Process Control 1333101

Eka Stephani Sinambela

9/17/2020 ProcessControl/2021/ESS 2
 Component of a Process
• A process consists of an address space and a set of data structures within
the kernel.
• The kernel’s internal data structures record various pieces of information
about each process, they are:
– The process’s address space map
– The current status of the process (sleeping, stopped, runnable, etc)
– The execution priority of the process
– Information about the resources the process has used (CPU, memory, etc)
– Information about the files and network ports the process has opened
– The process’s signal mask (a record which signals are blocked)
– The owner of the process
• A thread is an execution context within a process.
– Every process has at least one thread, but some processes have many.
– Each tried has its own stack and CPU context but operates within the address
space of its enclosing process.
– Modern computer hardware supports multithreaded.

9/17/2020 ProcessControl/2021/ESS 3
 Component of a Process
• PID: Process ID number
– The kernel assigns a unique ID number to every process.
• PPID: parent PID
– When a process is cloned, the original process is referred to as the parent, and
the copy is called the child.
– The parent PID is a useful information when you’re confronted with an
unrecognized process.
– Tracing back to its origin may give you a better idea of its purpose and
significance.
• UID and EUID: real and effective user ID
– A process’s UID is the user identification number of the person who created it
(it is a copy of the UID value of the parent process).
– Only the creator (owner) and the superuser can manipulate a process.
– The EUID is the “effective” user ID that determines what resources and files a
process has permission to access at any given moment.
– For most processes, the UID and EUID are the same.

9/17/2020 ProcessControl/2021/ESS 4
 Component of a Process
• GID and EGID: real and effective group ID
– The GID is the group identification number of a process.
– The EGID is related to GID in the same way that the EUID is
related to the UID.
• Niceness
– A process’s scheduling priority determine how much CPU time
it receives.
– Users can make their processes ‘nicer’ to the rest of system.
• Control Terminal
– The control terminal determines the default linkages for the
standard input (stdin), standard output (stdout), and standard
error channel (stderr).

9/17/2020 ProcessControl/2021/ESS 5
 The Life Cycle of a Process
• To create new process, a process copies itself with the fork
system call
– The parent receives the PID of newly created child.
– Child process is told 0.
• After for process, the child process often uses one of the
exec family routines to begin the execution of new
program.
• When ready to die, process calls _exit with exit code
– Process becomes a zombie
• Parent must wait to collect status of dead children
– The parent receives copy of the child’s exit code (or if the child
did not exit voluntarily, an indication of why it is killed)

9/17/2020 ProcessControl/2021/ESS 6
 The Life Cycle of a Process
• Signals
– Signals are process-level interrupt requests.
– Uses:
• They can be sent among processes as a means of communication.
• They can be sent by the terminal driver to kill, interrupt, or
suspend processes when keys such as <Control-C> and <Control-Z>
are pressed.
• They can be sent by and administrator (with kill) to achieve various
ends.
• They can be sent by the kernel when a process commits an
infraction such as division by zero.
• They can sent by the kernel to notify a process of an “interesting”
condition such as the death of child process or the availability of
data on an I/O channel.

9/17/2020 ProcessControl/2021/ESS 7
 The Life Cycle of a Process

• Signals every administrator should know

9/17/2020 ProcessControl/2021/ESS 8
 The Life Cycle of a Process
• Sending Signal
– Kill: send signals
• Kill command is most often used to terminate a
process.
• Kill can send any signal, but by default it sends a TERM.
• Kill can be used by normal users on their own process
or by root on any process.
• Kill [- signal] pid
– Signal is the number or symbolic name of the signal to be sent
(see slide no.7).
– Pid is the process identification number of the target process.

9/17/2020 ProcessControl/2021/ESS 9
 The Life Cycle of a Process
• kill -9 pid === kill –KILL pid
– “guarantees” that the process will die.
• kill –USR1 910 3044
• sudo killall httpd
– Killall kills process by name, for example the command
kills Apache web server processes.
• sudo pkill –u ben
– pkill command searches for processes by name or other
attributes such as EUID and sends the specified signal.
– For example the command sends a TERM signal to all
processes running as the user ben.

