Linux Administration (2016)

Process Management

Listing Processes and Displaying Information

To display the currently running processes,use thepscommand. If no options are specified,ps will display the processes associated with your current session. To see every process,including ones that are not owned by you, useps -e. To see processes running by a specific user, useps -u username.

ps - Display process status.

Commonps options:

-e - Everything, all processes.

-f - Full format listing.

-uusername - Display processes running as username.

-ppid - Display process information for pid. A PID is a process ID.

Commonps commands:

ps -e - Display all processes.

ps -ef - Display all processes with a full format listing.

ps -eH - Display a process tree.

ps -e --forest - Display a process tree.

ps -u username - Display processes running as username.

$ ps

PID TTY TIME CMD

19511 pts/2 00:00:00 bash

19554 pts/2 00:00:00 ps

$ ps -p 19511

PID TTY TIME CMD

19511 pts/2 00:00:00 bash

$ ps -f

UID PID PPID C STIME TTY TIME CMD

bob 19511 19509 0 16:50 pts/2 00:00:00 -bash

bob 19556 19511 0 16:50 pts/2 00:00:00 ps -f

$ ps -e | head

PID TTY TIME CMD

1 ? 00:00:02 init

2 ? 00:00:00 kthreadd

3 ? 00:00:19 ksoftirqd/0

5 ? 00:00:00 kworker/0:0H

7 ? 00:00:00 migration/0

8 ? 00:00:00 rcu_bh

9 ? 00:00:17 rcu_sched

10 ? 00:00:12 watchdog/0

11 ? 00:00:00 khelper

$ ps -ef | head

UID PID PPID C STIME TTY TIME CMD

root 1 0 0 Dec27 ? 00:00:02 /sbin/init

root 2 0 0 Dec27 ? 00:00:00 [kthreadd]

root 3 2 0 Dec27 ? 00:00:19 [ksoftirqd/0]

root 5 2 0 Dec27 ? 00:00:00 [kworker/0:0H]

root 7 2 0 Dec27 ? 00:00:00 [migration/0]

root 8 2 0 Dec27 ? 00:00:00 [rcu_bh]

root 9 2 0 Dec27 ? 00:00:17 [rcu_sched]

root 10 2 0 Dec27 ? 00:00:12 [watchdog/0]

root 11 2 0 Dec27 ? 00:00:00 [khelper]

$ ps -fu www-data

UID PID PPID C STIME TTY TIME CMD

www-data 941 938 0 Dec27 ? 00:00:00 /usr/sbin/apache2 -k start

www-data 942 938 0 Dec27 ? 00:00:00 /usr/sbin/apache2 -k start

www-data 943 938 0 Dec27 ? 00:00:00 /usr/sbin/apache2 -k start

Here are other commands that allow you to view running processes.

pstree - Display running processes in a tree format.

top - Interactive process viewer.

htop- Interactive process viewer. This command is less common thantop and may not be available on the system.

Running Processes in the Foreground and Background

Up until this point, all the commands you have executed have been running in the foreground. When a command, process, or program is running in the foreground, the shell prompt will not be displayed until that process exits. For long running programs, it can be convenient to send them to the background. Processes that are backgrounded still execute and perform their task; however,they do not block you from entering further commands at the shell prompt. To background a process, place an ampersand (&) at the end of the command.

command & - Start command in the background.

Ctrl-c - Kill the foreground process.

Ctrl-z - Suspend the foreground process.

bg [%num] - Background a suspended process.

fg [%num] - Foreground a background process.

kill [%num] - Kill a process by job number or PID.

jobs [%num] - List jobs.

$ ./long-running-program &

[1] 22686

$ ps -p 22686

PID TTY TIME CMD

22686 pts/1 00:00:00 long-running-pr

$ jobs

[1]+ Running ./long-running-program &

$ fg

./long-running-program

When a command is backgrounded, two numbers are displayed. The number in brackets is the job number and can be referred by preceding it with the percent sign. The second number is the PID. Here is what starting multiple processes in the background looks like.

$ ./long-running-program &

[1] 22703

$ ./long-running-program &

[2] 22705

$ ./long-running-program &

[3] 22707

$ ./long-running-program &

[4] 22709

$ jobs

[1] Done ./long-running-program

[2] Done ./long-running-program

[3]- Running ./long-running-program &

[4]+ Running ./long-running-program &

The plus sign (+) in thejobsoutput represents the current job while the minus sign (-) represents the previous job. The current job is considered to be the last job that was stopped while it was in the foreground or the last job started in the background. The current job can be referred to by%%or%+. If no job information is supplied to thefgorbgcommands, the current job is operated upon. The previous job can be referred to by%-.

You will notice that jobs 1 and 2 are reported as being done. The shell does not interrupt your current command line, but will report job statuses right before a new prompt is displayed. For example, if you start a program in the background, a prompt is returned. The shell will not report the status of the job until a new prompt is displayed. You can request a new prompt be displayed simply by hittingEnter.

