Linux Processes - Part 2

For additional context to set up your workspace, please view the first guide in this series User and Group Management in Linux and Linux Processes - Part 1.

Given the parent/child relationship between processes, it is often necessary to visualize a hierarchical list of processes in the form of a tree. To do this, we will use a tool called pstree.

If the command is followed by

• A PID, then the tree will be displayed with such process at its root. Otherwise, it is rooted at PID=1.

• A username, pstree will return all trees owned by the user.

In addition to displaying only the name of processes, pstree can also return their PIDs when used with the -p option. The following image shows all trees owned by pluralsight. The images on the left and the right show the output with and without the use of -p. The number inside parentheses is the PID of each process.

On the right, we can see that tmux (PID=1470) is the parent of two bash processes (PID=1471 and PID=1486). The latter is in turn the parent of pstree. This simple example illustrates the usefulness of pstree to view at a glance the process trees of a given user.

Terminating a parent process has the effect of terminating its children as well.

Although it is useful to use ps to take snapshots of the process list, it may be necessary to monitor that list dynamically with refreshing intervals. Instead of doing ps several times, Linux provides another tool called top that is more fit for the job.

Additionally, top shows the same information as uptime as we can see below:

The above image indicates that the current time is 19:23:57. The system has been up for 1 hour and 10 minutes and the load average over the last minute, 5 minutes, and 15 minutes has been 0.03 (3%), 0.02 (2%), and 0.00 (0%), respectively. These percentages represent the use of CPU by running processes over the specified time intervals. In a multi-CPU system, these numbers should be divided by the number of processors to find out the average CPU usage. If you consistently experience high CPU usage, it may be time to add hardware resources to the machine or move the more CPU-hungry services to another system.

Remember to check out man top for further details on the use of this tool, particularly the FIELDS / Columns section, which describes the available information of processes that are shown by top.

Without any intervention on our part, the kernel will automatically adjust the CPU cycles that are allocated to a certain process. However, Linux also allows the system administrator to change this behavior through the nice (for new processes) and renice (for running processes) commands. Both tools use an integer value in the range of -20 to 19 to modify the priority that should be given to a process in terms of CPU usage. The lower the value, the less nice the application - which means it will take up more system resources.

A regular user can only increase the niceness of a process he or she owns. He or she cannot decrease it or change the priority of processes owned by other users. These are administrative tasks that must be performed either as root or using sudo as explained earlier.

To renice a process, use renice followed by the new niceness value, and -p [PID] where [PID] is the PID of the process. For example, the following image shows how to increase the priority of snapd from 0 (current) to -5. You will not only see the change of the niceness value and the use of ps with another format specifier (ni) to return this information. Also, --pid followed by a PID allows us to view the process fields of the corresponding process only.

After changing the niceness value of snapd, the kernel will start allocating more CPU cycles for it.

Processes can be forced to terminate by sending them signals using the kill or killall commands. The former requires the PID of the process that we want to manipulate, whereas the latter allows us to terminate processes by name or by specifying the owning user.

Terminating a process manually should only be considered when it has failed to respond or is interfering with the normal operation of other processes. For example, an outdated or failed plugin running on a web browser can cause the browser -and ultimately the system- to crash. Under this scenario, the memory usage typically skyrockets. Before that happens, it is a good idea to terminate the browser process and uninstall the offending plugin as soon as possible.

To kill a process by PID (say PID=1025), do

If it ignores this signal, you can resort to a more drastic measure by using -SIGKILL instead:

Please note, however, that the use of SIGTERM is preferred as it gives the process a chance to close any files it may be using (also known as clean termination).

If we want to terminate all the processes owned by a particular user, killall is more appropriate. The command should be followed by -u [USER], where [USER] is the owner of the processes. For example,

will terminate all processes owned by www-data. By the way, this account is the default owner of the Apache web server on Debian, Ubuntu, and similar distributions.

Please continue on to the next guide in this series: Shell Scripting With Bash For Linux Administration - Part 1 to continue learning about Linux Administration.