LPIC-1 103.5 — Create, Monitor and Kill Processes

What You Need to Know

• Run jobs in the foreground and background.
• Keep programs running after logout.
• Monitor active processes.
• Select and sort processes for display.
• Send signals to processes.

Processes: Basics

Every running program in Linux lives as a process. The kernel assigns each process a unique numeric identifier.

PID, PPID and Process States

PID (Process ID) — process number, 1 to 32768 by default.
PPID (Parent Process ID) — PID of the parent process that spawned it.

The process with PID 1 is always init or systemd — the parent of everything.

Possible process states:

Job Control

The bash shell can manage multiple jobs in a single terminal.

Running in the Background

Add & to the end of a command and it goes to the background immediately:

sleep 300 &
# [1] 4521   <- job number and PID

To send an already-running process to the background: press Ctrl+Z (this stops the process with SIGTSTP), then type bg.

fg, bg and jobs

jobs lists all jobs of the current shell:

jobs
# [1]-  Running    sleep 300 &
# [2]+  Stopped    vim file.txt

+ marks the current default job, - marks the previous one.

jobs options:

bg resumes a stopped job in the background:

bg %2    # send job #2 to background
bg       # send current job (marked +)

fg brings a job to the foreground:

fg %1    # bring job #1 to foreground
fg       # bring current job to foreground

If no job is specified, fg and bg act on the current job (marked +). The kill command, unlike them, always requires a jobspec.

Jobspec: Ways to Reference a Job

Jobspec (job specification) is how you refer to a specific job in fg, bg, kill, and jobs.

Examples:

jobs %1        # job #1
jobs %sl       # job whose command starts with "sl"
jobs %?leep    # job whose command contains "leep"
fg %+          # bring current job to foreground
kill %-        # kill previous job

Surviving Logout: nohup, screen, tmux

By default, when you exit a terminal the shell sends SIGHUP to all its child processes and they terminate. Three tools solve this problem in different ways.

nohup

nohup runs a command with SIGHUP ignored. Output goes to nohup.out in the current directory by default (or $HOME/nohup.out if the current directory is not writable).

nohup ./long_script.sh &
# output -> nohup.out

nohup ./script.sh > /var/log/script.log 2>&1 &
# output -> specified file

nohup only protects against SIGHUP and does not create a persistent session.

screen

GNU Screen was created in 1987 to emulate multiple independent VT100 terminals on a single physical terminal. Structure: a session contains windows; windows can be split into regions.

Command prefix: Ctrl+A.

Starting and sessions:

screen              # new session
screen -S mywork    # new session with a name
screen -ls          # list sessions
screen -r           # reattach (when there's only one session)
screen -r mywork    # reattach by name or PID
screen -S PID -X quit   # terminate a session by PID

Reattach options:

Key bindings (after Ctrl+A):

Closing a region does not close its window; the window keeps running.

Copy mode in screen:

1. Enter: Ctrl+A [
2. Navigate with arrows or PgUp/PgDown.
3. Mark start: Space.
4. Move to end.
5. Mark end: Space.
6. Paste in the target window: Ctrl+A ].

Config: /etc/screenrc (system) and ~/.screenrc (user).

tmux

tmux was released in 2007. It uses a client-server model. Structure: a session contains windows; windows are split into panes. Unlike screen regions, panes are full pseudo-terminals — closing a pane terminates its process.

Command prefix: Ctrl+B.

Starting and sessions:

tmux                            # new session
tmux new -s "LPI" -n "Window"   # session with name, first window named
tmux ls                         # list sessions
tmux a                          # attach (when there's only one session)
tmux attach -t mywork           # attach by name
tmux attach -d -t mywork        # attach, detaching other clients first
tmux kill-session -t mywork     # terminate session

Key bindings (after Ctrl+B):

Copy mode in tmux:

1. Enter: Ctrl+B [
2. Navigate with arrows.
3. Mark start: Ctrl+Space.
4. Move to end.
5. Copy: Alt+W.
6. Paste: Ctrl+B ].

Config: /etc/tmux.conf and ~/.tmux.conf. Example with alternate config: tmux -f /path/to/config.

screen vs tmux

Key difference from nohup: in screen and tmux processes live inside a server that keeps running independently of the network connection.

Monitoring Processes

ps

ps takes a snapshot of processes at the time it runs. It accepts options in three styles:

Most common variants:

ps aux               # all processes, extended format (BSD style)
ps -ef               # all processes, full format (System V)
ps a                 # processes with a terminal (tty)
ps -e --forest       # process tree
ps -p 1234           # specific PID
ps aux --sort=-%cpu  # sort by CPU descending
ps aux --sort=-%mem  # sort by memory descending

Filter by user (all three are equivalent):

ps U www-data        # BSD
ps -u www-data       # UNIX
ps --user www-data   # GNU

Select columns with -o:

ps -eo pid,user,cmd             # only selected fields
ps o user,%mem,%cpu,cmd         # user, memory, CPU, command
ps o user,comm                  # user and program name

BSD-style flags a, u, x:

Columns in ps aux:

