Controlling Processes

A process is a running program which uses system resources such as CPU, I/O and memory.

The kernel sets asside memory pages for each running process.
These pages can reside in RAM or in swap space.

Linux uses virtual memory

More than one process can share an address space

muliple threads of execution

commands

kill
ps
nice
renice
top
fuser
echo

Components of a process

The process's address space map
The current status of the process

sleeping: waiting for a resource

interactive programs, shells and daemons spend most of their time sleeping

stopped: suspended (not allowed to execute), someone sent the process a STOP signal
runnable: can be executed whenever CPU time is available
zombie (the parent process dies before the child process)

The process's priority
Resources that the process has used
The owner of the process
...

Process Environments

This table summarizes the typical process environment consisting of variables and parameters required to run.

Terminal (TTY) Terminal ID from which the process was launched, provies linkage for 3 file descriptors: stdin, stdout, stderr

Open files Files the process is using

Current directory The directory from which the process was invoked

User ID (UID) ID of the user who invoked the process

Effective User ID (EUID) Determines what resources and files a process has permission to access at any given moment. There is a distinction between identity and permission. Think of setuid programs like sudo. (Next chapter)

Group ID (GID) ID of the group that the user belongs to

Process ID (PID) A unique number that the kernel randomly assigned to the process

Parent process ID (PPID) The parent process ID, which launched the subject process

Priority The processes scheduling priority or niceness. Determines how much CPU the process receives

Checking the Shell's Process ID (PID)

$ echo $$
3173

Parent-Child Relationships

All processes exist in parent-child hierarchies.

Init is the ultimate ancestor of all processes

It has process id 1.

A parent process may invoke other processes know as child processes

the parent copies or clones itself with the fork system call
the new process is called the child process
has a different PID and its own accounting info
the child process inherits the parents environment

A parent process can have more than one child

A child process can have only one parent process

The child process can modify its environment and pass the modified environment down to its own children

The child cannot pass the modified environment back to its parent

except when invoked by the source command (coming later)

Take a look at the jobs currently running on your machine:

$ ps -laxfw | less
(excerpt)

UID PID PPID PRI STAT TTY TIME COMMAND

500 5269 5095 15    S    pts/6   0:01 \_ /bin/bash
500 18006 5269 17    R    pts/6   0:00      \_ ps -laxfw
500 18007 5269 16    S    pts/6   0:00      \_ less

Find your login process
Find the shell your ran ps from
the f options shows child processes connected to their parents
the ps command is a child of the bash shell
the less command, on the other side of the pipe, is also a child of the bash shell process

The echo command is built into the shell. It doesn't require that a subshell be created:

$ echo $$

'$$' is assigned the value of the current process.
Used most frequently in shell scripts

ps options:
          u            select by effective user ID (supports names)
          a            Select all processes on a terminal, including those of other users
          x            Select processes without controlling ttys
          l              Long format
          f             ASCII-art process heirarchy (forest)
         w             wide output

Process Signals

Signals are interrupt requests for processes
Signal handler routines are written into some processes

When a process receives a signal one of the following things happens:

the handler routine performs some function based on the signal received

referred to as catching the signal

the kernel takes a default action based on the signal received

Most commonly used signals:

Numeric	bash name	Description
1	HUP	Hang-up signal 1. reset request for processes to reread config files (ie, syslog, init) 2. signal also generated by modem connection when dropped.
2	INT	Interrupt signal sent when <Ctrl-C> is typed at keyboard, terminate the current operation. Most programs simply allow themselves to be killed. Some processes may wait for more text input from keyboard.
3	QUIT	Similar to TERM, produces a core dump if not caught by process.
9	KILL	Unconditional kill -- not graceful, no cleanup.
11	SEGV	Segmentation fault caused by improper access of memory.
15	TERM	Termination signal which instructs process to terminate, graceful termination!

Terminating Processes

Why would you want to terminate one of you beloved processes:

You no longer need the process or daemon running on your system
You are not getting the results you expected
The system seems frozen
You are getting too much output to the screen or printer
The process is using too many system or network resources

Termination Methods

Foreground processes

Terminate with the quit signal, <Ctrl>c

Background processes

Must use the kill command to terminate a background process
Powering down the system is another very crude way to kill background processes

This is not good for the filesystems on running on your machine

The Kill Command

Ordinary users can kill any process that he or she has initiated
The root user can kill any process (unless it is really stubborn)

Syntax:

kill PID1 PID2 PID3
kill [-signal] PID
killall [-signal] process_name

Note that the process IDs are separated by a space. You can have as many as you want listed after the kill command and optional signal.

