Linux Processes & Networking

Process Management

Process Concepts & Hierarchy

What is a Process? An instance of a running program. Every process is assigned a unique Process ID (PID) and inherits the User ID and Group ID of the user who started it.

The init Process: The very first process started by the kernel at boot time. It never terminates and always has PID 1 (often systemd).

Child Processes: A process created by a running process. The parent is assigned a Parent Process ID (PPID). The parent must be running for the child processes to run.

Daemons: System processes that always run in the background and never require user input.

The Process Table

Summarizes current running processes on a system (across all users and system-initiated). It displays unique PIDs and shows both original and all subsequent/child processes.

Monitoring & Identification

ps Command

Invokes the process table. Displays processes run by current shell without options.

Option	Used To
a	List all user-triggered processes.
-e	List all processes.
-l	Long listing format.
u	List with user name and start time.
-U {user}	Display based on user.
-p {PID}	Display specific PID.
-C {cmd}	Display by command name.

Common ps Fields

PRI: Process scheduling priority (lower = higher priority).
NI: Nice value (using less CPU = higher number).
SIZE / RSS: Virtual / Physical memory in KB.
STAT: Process state (R, S, T, D, Z).
TT: Terminal associated with process.

Example Output

ps aux

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.1 168340 12692 ?        Ss   09:12   0:03 /sbin/init
neehar    2341  0.5  2.4 821948 198420 tty2    Sl+  09:15   1:23 /usr/bin/gnome-shell
neehar    5673  0.0  0.1  24128  8456 pts/0    Ss   10:30   0:00 bash

top / htop

Real-time, dynamic view of running tasks.

Enter: Refresh
Shift+n: Sort by PID
u: Filter by user
k: Terminate (kill)
r / -n: Renice PID

top

top - 10:45:12 up 1:33, 1 user, load avg: 0.23, 0.35, 0.41
Tasks: 215 total, 1 running, 214 sleeping
%Cpu(s): 1.5 us, 0.8 sy, 97.4 id

  PID USER      PR  NI    VIRT    RES  %CPU  %MEM     TIME+ COMMAND
 2341 neehar    20   0  821948 198420   2.5   2.4   1:23.45 gnome-shell
 1298 root      20   0  356128  89230   1.0   1.1   0:45.12 Xorg

pstree

Lists processes in a tree-like format to help track parent and child process relationships.

pstree

systemd─┬─cron
        ├─dbus-daemon
        └─sshd───sshd───bash───pstree

pgrep / pidof

pidof: Displays PID of a known process name.

Terminal

$ pidof bash
5673 5342

pgrep: Displays PIDs matching criteria.

Terminal

$ pgrep -u neehar
2341
5673

Process States

R - Running / ready to run

S - Interruptible sleep (waiting on trigger)

D - Uninterruptible sleep (permanently inactive)

T - Stopped (suspended/traced)

Z - Defunct / Zombie (ended before parent)

X - Dead (killed, rarely displayed)

Signals & Priorities

kill Commands & Signals

Signals are messages sent to processes to perform actions (suspend, terminate).

kill Sends signal (default SIGTERM) to PID.
pkill Signals based on name/identifiers.
killall Kills all processes by exact name.

Common Signals:

15 (SIGTERM): Graceful termination (default)
9 (SIGKILL): Forceful kill (immediate)
19 (SIGSTOP): Stop/Suspend process

Priority (nice & renice)

Niceness dictates how "nice" a process is in sharing system resources. Ranges from -20 (highest priority) to 19 (lowest priority). Default is 0.

nice -n {priority} {command}

Starts a new command with a specific nice value. Normal users cannot increase priority (lower nice value) once set, only root can.

renice {priority} {PID}

Alters the scheduling priority of an already running process. Can also target users (-u) or process groups (-g).

Job & Task Scheduling

Active Job Control

Foreground vs. Background: Only one program runs in the foreground at a time. Run a command in the background by appending &.

Suspend vs. Terminate: Press Ctrl+Z to suspend a foreground job (Stopped state). Press Ctrl+C to terminate it.

Background Control: Use bg %1 to resume a suspended job in the background. Use fg %1 to bring it to the foreground.

The Jobs Table

Shows only the processes started in a user's current shell. Use the jobs command. Status includes: Running, Stopped, Terminated, Done. Shows job numbers instead of PIDs.

+ designates the current/most recently started job.
- designates the job started just prior to the most recent one.

Terminal

$ jobs
[1]-  Running                 sleep 300 &
[2]+  Stopped                 nano /etc/hosts

Delayed & Detached Jobs

Delayed Jobs (sleep & at)

Put off the start of a job. For example, a CPU-intensive job that can slow down the system may be delayed for off-peak hours.

sleep {seconds} && {command}

Suspends any action for the specified seconds before running the command.

at {time}

Executes a given set of commands at a specified time (e.g. 10:00 PM).

Detached Jobs (nohup & screen)

Run jobs after you log out of the system.

nohup {command} &

Tells a program to ignore the hangup signal while disconnecting. Output goes to nohup.out.

screen

A full-screen window manager. Runs your program in the background and keeps the interactive shell open. Restore session with screen -r.

at Command Details

Options

Option	Enables You To
atq	Display job queue of all users.
atq -V	Display version number.
at -q [a-z]	Display jobs in specified queue.
at -m	Send mail to user when complete.
at -f {file}	Read job from file, not standard input.
at -l	Print all jobs queued for the user.
at -v	Display execution time before reading job.

Time Formats

Time Format	Description
HH:MM A.M./P.M.	Specifies the hour and minute.
MMDDYY / MM/DD/YY	Specifies the day, month, and year.
JAN / FEB / MAR	Specifies the month.
SUN / MON / TUE	Specifies the day of the week.

Automation (Cron)

Cron & crontab

Cron is a background daemon used to schedule periodically executed tasks. A scheduled task is called a cron job.

System default cron jobs are stored in /etc/crontab. Scripts can also be placed in directories like /etc/cron.daily or cron.hourly.

# Minute Hour Day Month Weekday Command

30 2 * * * /path/to/backup.sh

Automated Maintenance Tools

tmpreaper

Deletes files (e.g., in /tmp) that haven't been accessed for some time.
logrotate

Compresses, deletes, or mails log files on a schedule to manage disk space.
logwatch

Monitors logs and generates customizable reports for suspicious activity.

Anacron

A daemon that executes jobs at intervals specified in days, without requiring the system to be running continuously. Used for daily, weekly, or monthly jobs on systems like laptops that are shut down frequently.

Configured via /etc/anacrontab.

Networking Essentials

ip

Replaces the deprecated ifconfig command.

ip a

Shows all IP addresses associated with all network interfaces.

ping

Tests connectivity to another host.

ping google.com

Sends ICMP ECHO_REQUEST packets. Use -c 4 to limit count.

ss

Utility to investigate sockets (modern replacement for netstat).

ss -tuln

Shows all listening TCP/UDP ports numerically.

curl

Transfers data from or to a server.

curl -I https://api.io

Fetches only the HTTP headers. Extremely versatile for API testing.

SSH (Secure Shell)

Used for securely connecting to remote servers.

ssh user@192.168.1.10

By default uses port 22. Can use identity files via -i key.pem.