Linux Processes Last Update 2012.08.24 1.3.0 Copyright 2000-2012 Kenneth M. Chipps Ph.D. 1

LinuxProcesses

Last Update 2012.08.241.3.0

Copyright 2000-2012 Kenneth M. Chipps Ph.D. www.chipps.com

1

Objectives of This Section

• Learn– What processes are in Linux– How to monitor processes


2

Processes

• Each task that the kernel is working on is assigned a process id or PID

• Each process id has a parent process or PPID

• The parent of all processes is init or PID 1• Init is responsible for creating and

managing processes


3

Processes

• Recall that everything in Linux is a file• Whether it is or it isn’t• Most people think of a file as being

something that is physically stored on a disk magnetically

• In Linux processes appear as files, but with a file length of zero


4

Processes

• This is relevant in that processes running on a Linux system are monitored using these files


5

File Locations

• These process pseudo files are stored in– /proc

• Under /proc are several directories also with zero length

• Each of these numerically named directories corresponds to the process IDs of a particular process running on the system


6

File Locations

• Such as– PID– 1– 2– 3– 4– 5– 6– And so on


7

File Locations

• The corresponding directories will look like this– dr-xr-xr-x 3 root root 0 Feb 17 17:26 1– dr-xr-xr-x 3 root root 0 Feb 17 17:26 16– dr-xr-xr-x 3 root root 0 Feb 17 17:26 2– dr-xr-xr-x 3 root root 0 Feb 17 17:26 3– dr-xr-xr-x 3 root root 0 Feb 17 17:26 4– dr-xr-xr-x 3 root root 0 Feb 17 17:26 5– dr-xr-xr-x 3 root root 0 Feb 17 17:26 6– And so on


8

File Locations

• Within these directories will be a list of files that show some information about the process the directory represents

• For example


9

File Locations• [shs@dragonfly 9166]$ ls -l• total 0• -r--r--r-- 1 shs shs 0 Feb 17 17:31 cmdline• lrwxrwxrwx 1 shs shs 0 Feb 17 17:31 cwd -> /home/shs• -r-------- 1 shs shs 0 Feb 17 17:31 environ• lrwxrwxrwx 1 shs shs 0 Feb 17 17:31 exe - > /usr/bin/gnome-terminal• dr-x------ 2 shs shs 0 Feb 17 17:31 fd• -r--r--r-- 1 shs shs 0 Feb 17 17:31 maps• -rw------- 1 shs shs 0 Feb 17 17:31 mem• lrwxrwxrwx 1 shs shs 0 Feb 17 17:31 root -> /• -r--r--r-- 1 shs shs 0 Feb 17 17:31 stat• -r--r--r-- 1 shs shs 0 Feb 17 17:31 statm• -r--r--r-- 1 shs shs 0 Feb 17 17:31 status


10

Information on the Process

• Each of these files contains information on the process that the directory represents

• Using this information is not straight forward

• This is more a function that a developer might do, rather than a system administrator

• But it is there if you wish to look at it


11

ps command

• This command produces a static list of the processes running at that instant

• In other words, it is a snapshot of what was running when the command was invoked

• To see a constantly updated list of running processes, use the top program


12

ps command

• ps –ef– To display all processes with extended

information• ps ax

– To list of current system processes, including processes owned by other users

• ps aux– Displays the owner of the processes along

with the processesCopyright 2000-2012 Kenneth M. Chipps Ph.D.

www.chipps.com13

lsof• Let’s say top shows an unusual program

using a bunch of cpu resources• ps shows the program’s command line

name to be something that the find command cannot locate

• This may mean someone is running something that they are trying to hide

• In such a case lsof may be more useful• Run it against the pid


14

lsof• As in

– lsof –p 24061• The output of this command will show in

the first column the real name of the program associated with the PID

• Checking the output produced may show what the program has been doing


15

kill command

• Used to terminate a program from outside of the program

• To use it– At the command line search for the process

causing the problem using grep• Such as

– ps ax | grep nameoftheprogram

– This will show something like• 7790 pts/1 S 1:25 /usr/lib/nameoftheprogram


16

kill command– What is needed is the process number

• This is the number in the first column when the ps command is run this way

• In this case– 7790

– Run• kill 7790

• If this doesn't do it, the parent process or PPID may need to be killed


17

kill command

• To find it run– ps axl | grep nameoftheprogram

• When the ps command is run in this form, the PPID is the number in the fourth column


18

killall command

• With this command all that is needed is the name of the program to be killed

• As in– killall httpd

• It does not work with PIDs


19

top command

• The top command displays the currently running processes, as well as important information about them including their memory and CPU usage

• The list is both real-time and interactive


20

top command


21

Gnome System Monitor

• The Gnome GUI has a program similar to top– Main Menu

• Programs– System

» System monitor


22

Gnome System Monitor


23

Documents

Linux Processes Last Update 2012.08.24 1.3.0 Copyright 2000-2012 Kenneth M. Chipps Ph.D. 1