Example -- to create output and load:

[pattyo@ponto $ bash
[pattyo@ponto]$ yes > /dev/null &
[1] 6023
What the heck is the yes command anyway?

$ man yes
NAME
yes - output a string repeatedly until killed

ps with no options will report processes running in the current terminal.

[pattyo@ponto]$ ps f
PID TTY      STAT   TIME COMMAND
763 pts/0    S      0:00 bash
6013 pts/0    S      0:00 bash
6023 pts/0    R      0:03 \_ yes
6024 pts/0    R      0:00 \_ ps f
[pattyo@ponto]$ kill 6023
[pattyo@ponto]$

No error message is displayed. Check process exit status.

[pattyo@ponto]$ echo $?
0
[1]+ Terminated yes >/dev/null
A return code of 0 is good news, anything else for an exit status is bad.

Using the killall command

If you don't know the PID
or are too lazy to type ps to find it ;)
killall performs the PID lookup for you

$ sudo killall -15 xinetd

NOTE: If you entire session is hung, you can log in to a different virtual terminal and use the kill command from there. <Ctrl><Alt>F3. You can get back to your original session with <Ctrl><Alt>F7 (depending how your system is configured).

kill Command Signals

To get a complete listing of the kill signals type:

$ kill -l
1) SIGHUP     2) SIGINT   3) SIGQUIT   4) SIGILL
5) SIGTRAP    6) SIGIOT   7) SIGBUS    8) SIGFPE
9) SIGKILL   10) SIGUSR1 11) SIGSEGV 12) SIGUSR2
13) SIGPIPE   14) SIGALRM 15) SIGTERM 17) SIGCHLD
18) SIGCONT   19) SIGSTOP 20) SIGTSTP 21) SIGTTIN
22) SIGTTOU   23) SIGURG 24) SIGXCPU 25) SIGXFSZ
26) SIGVTALRM 27) SIGPROF 28) SIGWINCH 29) SIGIO
30) SIGPWR    31) SIGSYS

Process Monitoring

A process is a single program or task running in its own virtual address space.

The ps (process status) command is used to

see how many processes are running
check whether a specific process is hung
examine the resources being used by a process
examine owner of process and parent of process

This command illustrates the parent child relationships of process.

$ ps -auxf

The ps command can be used without any options.

It will display only the minimum information about the processes started from your terminal (shell window)

$ ps
PID TTY          TIME CMD
889 pts/3    00:00:00 bash
5708 pts/3    00:00:00 ps

Output of ps Command above

PID	Process identification number assigned by the kernel
TTY	Terminal where the process originated
TIME	Cumulative execution time (min:sec)
COMMAND	Name of the process being executed

ps options (documented in man pages)

u select by user name

a Select all processes on a terminal-- including those of other users

x Select processes without controlling ttys

f ASCII-art process heirarchy (forest)

e Environment of the process

l Long listing (along with basic flags)

The top command
Provides a way to view the most CPU intensive processes at any given moment

ps provides one-time snapshot
top updates every few seconds (by default)
uses CPU itself
has interactive options

8:43pm up 17 min, 7 users, load average: 0.54, 0.61, 0.38
89 processes: 86 sleeping, 2 running, 1 zombie, 0 stopped
CPU states: 7.3% user, 2.5% system, 0.0% nice, 90.0% idle
Mem: 158928K av, 139676K used, 19252K free, 740K shrd, 4252K buff
Swap: 337280K av, 0K used, 337280K free 78256K cached

PID USER     PRI NI SIZE RSS SHARE STAT %CPU %MEM   TIME COMMAND
1960 root      16   0 15760 11M 2536 R     4.5 7.2   0:09 X
2154 pattyo    11   0 15396 14M 8964 S     2.3 9.5   0:05 netscape-commun
2189 pattyo    14   0 1064 1064   836 R     0.9 0.6   0:00 top
1995 pattyo    12   0 3728 3728 2048 S     0.7 2.3   0:03 sawfish
2019 pattyo     9   0 5384 5384 3980 S     0.3 3.3   0:01 panel
    2 root       9   0     0    0     0 SW    0.1 0.0   0:00 keventd
1977 pattyo     9   0 2044 2044 1704 S     0.1 1.2   0:00 gnome-smproxy
2021 pattyo     9   0 4328 4328 3480 S     0.1 2.7   0:00 gnome-terminal
2122 pattyo     9   0 3876 3876 3240 S     0.1 2.4   0:00 deskguide_apple
    1 root       8   0   520 520   452 S     0.0 0.3   0:04 init
    3 root       9   0     0    0     0 SW    0.0 0.0   0:00 kapm-idled
    4 root      19 19     0    0     0 SWN   0.0 0.0   0:00 ksoftirqd_CPU0
    5 root       9   0     0    0     0 SW    0.0 0.0   0:00 kswapd
    6 root       9   0     0    0     0 SW    0.0 0.0   0:00 kreclaimd
    7 root       9   0     0    0     0 SW    0.0 0.0   0:00 bdflush
    8 root       9   0     0    0     0 SW    0.0 0.0   0:00 kupdated
    9 root      -1 -20     0    0     0 SW<   0.0 0.0   0:00 mdrecoveryd

