Skip to content
Snippets Groups Projects
6_unix_processes.md 14.41 KiB
title: Unix Processes

Unix Processes

cc_by_sa

Objective: Understand how process works in GNU/Linux

A program is a list of instructions to be executed on a computer. These instructions are written in one or many files in a format readable by the computer (binary files), or interpretable by the computer (text file). The interpretable format needs to be processed by an interpreter who is in binary format.

The execution of a program on the system is represented as one or many processes. The program is the file of instruction while the process is the instructions being read.

mkdir is the program, when you type mkdir my_folder, you launch an mkdir process.

Your shell is a process to manipulate other processes.

In multitasking operating systems, processes (running programs) need a way to create new processes, e.g. to run other programs. Fork and its variants are typically the only way of doing so in Unix-like systems. For a process to start the execution of a different program, it first forks to create a copy of itself. Then, the copy, called the "child process", calls the exec system call to overlay itself with the other program: it ceases execution of its former program in favor of the other.

Some commands in your shell don’t have an associated process, for example there is no cd program, it’s a functionality of your shell. The cd command tell your bash process to do something not to fork another process.

Process attributes

  • PID : the process identifier is an integer, at a given time each PID is unique to a process
  • PPID : the parent process identifier is the PID of the process that has stared the current process
  • UID : the user identifier is the identifier of the user that has started the process, except for SE Linux, the process will have th same right as the user launching it.
  • PGID : the process group identifier (like users, processes have groups)

You can use the command ps to see the processes launched by your user

ps

Like for the command ls you can use the switch -l to have more details.

Open another tab in your browser to log again on your VM. Keep this tab open, we are going to use both of them in this session.

In this new tab, you are going to launch a less process.

less .bashrc

Comme back, to your first tab, can you see your less process with the command ps ?

The ps option -u [login] list all the processes with UIDthe UIDassociated with [login]

ps -l -u etudiant

Is the number of bash processes consistent with the number of tabs you openned ?

What is the PPID of the less process ? Can you identify in which bash process less is running ?

Did you launch the systemd and (sd-pam) process ?

pam stand for pluggable authentication modules, it’s a collection of tools that handle identification and resource access restriction. From the PPID of the (sd-pam) can you find which process launched (sd-pam) ? What is the PPID of this process ?

The option -C allows you to filter process by name

ps -l -C systemd

Who launched the first systemd process ?

Processes tree

From PPID to PPID, you can guess that like the file system, processes are organized in a tree. The command pstree can give you a nice representation of this tree.

The following ps command shows information on the process with PID 1

ps -l -1

Is this output coherent with what you know on PID and the previous ps command ? Can you look at the corresponding program (with the command which) ?

Can you look for information on PID 0 ?

The root of the processes tree is the PID 1.

What is the UID of the dockerd process, can you guess why we were able to gain sudo access in the previous section by using a docker command ?

ps give you a static snapshot of the processes but processes are dynamic. To see them running you can use the command top. While top is functional, most system have htop with a more accessible interface. You can test top and htop.

Like ps you can use -u etduiant with htop to only display your user processes.

With the F6 key, you can change the column on which to sort your process.

  • Which process is consuming the most of CPU ?
  • Which process is consuming the most of memory ?

What is the difference between M_SIZE (VIRT column), M_RESIDENT (RES column) and M_SHARE (SHR column) ? To which value, the column MEM% corresponds to ?

  • M_SIZE : The total amount of virtual memory used by the task. It includes all code, data and shared libraries plus pages that have been swapped out and pages that have been mapped but not used (If an application requests 1 GB of memory but uses only 1 MB, then VIRT will report 1 GB).
  • M_RESIDENT : what’s currently in the physical memory. This does not include the swapped out memory and some of the memory may be shared with other processes (If a process uses 1 GB of memory and it calls fork(), the result of forking will be two processes whose RES is both 1 GB but only 1 GB will actually be used since Linux uses copy-on-write).
  • M_SHARE : The amount of shared memory used by a task. It simply reflects memory that could be potentially shared with other processes.

Wait what is swapped out memory ?

Linux divides its physical RAM (random access memory) into chucks of memory called pages. Swapping is the process whereby a page of memory is copied to the preconfigured space on the hard disk, called swap space, to free up that page of memory. The combined sizes of the physical memory and the swap space is the amount of virtual memory available.

And as you HDD (even your fast SSD) is way slower than your RAM, when you run out of RAM and the system start to swap out memory, things will start to go really slowly on your computer. Generally, you want to avoid swapping. The swap space is often a dedicated partition in the Linux_swap format.

From the htop command, what is the size of the swap space on your VM ?

You have control over all the process launched with your UID. To test this control we are going to use the well-named command stress. Check the manual of the stress command.

Launch the stress for 1 cpu and 3600 second.

You don’t have a prompt, it means that the last command (stress) is running.

Terminate

Instead of taking a nap and come back at the end of this session, we may want to interrupt this command. The first way to do that is to ask the system to terminate the stress process.

From your terminal you can press ctrl + c. This short cut terminates the current process, it works everywhere except for programs like man or less which can be closed with the key q.

Launch another long stress process and switch to your other terminal tab and list your active process.

ps -l -u etudiant

You ask stress to launch a worker using 100% of one cpu (you can also see that with htop). You can see that the stress process you launched (with the PPID of your bash) forked another stress process.

Another way to terminate a process is with the command kill. kill is used to send a signal to a process with the command:

kill -15 PID

The -15 option is the default option for kill so you can also write kill PID.

We can do the same thing as with the command ctrl + c: ask nicely the process to terminate itself. The -15 signal is called the SIGTERM.

On rare occasions a buggy process will not be able to listen to signals anymore. The signal -9 will kill a process (not nicely at all). The -9 signal is called the SIGKILL signal. There are 64 different signals that you can send with the kill command.

Use the kill command to terminate the worker process of your stress command. Go to the other tab where stress was running. What is the difference with your previous ctrl + c ?

In your current terminal type the bash command, nothing happens. You have a shell within a shell. Launch a long stress command and switch to the other tab.

You can use the ps command to check that sleep is running within a bash within a bash

ps -l --forest -u etudiant

Nicely terminate the intermediate bash. What happened ?

Try not nicely. What happened ?

A process with a PPID of 1 is called a daemon, daemons are processes that run in the background. Congratulations you created your first daemon.

Kill the remaining stress processes with the command pkill. You can check the manual on how to do that.

Suspend

Launch htop then press ctrl + z. What happened ?