Extended codes in the STAT column:

top

top shows processes in real time, refreshing every 3 seconds.

top
top -u alice        # only processes of a user
top -p 1234,5678    # specific PIDs
top -n 5            # update 5 times then exit
top -b -n 1         # batch mode, one update (useful for scripts)

Interactive keys inside top:

Launch top with a specific sort field:

top -o %MEM    # sort by memory on startup

Header lines in top:

• load average — three numbers: load over 1, 5, and 15 minutes. On a single-core system, 1.0 means full load.
• Tasks — total, running, sleeping, stopped, zombie.
• %Cpu(s) — CPU time breakdown: us (user), sy (system), ni (nice), id (idle), wa (iowait), hi (hardware interrupts), si (software interrupts), st (stolen).
• MiB Mem / MiB Swap — memory usage.

pgrep and pidof

pgrep searches for processes by name and returns PIDs:

pgrep firefox           # find all PIDs of firefox processes
pgrep -l firefox        # with names
pgrep -u alice          # processes of user alice
pgrep -a sshd           # PID and full command line

pidof does the same but requires an exact program name:

pidof apache2

Both work for substitution into kill: kill $(pgrep sleep) and kill $(pidof sleep).

watch

watch repeatedly runs a command at a given interval and displays the output:

watch ps aux            # update every 2 seconds (default)
watch -n 5 free -h      # every 5 seconds
watch -d ls /tmp        # highlight changes

uptime and free

uptime shows system uptime and average load:

uptime
# 14:32:11 up 5 days, 3:12,  2 users,  load average: 0.15, 0.10, 0.09

free shows RAM and swap usage:

free -h     # human-readable units (K, M, G)
free -m     # in megabytes
free -s 2   # update every 2 seconds

Signals and Killing Processes

Signals are the mechanism for notifying processes about events. A process can catch a signal, ignore it, or let the default action run.

The most important signals:

List all signals: kill -l.

kill

kill sends a signal to a process by PID:

kill 1234           # SIGTERM (15) by default
kill -9 1234        # SIGKILL
kill -SIGKILL 1234  # same thing
kill -15 1234       # explicit SIGTERM
kill -HUP 1234      # SIGHUP (reload config)

A signal can be specified three ways:

kill -SIGHUP 1234    # by name
kill -1 1234         # by number
kill -s SIGHUP 1234  # via -s option

To avoid looking up PIDs manually, use command substitution:

kill $(pgrep apache2)   # modern syntax
kill `pgrep apache2`    # old syntax

Use SIGKILL as a last resort: the process has no chance to shut down cleanly, save data, or release resources.

pkill and killall

pkill sends a signal to processes by name (no PID needed):

pkill firefox           # SIGTERM to all firefox
pkill -9 firefox        # SIGKILL
pkill -u alice          # terminate all processes of user alice
pkill -STOP firefox     # stop firefox

killall works similarly but requires an exact name match:

killall httpd           # SIGTERM to all httpd
killall -9 httpd        # SIGKILL
killall -v httpd        # verbose (print PIDs)
killall -i httpd        # interactive (ask for confirmation)

Difference: pkill supports regular expressions and partial matching; killall requires an exact name.

Quick Reference

# Job control
command &               # run in background
Ctrl+Z                  # stop current process
bg [%n]                 # resume job in background
fg [%n]                 # bring job to foreground
jobs                    # list jobs of current shell
jobs -l                 # with PIDs

# Protect from logout
nohup command &                  # ignore SIGHUP
nohup cmd > file.log 2>&1 &      # with redirection
screen -S name                   # new screen session
screen -r name                   # reattach
tmux new -s name                 # new tmux session
tmux attach -t name              # reattach

# Monitoring
ps aux                  # all processes
ps -ef                  # all processes (different format)
ps aux --sort=-%mem     # sort by memory
top                     # interactive monitoring
top -b -n 1             # batch mode
pgrep -l name           # find PID by name
watch -n 5 free -h      # watch a command
uptime                  # system load
free -h                 # memory

# Signals
kill -l                 # list signals
kill PID                # SIGTERM
kill -9 PID             # SIGKILL
pkill name              # by name
pkill -u user           # by user
killall name            # exact name

Exam Tips

Which signal does kill send by default? SIGTERM (15). It can be caught and handled, unlike SIGKILL (9).

How does pkill differ from killall? pkill supports partial matching and regular expressions. killall requires an exact name.

What does Ctrl+Z do? Sends SIGTSTP, which suspends the process. After that bg sends it to the background, fg brings it to the foreground.

How does nohup differ from screen? nohup only protects against SIGHUP. screen creates a persistent session you can return to.

Where does nohup send output? To nohup.out in the current directory, or $HOME/nohup.out.

How do you detach from a tmux session? Ctrl+B, then d.

What does a load average of 2.0 mean on a dual-core processor? Full load across all cores (1.0 per core).

How do you list all signals? kill -l.

Which signals cannot be caught or ignored? SIGKILL (9) and SIGSTOP (19).

Exercises

Guided Exercises — Lesson 1

Exercise 1. oneko and Job Control

oneko is a program that shows a cat chasing the mouse cursor. Use it to practice job control.