Change the time between screen updates with the s option followed by a number

GUI tools provided on your Linux system

gtop

GNOME System Monitor
Footprint -> Programs -> System -> System Monitor

kpm

KDE System Monitor
Footprint -> KDE Menus -> System System Management

Memory Usage

Note the memory usage when running top from the X-Windows environment
now kill X using Control-Alt-Backspace
Note the memory usage running top without X

Locating a number of processes using ps and killing them all from a single command

In this example my intent is to kill all jobs named nfsd
Nothing gets killed though

Why?

Can you guess which process PID 21064 refers?

$ kill `ps -lax | grep nfsd | awk '{print $3}'`

bash: kill: (1225) - Operation not permitted

bash: kill: (1226) - Operation not permitted

bash: kill: (1227) - Operation not permitted

bash: kill: (1228) - Operation not permitted

bash: kill: (1229) - Operation not permitted

bash: kill: (1230) - Operation not permitted

bash: kill: (1231) - Operation not permitted

bash: kill: (1232) - Operation not permitted

bash: kill: (21064) - No such process

$ sudo kill `ps -lax | grep nfsd | \ grep -v grep | awk '{print $3}'`

Renicing a process

The niceness value of a process determines its priority compared to other processes
When a process is using an excessive amount of CPU you can modify the nice value
The range of values is -20 to +19

a higher value means a lower priority
a negative value is higher priority

The root user is the only user capable of giving a process a higher nice value
The nice value of a process has no effect on how the kernel manages memory or I/O for that process.

Processes with high nice values can still monopolize your system!

Lab: renicing a process

What nice value will a new process receive?

Use ps -lax to view fields such as the parent process IDs and nice values of your processes.

By default it looks like our processes have a nice value of zero

F UID PID PPID PRI NI VSZ RSS WCHAN STAT TTY TIME COMMAND

000 500 8529 8527 15 0 2556 1236 wait4 S pts/1 0:01 /bin/bash

$ renice 15 8529

8529: old priority 0, new priority 15

$ renice -1 8529
renice: 8529: setpriority: Permission denied

$ renice 16 8529
8529: old priority 15, new priority 16

$ renice 15 8529
renice: 8529: setpriority: Permission denied

$ sudo renice 15 8529
Password:
8529: old priority 16, new priority 15

If you have a runaway process that is driving the load way up on your system create a shell with a higher priority than the default using the nice command. Nice takes command line arguments:

$ sudo nice --adjustment=-10 bash $ ps -lax | tail

This command creates a shell with a nice value of 10 less than the default.
When would this come in handy?

Exercise: Runaway Processes

Create a script file to create load on your system.
*Don't forget to make it executable*

#!/bin/sh

while [ 1 ]; do
cal 2000 > /dev/null
done

OR from the command line (from bash shell):

$ val=1

$ while [ $val ]; do

> cal 2000 > /dev/null

> done

Renice the process to use less CPU:

% top

% renice 20 -p 2825

2825: old priority 0, new priority 20

The following example is from page 60 in your text.
What happens when a user executes this program?

I don't suggest you play with this one unless you know how to deal with the disaster it creates!
First, check your inode and disk space

$ df -i .

{inode usage

$ df .

{disk usage}

$ while [ 1 ]; do

mkdir adir

cd adir

touch afile

done $ df -i . $ df . $ pwd $ ls -lR adir $ rm -rf adir

{remove with force}

How do you identify a process that is consuming huge amounts of disk space?

Tools to identify files that are currently open and the processes using them

fuser
lsof

# fuser -mv /home {identify processes using files}
# lsof /home {list open files}

Process States

State	Meaning
Runnable	The process can be exectued whenever the cpu is ready
Sleeping	The process is waiting for some resource, or keyboard input
Zombie	The process is finished but has not reported its status back to its parent
Stopped	The process is suspended, received a STOP signal

Zombie Processes (nothing to do with Halloween)

Sometimes a child process is killed (with a -9 signal) but the parent doesn't acknowledge the termination.

The now-dead child process become what is called a zombie.
It will appear as defunct when issuing a ps under the COMMAND column.
The zombie takes up a slot in the process table.
Many zombie process can cripple your machine -- using resources.
A reboot may be your only course of action.