9/17/2020 ProcessControl/2021/ESS 10
 The Life Cycle of a Process
• Process exist in one of four states
– Runnable – can be executed
– Sleeping – waiting for some resources
• Gets no CPU time until resource is available
– Zombie – trying to die (parent hasn’t waited)
– Stopped – process is suspended (i.e., not
permitted to run)

9/17/2020 ProcessControl/2021/ESS 11
 PS: Monitor Processes
• ps command is the system administrator’s main
tool for monitoring processes
• ps can show the PID, UID, priority, and control
terminal of processes.
• It also informs how much memory a process is
using, how much CPU time it has consumed, and
what its current status is (running, stopped,
sleeping, etc.)
• Zombies show up in a ps listing as <exiting> or
defunct.
9/17/2020 ProcessControl/2021/ESS 12
 PS: Monitor Processes
• Useful overview of all the process running on
the system with ps aux.
– The a option says show all processes.
– x says show even processes that don’t have a
control to terminal.
– u selects the “user oriented” output format.

9/17/2020 ProcessControl/2021/ESS 13
 PS: Monitor Processes
• ps aux output on a machine:

9/17/2020 ProcessControl/2021/ESS 14
 PS: Monitor Processes
• The meaning of each field is shown as
following.

9/17/2020 ProcessControl/2021/ESS 15
 Interactive Monitoring with TOP

• top is a sort real-time version of ps that gives

9/17/2020 ProcessControl/2021/ESS 16
 Interactive Monitoring with TOP
• By default the display updates every 1-2 seconds,
depending on the system.
• The most CPU-consumptive processes appear at
the top.
• The summary information in the first few lines of
top output is one of the first places to look at to
analyze the health of the system.
– It shows a condensed view of the system load,
memory usage, number of processes, and a
breakdown of how CPU is being used.

9/17/2020 ProcessControl/2021/ESS 17
 Nice and Renice:
Influence Scheduling Priority
• “Niceness” is hint to kernel about how often
to schedule the process.
– A high niceness means a low priority for your
process (you are going to be nice).
– A low or negative value means high priority (you
are not very nice).
• In Linux the range is -20 (high priority, not
nice) to +19 (low priority, very nice) , 0 is
default.
9/17/2020 ProcessControl/2021/ESS 18
 Nice and Renice:
Influence Scheduling Priority
• The owner of the process (user) can increase its
niceness but cannot lower it.
• However the root/superuser can set nice values
arbitrarily.
• A process’s niceness can be set at the time of
creation with the nice command and adjusted
later with the renice command.
– nice takes command line as an argument.
– renice takes a PID or (sometimes) a username.
• Fully qualified to path system nice is
/user/bin/nice.
9/17/2020 ProcessControl/2021/ESS 19
 Nice and Renice:
Influence Scheduling Priority
• Example:

9/17/2020 ProcessControl/2021/ESS 20
 The /Proc Filesystem
• ps and top read their process status information from
the /proc directory a pseudo-filesystem, in which the
kernel exposes a variety of interesting information
about the system’s state.
• Although a lot information is easiest to access through
front-end commands such as vmstat and ps, some of
the more obscure nuggets must be read directly from
/proc.
• It’s worth poking around in this directory to familiarize
yourself with everything that’s there.
– man proc for comprehensive explanation of its contents.
9/17/2020 ProcessControl/2021/ESS 21
 The /Proc Filesystem
• Because the kernel creates the contents of
/proc files on the fly (as they are read).
– Most appear to be empty, 0-byte files when listed
with ls-l.
– Use cat or less the contents to see the contain.
• Process-specific information is divided into
subdirectories named by PID.
– Example, /proc/1 is always the directory that
contains information about init.

