Table of Contents
Monitor and Manage Processes
Using PS
Using PS to monitor processes
ps aux | grep bash look for any bash processes.
Showing multiple states
[user@host ~]$ ps aux USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND ...output omitted... root 2 0.0 0.0 0 0 ? S 11:57 0:00 [kthreadd] student 3448 0.0 0.2 266904 3836 pts/0 R+ 18:07 0:00 ps aux ...output omitted...
Here is what the states mean
| Name | Flag | Kernel-defined state name and description |
|---|---|---|
| Running | R | TASK_RUNNING: The process is either executing on a CPU or waiting to run. The process can be executing user routines or kernel routines (system calls), or be queued and ready when in the Running (or Runnable) state. |
| Sleeping | S | TASK_INTERRUPTIBLE: The process is waiting for some condition: a hardware request, system resource access, or a signal. When an event or signal satisfies the condition, the process returns to Running. |
| D | TASK_UNINTERRUPTIBLE: This process is also sleeping, but unlike the S state, does not respond to signals. It is used only when process interruption might cause an unpredictable device state. | |
| K | ||
| I | TASK_REPORT_IDLE: A subset of state D. The kernel does not count these processes when calculating the load average. It is used for kernel threads. The TASK_UNINTERRUPTIBLE and TASK_NOLOAD flags are set. It is similar to TASK_KILLABLE, and is also a subset of state D. It accepts fatal signals. | |
| Stopped | T | TASK_STOPPED: The process is stopped (suspended), usually by being signaled by a user or another process. The process can be continued (resumed) by another signal to return to running. |
| T | TASK_TRACED: A process that is being debugged is also temporarily stopped and shares the T state flag. | |
| Zombie | Z | EXIT_ZOMBIE: A child process signals to its parent as it exits. All resources except for the process identity (PID) are released. |
| X | EXIT_DEAD: When the parent cleans up (reaps) the remaining child process structure, the process is now released completely. This state cannot be observed in process-listing utilities. |
other PS options are
- lax similar to aux but does not resolve the USER id name
- -ef
Running Commands
You can run commands in the background by appending an & to them
sleep 10000 &
use the command jobs to see what you have running in the background to bring a job back in to the foreground use fg %# wherre number is the job number
[user@host ~]$ jobs [1]+ Running sleep 10000 & [user@host ~]$
and to bring it to the foreground
[user@host ~]$ fg %1 sleep 10000
you can use pgrep to identify a process (similar to ps -aux | grep )
or even better you can use pidoff you can also use pstree -p user to give you a parents etc of process
You can stop the command using pkill if you have several versions of the same process running you can use killall
[user@host ~]$ ps aux | grep job 5194 0.0 0.1 222448 2980 pts/1 S 16:39 0:00 /bin/bash /home/user/bin/control job1 5199 0.0 0.1 222448 3132 pts/1 S 16:39 0:00 /bin/bash /home/user/bin/control job2 5205 0.0 0.1 222448 3124 pts/1 S 16:39 0:00 /bin/bash /home/user/bin/control job3 5430 0.0 0.0 221860 1096 pts/1 S+ 16:41 0:00 grep --color=auto job [user@host ~]$ killall control [1] Terminated control job1 [2]- Terminated control job2 [3]+ Terminated control job3 [user@host ~]$
To kill background jobs first use jobs to identify the job number
[user@host ~]$ jobs [1]- Running sleep 500 & [2]+ Running sleep 1000 & [user@host ~]$
then use kill and prefix the job number with a %
[user@host ~]$ kill -SIGTERM %1 [user@host ~]$ jobs [2]+ Running sleep 1000 &
THere are various kill optionns for process the fundamental ones are
| Signal | Name | Definition |
|---|---|---|
| 1 | HUP | Hangup : Reports termination of the controlling process of a terminal. Also requests process re-initialization (configuration reload) without termination. |
| 2 | INT | Keyboard interrupt : Causes program termination. It can be blocked or handled. Sent by pressing the INTR (Interrupt) key sequence (Ctrl+c). |
| 3 | QUIT | Keyboard quit : Similar to SIGINT; adds a process dump at termination. Sent by pressing the QUIT key sequence (Ctrl+\). |
| 9 | KILL | |
| 15 default | TERM | Terminate : Causes program termination. Unlike SIGKILL, it can be blocked, ignored, or handled. The “clean” way to ask a program to terminate; it allows the program to complete essential operations and self-cleanup before termination. |
| 18 | CONT | Continue : Sent to a process to resume if stopped. It cannot be blocked. Even if handled, it always resumes the process. |
| 19 | STOP | Stop, unblockable : Suspends the process. It cannot be blocked or handled. |
| 20 | TSTP | Keyboard stop : Unlike SIGSTOP, it can be blocked, ignored, or handled. Sent by pressing the suspend key sequence (Ctrl+z). |
so for example to get ssh to reread its configuration you can run systemctl status to find is main pid and then run
kill -1 PUID
logging users out
YOu identify the users with w then use
pgrep -l -u username this showsa all the processes being run by the user
finally you can use pkill -SIGKILL -u username this will kill all the prtocesses being run by the user and will force a logout of the user
you can also close a particular seccion of a user
in that case use w -u username then specify the pts seccion you want to close pkill -t ptsXX -SIGKILL