An alternative might be to login as the owner of the zombie's and do a kill -1 -1

Daemons: Never-Ending System Processes

Daemons are programs that run in the background
Run system tasks
Typically started at boot time
Some daemons are controlled by a master daemon

inetd or xinetd, init, portmapper, crond, lpd

Daemons wake up on-demand, waiting for a specific event to take place.

Daemons typically have process names that end in 'd'

use ps and egrep to find the daemons running on your machine

$ ps -ef | egrep 'd$|d]$'

... root       333   1 0 Oct16 ? 00:00:00 rpc.statd
root       395   1 0 Oct16 ? 00:00:34 klogd
root       423   1 0 Oct16 ? 00:00:01 crond
root       437   1 0 Oct16 ? 00:00:00 inetd
named      451   1 0 Oct16 ? 00:00:01 named
root       460   1 0 Oct16 ? 00:00:00 sshd
root       476   1 0 Oct16 ? 00:00:00 lpd ...

Notice the parent process for most daemons is init.

Invoking Foreground and Background Processes

Typically process are invoked from the command line.
You can invoke processes from the foreground and background states.

Foreground Process

started and require interaction from user at terminal
typically take a short time to run
take over the terminal (tty window) while they run

The syntax for a foreground process:

command options arguments

Background Process

processes that run independently from the initiating terminal
allows you to use your terminal for other tasks
process must not require keyboard input

The syntax for a background process:

command options arguments > backfile &

Here you are saving the output to the file backfile. Note the ampersand at the end of the command. This is how a background process is invoked.

Job Control in the bash and tcsh Shells

jobs

the jobs command indicates the processes running in the background
the job number is seen in brackets
Note the redirection of standard error to the same file that output has been redirectred

$ ls -R / >> junk 2>&1 &

[1] 6284

$ jobs

[1]+ Running ls --color=tty -R / >>junk 2>&1 &

When the job is done, the jobs command will indicate it

Lab: Background Processes

$ nohup yes >> junk 2>&1 &
[1] 6292
$ jobs
[1]+ Running     nohup yes >>junk 2>&1 &
$ ps
PID TTY          TIME CMD
776 pts/1    00:00:00 bash
6292 pts/1    00:00:11 yes
6295 pts/1    00:00:00 ps
$ kill -15 6292
$ jobs
[1]+ Terminated    nohup yes >>junk 2>&1
Note: kill -15 is using the TERM signal for graceful termination.

Suspending and Resuming a Foreground Task

By typing <Ctrl-z> after invoking a process from the command line, you will suspend that process, not kill it.
No CPU cylcles are used for the suspended process but the suspended process still occupies RAM.
The process will be swapped to disk if enough higher priority jobs require memory.

Foreground Task Control

To suspend a foreground task:

$ yes > /dev/null
<Ctrl-z>
[1]+ Stopped

To resume a suspended task:

[pattyo@ponto fall2001]$ fg
yes >/dev/null

To suspend a background task you will first need to bring it to the foreground using the fg command. Then suspend it using <Ctrl>-z>.

If you have have more than one process running in the background you will need to provide a jobnumber to the fg command.

Example:

$ yes > /dev/null
<Ctrl>z
[1]+ Stopped                 yes >/dev/null
$ yes > /dev/null &
[2] 6440

$ jobs
[1]+ Stopped                 yes >/dev/null
[2]- Running                 yes >/dev/null &

Now we have two jobs, one stopped, one running

$ fg %2
yes >/dev/null
<Ctrl>z
[2]+ Stopped                 yes >/dev/null

$ jobs
[1]- Stopped                 yes >/dev/null
[2]+ Stopped                 yes >/dev/null

The current job is always flagged with a +, and the previous job with a -.

Terminal (TTY)	Terminal ID from which the process was launched, provies linkage for 3 file descriptors: stdin, stdout, stderr
Open files	Files the process is using
Current directory	The directory from which the process was invoked
User ID (UID)	ID of the user who invoked the process
Effective User ID (EUID)	Determines what resources and files a process has permission to access at any given moment. There is a distinction between identity and permission. Think of setuid programs like sudo. (Next chapter)
Group ID (GID)	ID of the group that the user belongs to
Process ID (PID)	A unique number that the kernel randomly assigned to the process
Parent process ID (PPID)	The parent process ID, which launched the subject process
Priority	The processes scheduling priority or niceness. Determines how much CPU the process receives

u	select by user name
a	Select all processes on a terminal-- including those of other users
x	Select processes without controlling ttys
f	ASCII-art process heirarchy (forest)
e	Environment of the process
l	Long listing (along with basic flags)