How do you run the program?

oneko

How do you suspend the process, and what is printed?

[1]+  Stopped    oneko

How do you check how many jobs are currently active?

jobs

[1]+  Stopped    oneko

How do you send the job to the background by its job ID, and how do you know it’s running?

bg %1

[1]+ oneko &

How do you terminate the job by its job ID?

kill %1

Exercise 2. PID of Apache Processes

Task: Find the PIDs of all Apache HTTPD (apache2) processes using two different commands.

pgrep apache2

pidof apache2

Exercise 3. Stop Apache Without a PID

Task: Terminate all apache2 processes without using their PIDs, using two commands.

pkill apache2

killall apache2

Exercise 4. kill with Command Substitution

Task: Terminate all apache2 instances via kill with the default signal (SIGTERM) in one line, without knowing their PIDs.

kill $(pgrep apache2)

kill `pgrep apache2`

kill $(pidof apache2)

Exercise 5. top: Forest View and Full Paths

Task: Launch top and perform two actions inside the interface.

How do you show the process tree (forest view)?

How do you show full process paths and separate userspace from kernelspace?

Exercise 6. ps Filtered by www-data

Task: Show all processes running as www-data (Apache HTTPD) using three different syntax styles.

ps U www-data

ps -u www-data

ps --user www-data

Explorational Exercises — Lesson 1

Exercise 7. SIGHUP and Apache

SIGHUP is used to restart daemons: Apache rereads its config, closes old child processes, and spawns new ones — while the parent process itself stays alive.

How do you start the web server?

sudo systemctl start apache2

How do you find the PID of the parent process?

ps aux | grep apache2

How do you reload Apache with SIGHUP?

kill -SIGHUP <parent_PID>

How do you verify the parent is still alive and children were recreated?

ps aux | grep apache2

Exercise 8. watch + ps for Connection Monitoring

A static ps output becomes dynamic when wrapped in watch. Monitor new connections to Apache.

How do you add MaxConnectionsPerChild to the config?

MaxConnectionsPerChild 1

sudo systemctl restart apache2

How do you run watch with ps and grep to monitor apache2?

watch 'ps aux | grep apache2'

What happens in the watch output when a browser connects to the server?

Exercise 9. top -o for Sorting on Startup

How do you launch top sorted by memory immediately?

top -o %MEM

How do you confirm the sort column is active (highlight it)?

Exercise 10. ps -o for Column Selection

How do you print only user, % memory, % CPU, and full command?

ps o user,%mem,%cpu,cmd

How do you print only user and program name?

ps o user,comm

Guided Exercises — Lesson 2

Exercise 11. screen vs tmux: Feature Comparison

Task: Identify which feature belongs to GNU Screen, tmux, or both.

Exercise 12. Working with GNU Screen

How do you start screen?

screen

How do you open a new window and edit /etc/screenrc in vi?

sudo vi /etc/screenrc

How do you display the window list in the bottom bar?

How do you rename the current window to “vi”?

How do you detach and create a new session named “ssh”?

Ctrl+A d
screen -S "ssh"

How do you list sessions and reattach to the first one by PID?

Ctrl+A d
screen -ls
screen -r PID

How do you split the window horizontally and move to the new empty region?

Ctrl+A S
Ctrl+A Tab

How do you terminate a session by PID from the command line?

screen -S PID -X quit

Exercise 13. Working with tmux

How do you start tmux?

tmux

How do you open a new window and create ~/.tmux.conf with nano?

Ctrl+B c
nano ~/.tmux.conf

How do you split the window vertically and resize the new pane?

Ctrl+B "
Ctrl+B Ctrl+↓   (several times)

How do you rename the current window to “text editing”?

Ctrl+B ,   (type "text editing", Enter)

How do you detach and create a new session named “ssh” with window “ssh window”?

Ctrl+B d
tmux new -s "ssh" -n "ssh window"

How do you attach to the “ssh” session from a remote machine, guaranteeing the other client is detached?

tmux a -d -t ssh

How do you terminate a session by name?

tmux kill-session -t ssh

Explorational Exercises — Lesson 2

Exercise 14. Multiplexer Command Line

Both tools support a command mode via prefix + :.

How do you enter copy mode in screen via the command line?

Ctrl+A :
copy

How do you rename the current tmux window via the command line?

Ctrl+B :
rename-window

How do you close all screen windows and end the session via the command line?

Ctrl+A :
quit

How do you split a tmux pane via the command line?

Ctrl+B :
split-window

How do you close the current tmux window via the command line?

Ctrl+B :
kill-window

Exercise 15. Copy Mode in screen with vi-like Navigation

How do you echo a long word?

echo supercalifragilisticexpialidocious

How do you copy five consecutive characters from that line?

How do you paste the copied text into the command line?

Ctrl+A ]

Exercise 16. Shared tmux Session

Task: Another user wants to connect via tmux -S /tmp/our_socket a -t our_session. The socket is already created with correct permissions. What two other conditions are needed?

Topic 103: GNU and Unix Commands