understand parent-child relationships.

8. Hands-on Practice

1. Run ps.
2. Display all processes using ps -ef.
3. Compare the output of ps aux.
4. Locate the SSH daemon using pgrep.
5. Display the process tree using pstree.

9. Common Mistakes

• Confusing a binary program with an active running process.
• Ignoring PPID variables while tracing runaway child tasks.
• Assuming every sleeping process requires a task termination.
• Killing a process without identifying its parent or purpose.

10. Process Signaling (kill, killall, pkill)

The kill command sends a signal to a specific process ID (PID). Despite its name, a signal is usually a message the process can handle, ignore, or catch — except SIGKILL and SIGSTOP, which the kernel enforces and the process cannot catch or ignore. Always send SIGTERM first to let the program shut down cleanly, and only escalate to SIGKILL if it will not stop.

kill 4521 # Send SIGTERM (the default) to PID 4521
kill -TERM 4521 # The same thing, stated explicitly
kill -HUP 4521 # SIGHUP: many daemons reload config; processes that ignore it may terminate
kill -9 4521 # Send SIGKILL as a last resort if SIGTERM did not work
pkill nginx # Signal processes whose name matches "nginx"
pkill -u alice # Signal all processes owned by user alice
killall nginx # Signal every process named exactly "nginx"

11. Shell Job Control & Priorities

Append & to a command to run it in the background so your shell prompt returns immediately. Press Ctrl+Z to suspend the foreground command (this sends SIGTSTP); then use bg to let it continue running in the background or fg to bring it back to the foreground. List the jobs started from your current shell with jobs. To keep a task running after you log out, start it with nohup command &. Adjust how much CPU time a process is given relative to others with nice (when starting it) and renice (for a process already running).

12. Service Control via systemd (systemctl)

Modern Linux systems use systemd as the first process (PID 1) to start services at boot and manage them while the system runs. You control individual services (called units) with systemctl:

systemctl status sshd # Show whether the service is running, plus recent log lines
systemctl start sshd # Start the service now
systemctl stop sshd # Stop the service now
systemctl restart sshd # Stop and start the service
systemctl reload sshd # Re-read configuration without a full restart (if supported)
systemctl enable sshd # Start the service automatically at boot
systemctl enable --now sshd # Enable at boot and start immediately

13. System Monitoring & Diagnostics

Watch live CPU and memory usage per process with top, or the friendlier, color-coded htop. Check overall system activity (CPU, memory, and I/O) with vmstat, and view free and used memory in human-readable units with free -h. See how long the system has been running and its 1-, 5-, and 15-minute load averages with uptime.

To understand how long the system took to boot and which units were slowest, use systemd-analyze:

systemd-analyze # Show total boot time (firmware, loader, kernel, userspace)
systemd-analyze blame # List each unit's startup time, slowest first
systemd-analyze critical-chain # Show the chain of units on the critical boot path

14. Centralized Log Inspection (journalctl)

Query the systemd journal with journalctl instead of opening individual log files by hand during an incident. For example, journalctl -u sshd -n 50 --no-pager shows the last 50 log lines for the sshd unit, and adding -f follows new entries as they arrive.

15. Production Troubleshooting Workflow

Commands Covered in This Chapter

• ps — list running processes
• top / htop — interactive CPU and memory view
• kill / pkill / killall — send signals to processes
• nice / renice — adjust process priority
• systemctl — start, stop, enable, and check services
• journalctl — query systemd journal logs
• free / vmstat — check memory and system activity
• systemd-analyze — inspect boot and unit timing