Master Linux Process Management: From PCB to Fork, Exec, and Daemons

1. Process Control Block (PCB)

In Linux, each process is described by a PCB (Process Control Block), which stores key information such as PID, state, priority, memory pointers, program counter, and I/O status. The PCB is implemented by the task_struct structure in the kernel.

Commands like ps -ef and top can display parts of this information.

2. Linux Process Creation

The fork() system call creates a child process that is a copy of the parent. The kernel uses Copy‑On‑Write (COW) so parent and child initially share the same physical pages; a separate copy is made only when one writes to a page.

#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>

int main() {
    pid_t pid;
    pid = fork();
    if (pid < 0) {
        perror("fork error");
        return 1;
    } else if (pid == 0) {
        printf("I am the child process, my PID is %d, my parent's PID is %d
", getpid(), getppid());
    } else {
        printf("I am the parent process, my PID is %d, and I just created a child with PID %d
", getpid(), pid);
    }
    return 0;
}

After fork(), the return value distinguishes parent (PID of child) from child (0). The child can replace its memory image with a new program using the exec family (e.g., execlp("ls", "ls", "-l", NULL)).

#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
#include <stdlib.h>

int main() {
    pid_t pid;
    pid = fork();
    if (pid < 0) {
        perror("fork error");
        exit(1);
    } else if (pid == 0) {
        execlp("ls", "ls", "-l", NULL);
        perror("exec error");
        exit(1);
    } else {
        wait(NULL);
        printf("Child process has finished.
");
    }
    return 0;
}

3. Foreground, Background and Daemon Processes

3.1 Foreground processes

These run attached to the terminal; the terminal is blocked until the process finishes.

3.2 Background processes

Started with an ampersand (&) so the shell returns immediately. They inherit stdout/stderr but not stdin. Commands jobs, fg, and bg manage them.

3.3 Daemon processes

Daemons detach from any terminal, run in the background from system start, and usually run as root to bind privileged ports. They are created by forking, calling setsid(), changing working directory, resetting umask, and closing unnecessary file descriptors, or simply by using nohup.

4. Common Linux Process Management Commands

4.1 ps – view process status

Examples:

UID        PID  PPID  C STIME TTY          TIME CMD
root         1     0  0 08:30 ?        00:00:01 /sbin/init
user       101     1  0 09:00 pts/0    00:00:00 bash

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.1  20016  1212 ?        Ss   08:30   0:00:01 /sbin/init
user       101  0.1  0.5  12288  5124 pts/0    R+   09:00   0:00:00 bash

-ef

(UNIX style) shows full format including PPID and UID. -aux (BSD style) emphasizes resource usage. -C searches by command name. -p selects by PID.

4.2 top – real‑time monitoring

Displays CPU, memory, load average, and per‑process statistics. Common options: -u show processes of a specific user. -n limit number of updates. -d set delay between updates. -b batch mode for scripting. -H show threads.

4.3 htop – enhanced interactive monitor

Provides a colorful UI, tree view, and many shortcuts (F1‑help, F2‑setup, F3‑search, F4‑filter, F5‑tree, F6‑sort, F7/F8‑nice, F9‑kill, F10‑quit). -d set delay. -u filter by user. -p filter by PID. -s sort by column. -t tree view. --no-color monochrome mode.

4.4 pgrep – find processes by criteria

-u

user. -g group. -P parent PID. -f full command line. -l show name and PID. -o first match. -v invert match. -c count matches.

4.5 pkill – kill processes by criteria

-9

force kill (SIGKILL). -15 graceful terminate (SIGTERM). -u specify user. -f match full command line.

4.6 kill – send signals

Common signals: SIGTERM (15) – graceful termination, SIGKILL (9) – immediate kill, SIGSTOP – pause, SIGCONT – resume.

Example: kill 1234 (default SIGTERM).

Force: kill -9 1234.

Pause: kill -STOP 5678, resume: kill -CONT 5678.

4.7 killall – terminate by name

Example: killall httpd (SIGTERM) or killall -9 httpd (SIGKILL).

4.8 pidof – get PID(s) of a program

Example: pidof nginx returns all Nginx PIDs.

4.9 nice and renice – adjust priority

nice -n -5 python script.py

starts with higher priority; renice 10 1234 changes priority of an existing process.