Master Linux Process Management: From Basics to Advanced Monitoring

1. Introduction

A program is a static collection of code and data, while a process is the dynamic execution of that program, allocated memory, identity, and permissions by the operating system. When a program runs, the resulting process is referred to simply as a process.

Process vs. Program

Programs are permanent binary files (e.g., /bin/ls, /bin/cp) that can exist indefinitely on disk. Processes are temporary instances with a lifecycle that ends when the program terminates.

Process Lifecycle

The lifecycle describes the creation, execution, and termination of a process. A parent process can fork child processes; children inherit the parent’s attributes. If a parent exits before its children, those children become zombie processes.

2. Monitoring Process Status

Static Monitoring with ps

The ps command displays information such as USER, PID, %CPU, %MEM, VSZ, RSS, TTY, STAT, START, TIME, and COMMAND. The STAT column indicates the process state (e.g., R‑running, S‑sleeping, D‑uninterruptible sleep, Z‑zombie, etc.).

Example:

# ps aux | grep oldboy

Dynamic Monitoring with top

top

shows real‑time tasks, CPU usage, memory usage, and process states. Common interactive keys include h for help, 1 to display all CPU cores, b to highlight running processes, M to sort by memory, and P to sort by CPU.

3. Managing Processes

Signals and kill

Use kill -l to list supported signals. The most common are: SIGHUP (1): reload configuration SIGKILL (9): force termination SIGTERM (15): graceful termination (default for kill)

Example:

# kill -9 9160   # force‑kill a process

Convenient Commands

killall

and pkill terminate processes by name, combining the search and kill steps.

# pkill nginx

4. Background Jobs and Session Management

Traditional job control uses &, jobs, bg, and fg, but tools like screen provide a more robust solution.

# yum install screen -y
# screen -S wget_mysql   # start a named session
# ctrl+a d               # detach without stopping tasks
# screen -list           # list sessions
# screen -r wget_mysql   # reattach

Other utilities include nohup (e.g., nohup ping www.baidu.com >/dev/null &) for detaching processes from the terminal.

5. Process Priority (Nice)

The nice value determines scheduling priority: lower values (e.g., -20) give higher priority, while higher values (e.g., +19) lower it. View and modify priorities with top, ps, nice, and renice.

# nice -n -5 vim &   # start vim with high priority
# renice -n -20 98002   # raise priority of a running process

6. System Load and Performance Metrics

The load average represents the average number of active (running or uninterruptible) processes over 1, 5, and 15 minutes. It should be compared to the number of CPU cores; values exceeding 70% of core count warrant investigation.

Typical commands: uptime – shows load averages free – displays memory usage vmstat – reports virtual memory, I/O, and CPU statistics iostat – monitors disk I/O dstat – aggregates CPU, disk, memory, network, and process metrics

Analyzing Load Scenarios

Three common cases are demonstrated:

CPU‑intensive workload (using stress --cpu) – high CPU usage directly raises load.

I/O‑intensive workload (using stress --io) – load increases while CPU idle remains low, indicating I/O bottlenecks.

Excessive process count (multiple stress -c instances) – many processes compete for limited CPU, causing high load and high %wait values.

Tools like pidstat help pinpoint the offending processes.

7. Additional System Tools

Other useful commands include: ps aux – detailed process list top and htop – interactive process viewers watch -d uptime – continuously monitor load changes

8. Security Basics (Brief)

Common firewall vendors (e.g., Green Army, Deep Trust, Sangfor) and basic iptables usage are listed. SELinux can be disabled via /etc/selinux/config or temporarily with setenforce 0.