Red Hat System Administration I
Abstract
| Goal | To evaluate and control processes running on a Red Hat Enterprise Linux system. |
| Objectives |
|
| Sections |
|
| Lab |
|
Define process components and interpret process viewing commands.
Objectives
After completing this section, students should be able to:
Define the life cycle of a process.
Define process states.
View and interpret process listings.
What is a process?
A process is a running instance of a launched, executable program. A process consists of:
an address space of allocated memory,
security properties including ownership credentials and privileges,
one or more execution threads of program code, and
the process state.
The environment of a process includes:
local and global variables,
a current scheduling context, and
allocated system resources, such as file descriptors and network ports.
An existing (parent) process duplicates its own address space (fork) to create a new (child) process structure. Every new process is assigned a unique process ID (PID) for tracking and security. The PID and the parent's process ID (PPID) are elements of the new process environment. Any process may create a child process. All processes are descendants of the first system process, which is systemd(1) on a Red Hat Enterprise Linux 7 system.
 |
Through the fork routine, a child process inherits security identities, previous and current file descriptors, port and resource privileges, environment variables, and program code. A child process may then exec its own program code. Normally, a parent process sleeps while the child process runs, setting a request (wait) to be signaled when the child completes. Upon exit, the child process has already closed or discarded its resources and environment; the remainder is referred to as a zombie. The parent, signaled awake when the child exited, cleans the remaining structure, then continues with its own program code execution.
Process states
In a multitasking operating system, each CPU (or CPU core) can be working on one process at a single point in time. As a process runs, its immediate requirements for CPU time and resource allocation change. Processes are assigned a state, which changes as circumstances require.
 |
The Linux process states are illustrated in the previous diagram and described in the following table.
Table 7.1. Linux process states
| Name | Flag | Kernel-defined state name and description |
|---|---|---|
| Running | R | TASK_RUNNING: The process is either executing on a CPU or waiting to run. Process can be executing user routines or kernel routines (system calls), or be queued and ready when in the Running (or Runnable) state. |
| Sleeping | S | TASK_INTERRUPTIBLE: The process is waiting for some condition: a hardware request, system resource access, or signal. When an event or signal satisfies the condition, the process returns to Running. |
D |
TASK_UNINTERRUPTIBLE: This process is also Sleeping, but
unlike | |
K |
TASK_KILLABLE: Identical to the uninterruptible | |
| Stopped | T | TASK_STOPPED: The process has been Stopped (suspended), usually by being signaled by a user or another process. The process can be continued (resumed) by another signal to return to Running. |
T |
TASK_TRACED: A process that is being debugged is also temporarily
Stopped
and shares the same | |
| Zombie | Z | EXIT_ZOMBIE: A child process signals its parent as it exits. All resources except for the process identity (PID) are released. |
X | EXIT_DEAD: When the parent cleans up (reaps) the remaining child process structure, the process is now released completely. This state will never be observed in process-listing utilities. |
Listing processes
The ps command is used for listing current processes. The command can provide detailed process information, including:
the user identification (UID) which determines process privileges,
the unique process identification (PID),
the CPU and real time already expended,
how much memory the process has allocated in various locations,
the location of process
STDOUT, known as the controlling terminal, andthe current process state.
Important
The Linux version of ps supports three option formats, including:
UNIX (POSIX) options, which may be grouped and must be preceded by a dash,
BSD options, which may be grouped and must not be used with a dash, and
GNU long options, which are preceded by two dashes.
For example, ps -aux is not the same as ps aux.
A common display listing (options aux) displays all processes,
with columns in which users will be interested,
and includes processes without a controlling terminal.
A long listing (options lax) provides more technical detail,
but may display faster by avoiding the username lookup.
The similar UNIX syntax uses the options -ef to display all processes.
[student@serverX ~]$ps auxUSER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.1 0.1 51648 7504 ? Ss 17:45 0:03 /usr/lib/systemd/syst root 2 0.0 0.0 0 0 ? S 17:45 0:00 [kthreadd] root 3 0.0 0.0 0 0 ? S 17:45 0:00 [ksoftirqd/0] root 5 0.0 0.0 0 0 ? S< 17:45 0:00 [kworker/0:0H] root 7 0.0 0.0 0 0 ? S 17:45 0:00 [migration/0] -- output truncated --[student@serverX ~]$ps laxF UID PID PPID PRI NI VSZ RSS WCHAN STAT TTY TIME COMMAND 4 0 1 0 20 0 51648 7504 ep_pol Ss ? 0:03 /usr/lib/systemd/ 1 0 2 0 20 0 0 0 kthrea S ? 0:00 [kthreadd] 1 0 3 2 20 0 0 0 smpboo S ? 0:00 [ksoftirqd/0] 1 0 5 2 0 -20 0 0 worker S< ? 0:00 [kworker/0:0H] 1 0 7 2 -100 - 0 0 smpboo S ? 0:00 [migration/0] -- output truncated --[student@serverX ~]$ps -efUID PID PPID C STIME TTY TIME CMD root 1 0 0 17:45 ? 00:00:03 /usr/lib/systemd/systemd --switched-ro root 2 0 0 17:45 ? 00:00:00 [kthreadd] root 3 2 0 17:45 ? 00:00:00 [ksoftirqd/0] root 5 2 0 17:45 ? 00:00:00 [kworker/0:0H] root 7 2 0 17:45 ? 00:00:00 [migration/0] -- output truncated --
By default, ps with no options selects all processes with the same effective user ID (EUID) as the current user and associated with the same terminal where ps was invoked.
Processes in brackets (usually at the top) are scheduled kernel threads.
Zombies show up in a ps listing as exiting or defunct.
ps displays once. Use top(1) for a repetitive update process display.
ps can display in tree format to view parent/child relationships.
The default output is unsorted. Display order matches that of the system process table, which reuses table rows as processes die and new ones are created. Output may appear chronological, but is not guaranteed unless explicit
-Oor--sortoptions are used.
References
info libc signal (GNU C Library Reference Manual)
Section 24: Signal Handling
info libc processes (GNU C Library Reference Manual)
Section 26: Processes
ps(1) and signal(7) man pages