9/17/2020 ProcessControl/2021/ESS 22
 The /Proc Filesystem

• Process information files in Linux /proc

9/17/2020 ProcessControl/2021/ESS 23
 Strace and Truss:
Trace Signals and System Calls
• If sources information from ps prove insufficient
use strace to snoop on the process at lower level.
– strace (Linux: usually an optional package) or truss in
FreeBSD.
• These commands display every system call that a
process makes and every signal it receives.
• strace or truss can be attached to a running
process, snoop for a while, and detach from the
process without disturbing it.
9/17/2020 ProcessControl/2021/ESS 24
 Strace and Truss:
Trace Signals and System Calls
• Example:

9/17/2020 ProcessControl/2021/ESS 25
 Runaway Processes
• “Runaway” processes are those that soak up significantly
more of:
– The system CPU
– Disk
– Network resources
• Sometimes, it causes by bug’s program with upstream
failures and get stuck in maladaptive loops then flooring
the CPU.
• All these situations merit investigation by a system
administrator because,
– The runaway process is most likely malfunctioning.
– It can interferes with the operation of other processes that are
running on the system.

9/17/2020 ProcessControl/2021/ESS 26
 Runaway Processes
• What can you do about processes using an
unusual amount of resources?
– Identify resources hogs using top and/or ps.
– strace or truss to get sense of what the process is
doing (e.g., cracking password) and where its data is
stored.
– Use df –h and du to determine which filesystem is full
and which file is filling it up.
– If you can’t determine which process is using a file try
running the fuser and lsof commands to get more
information.

9/17/2020 ProcessControl/2021/ESS 27
 Periodic Processes
• Automation, as you’ve heard, is key to
efficiency.
• Instead of manually performing tasks daily,
weekly, or monthly you can schedule them
– Cron
– Anacron
• Include tasks like
– Monitoring, log rotation, backups, file distribution,
database maintenance activities.

9/17/2020 ProcessControl/2021/ESS 28
 Cron: schedule commands
• Cron daemon is the traditional tool for running
commands on a predetermined schedule.
– It starts when the system boots and runs as long as
the system up.
• Cron reads configuration files containing list of
command lines and times at which they are to be
invoked.
– The command lines are executed by sh, so almost
anything executed from shell can be done with cron.

9/17/2020 ProcessControl/2021/ESS 29
 Cron: schedule commands
• Cron configuration file is called a “crontab”,
short for “cron table”.
• Crontab files are examined by cron for
schedule
– Crontabs stored under /var/spool/cron.
– Cron keep a log file usually under /var/log/cron.
– System contrab entries found in /etc/crontab and
in the /etc/cron.d directory

9/17/2020 ProcessControl/2021/ESS 30
 Cron: schedule commands
• The format of crontab files
– Comments are introduced with a pound sign (#) in
the first column of a line.
– Each non-comment line contains six field and
represents one command:
• Minute hour dom month weekday command

9/17/2020 ProcessControl/2021/ESS 31
 Cron: schedule commands
• Crontab time specifications

9/17/2020 ProcessControl/2021/ESS 32
 Cron: schedule commands
• Example crontab entries

9/17/2020 ProcessControl/2021/ESS 33
 Cron: schedule commands
• Crontab Management
– Use crontab –e to edit.
– crontab –l to list the content of crontab to
standard output.
– crontab –r removes it.

9/17/2020 ProcessControl/2021/ESS 34
 Cron: schedule commands
• Cron access control
– Two config files specify which users may submit
crontab files.
• /etc/cron.allow and /etc/cron.deny
• If the cron allow exists, it contains a list of all users that
may submits crontabs, otherwise the cron.deny files is
checked.
• If both files don’t exist, system default either to
allowing all users to submit crontabs or to limiting
crontab access to root.

9/17/2020 ProcessControl/2021/ESS 35
 Cron: schedule commands
• Distribution to set up crontab entries to automatically run
scripts in
– /etc/cron.monthly
– /etc/cron.weekly
– /etc/cron.daily
– /etc/cron.hourly
• Common uses for scheduled tasks
– Sending email
– Cleaning up a filesystem (core files usually named core.pid,
core, or program.core) use finds.
– Rotating a log file
– Running batch jobs
– Backing up and mirroring

9/17/2020 ProcessControl/2021/ESS 36
 Reference
• Evi Nemeth, Garth Synder, Trent R. Hein, Ben
Whaley, Dan Mackin. Unix and Linux System
Administration Handbook, 5th edition.

9/17/2020 ProcessControl/2021/ESS 37
 Thank you

9/17/2020 ProcessControl/2021/ESS 38