=====Monitor and Manage Processes=====
====Using PS====
Using PS to monitor processes
**ps aux | grep bash** look for any bash processes.
Showing multiple states
[user@host ~]$ ps aux
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
...output omitted...
root 2 0.0 0.0 0 0 ? S 11:57 0:00 [kthreadd]
student 3448 0.0 0.2 266904 3836 pts/0 R+ 18:07 0:00 ps aux
...output omitted...
Here is what the states mean
^ Name ^ Flag ^ Kernel-defined state name and description ^
| Running | R |TASK_RUNNING: The process is either executing on a CPU or waiting to run. The process can be executing user routines or kernel routines (system calls), or be queued and ready when in the Running (or Runnable) state.|
| Sleeping | S |TASK_INTERRUPTIBLE: The process is waiting for some condition: a hardware request, system resource access, or a signal. When an event or signal satisfies the condition, the process returns to Running.|
| | D | TASK_UNINTERRUPTIBLE: This process is also sleeping, but unlike the S state, does not respond to signals. It is used only when process interruption might cause an unpredictable device state. |
| | K |TASK_KILLABLE: Same as the uninterruptible D state, but modified to allow a waiting task to respond to the signal to kill it (exit completely). Utilities often display Killable processes as the D state.
| | I |TASK_REPORT_IDLE: A subset of state D. The kernel does not count these processes when calculating the load average. It is used for kernel threads. The TASK_UNINTERRUPTIBLE and TASK_NOLOAD flags are set. It is similar to TASK_KILLABLE, and is also a subset of state D. It accepts fatal signals.|
| Stopped | T |TASK_STOPPED: The process is stopped (suspended), usually by being signaled by a user or another process. The process can be continued (resumed) by another signal to return to running.|
| | T |TASK_TRACED: A process that is being debugged is also temporarily stopped and shares the T state flag. |
| Zombie | Z |EXIT_ZOMBIE: A child process signals to its parent as it exits. All resources except for the process identity (PID) are released.|
| | X |EXIT_DEAD: When the parent cleans up (reaps) the remaining child process structure, the process is now released completely. This state cannot be observed in process-listing utilities.|
other PS options are
* lax similar to aux but does not resolve the USER id name
* -ef
====Running Commands====
You can run commands in the background by appending an **&** to them
sleep 10000 &
use the command **jobs** to see what you have running in the background to bring a job back in to the foreground use **fg %#** wherre number is the job number
[user@host ~]$ jobs
[1]+ Running sleep 10000 &
[user@host ~]$
and to bring it to the foreground
[user@host ~]$ fg %1
sleep 10000
you can use **pgrep** to identify a process (similar to ps -aux | grep )
or even better you can use **pidoff** you can also use **pstree -p user** to give you a parents etc of process
You can stop the command using pkill if you have several versions of the same process running you can use **killall**
[user@host ~]$ ps aux | grep job
5194 0.0 0.1 222448 2980 pts/1 S 16:39 0:00 /bin/bash /home/user/bin/control job1
5199 0.0 0.1 222448 3132 pts/1 S 16:39 0:00 /bin/bash /home/user/bin/control job2
5205 0.0 0.1 222448 3124 pts/1 S 16:39 0:00 /bin/bash /home/user/bin/control job3
5430 0.0 0.0 221860 1096 pts/1 S+ 16:41 0:00 grep --color=auto job
[user@host ~]$ killall control
[1] Terminated control job1
[2]- Terminated control job2
[3]+ Terminated control job3
[user@host ~]$
To kill background jobs first use jobs to identify the job number
[user@host ~]$ jobs
[1]- Running sleep 500 &
[2]+ Running sleep 1000 &
[user@host ~]$
then use kill and prefix the job number with a %
[user@host ~]$ kill -SIGTERM %1
[user@host ~]$ jobs
[2]+ Running sleep 1000 &
THere are various kill optionns for process the fundamental ones are
^ Signal ^ Name ^ Definition ^
| 1 | HUP | Hangup : Reports termination of the controlling process of a terminal. Also requests process re-initialization (configuration reload) without termination.|
| 2 | INT |Keyboard interrupt : Causes program termination. It can be blocked or handled. Sent by pressing the INTR (Interrupt) key sequence (Ctrl+c).|
| 3 | QUIT |Keyboard quit : Similar to SIGINT; adds a process dump at termination. Sent by pressing the QUIT key sequence (Ctrl+\).|
| 9 | KILL |Kill, unblockable : Causes abrupt program termination. It cannot be blocked, ignored, or handled; consistently fatal.
| 15 default | TERM |Terminate : Causes program termination. Unlike SIGKILL, it can be blocked, ignored, or handled. The "clean" way to ask a program to terminate; it allows the program to complete essential operations and self-cleanup before termination.|
| 18 | CONT |Continue : Sent to a process to resume if stopped. It cannot be blocked. Even if handled, it always resumes the process.|
| 19 | STOP | Stop, unblockable : Suspends the process. It cannot be blocked or handled.|
| 20 | TSTP | Keyboard stop : Unlike SIGSTOP, it can be blocked, ignored, or handled. Sent by pressing the suspend key sequence (Ctrl+z).|
so for example to get ssh to reread its configuration you can run systemctl status to find is main pid and then run
kill -1 PUID
====logging users out====
YOu identify the users with **w** then use
**pgrep -l -u username** this showsa all the processes being run by the user
finally you can use **pkill -SIGKILL -u username** this will kill all the prtocesses being run by the user and will force a logout of the user
you can also close a particular seccion of a user
in that case use **w -u username** then specify the pts seccion you want to close **pkill -t ptsXX -SIGKILL**