To bring a job back to the foreground, type in the name of the job or use thefg command. To foreground the current job,execute%%,%+,fg,fg %%,fg %+, or fg%num. To foreground job 3, execute%3 orfg %3.

$ jobs

[3]- Running ./long-running-program &

[4]+ Running ./long-running-program &

$ fg %3

./long-running-program

To pause or suspend a job that is running in the foreground, typeCtrl-z. Once a job is suspended it can be resumed in the foreground or background. To background a suspended job,type the name of the job followed by an ampersand or usebg followed by the job name.

$ jobs

[1] Running ./long-running-program &

[2]- Running ./long-running-program &

[3]+ Running ./another-program &

$ fg

./another-program

^Z

[3]+ Stopped ./another-program

$ jobs

[1] Running ./long-running-program &

[2]- Running ./long-running-program &

[3]+ Stopped ./another-program

$ bg %3

[3]+ ./another-program &

$ jobs

[1] Running ./long-running-program &

[2]- Running ./long-running-program &

[3]+ Running ./another-program &

You can stop or kill a background job using thekill command. For example, to kill job number 1,executekill %1. To kill a job that is running in the foreground, typeCtrl-c.

$ jobs

[1] Running ./long-running-program &

[2]- Running ./long-running-program &

[3]+ Running ./another-program &

$ kill %1

[1] Terminated ./long-running-program

$ jobs

[2]- Running ./long-running-program &

[3]+ Running ./another-program &

$ fg %2

./long-running-program

^C

$ jobs

[3]+ Running ./another-program &

$

Killing Processes

Ctrl-c - Kills the foreground process.

kill [signal] pid - Send a signal to a process.

kill -l - Display a list of signals.

The default signal used by kill is termination. You will see this signal referred to as SIGTERM or TERM for short. Signals have numbers that correspond to their names. The default TERM signal is number 15, so runningkill pid, kill -15 pid, and kill -TERM pid are all equivalent. If a process does not terminate when you send it the TERM signal, use the KILL signal, which is number 9.

$ ps | grep hard-to-stop

27398 pts/1 00:00:00 hard-to-stop

$ kill 27398

$ ps | grep hard-to-stop

27398 pts/1 00:00:00 hard-to-stop

$ kill -9 27398

$ ps | grep hard-to-stop

$

Instead of running the ps command and piping its output to the grep command, you can use the pgrep command, which is built for just this purpose. It prints the PIDs of commands that match the search pattern you supply to it.

pgrep [options] search_pattern

Let’s use pgrep to determine the PID of the crond process.

$ pgrep crond

13813

$ ps -fp 13813

UID PID PPID C STIME TTY TIME CMD

root 13813 1 0 20:47 ? 00:00:00 /usr/sbin/crond -n

If multiple matches exist, the PIDs of each of the matches is returned. In this example, we are searching for “nd”, which happens to match crond and systemd-logind.

$ pgrep nd

13813

13949

$ ps -fp 13813 13949

UID PID PPID C STIME TTY STAT TIME CMD

root 13813 1 0 20:47 ? Ss 0:00 /usr/sbin/crond -n

root 13949 1 0 20:47 ? Ss 0:00 /usr/lib/systemd/systemd-logind

If you want to perform an exact match, use the -x option. This example demonstrates that “nd” does not match any process exactly, so no PIDs are returned. However, searching for “crond” does exactly match one process.

$ pgrep -x nd

$ pgrep -x crond

13813

$ ps -fp 13813

UID PID PPID C STIME TTY TIME CMD

root 13813 1 0 20:47 ? 00:00:00 /usr/sbin/crond -n

The pkill command acts in much the same was the pgrep command, except it sends the TERM signal to the matching processes by default. You can send a different signal in the same manner as the kill command. This example kills the crond process. We use the pgrep command to ensure the process is indeed killed.

# pkill crond

# pgrep crond

#

You can also kill a process by name with the killall command. The killall command is similar to the kill and pkill commands.

killall [options] process_name

For example, to kill all the httpd process, run this command.

# killall httpd

If the httpd processes didn’t die, you can use the KILL signal as we did in a previous example.

# killall -9 httpd

You can also use the killall command to kill all the processes for a given user by using the -u option followed by the username. A normal user cannot kill another user’s processes. The only exception is for the superuser, the root account. Root can kill anyone’s processes on a system. This is an example of using the root account to kill all of the processes that are being executed by the user john.

# killall -u john

To show when a process gets killed by the kill command, use the -v option.

# killall -vu john

Killed bash(624) with signal 15

Process Priorities and Niceness

All processes on a Linux system are assigned a niceness value. The niceness value ranges from -20 to 19, with -20 being the highest priorty and 19 being the lowest priority. Processes with higher priority get scheduled to run more often. You can think of processes with higher niceness numeric values as being nice to the processes that have lower niceness numeric values. For example, a process with a niceness of 10 will be “nice” to a process with a priorty of 0 and allow it to run at a higher priority. The process with the niceness of 0 will get more CPU time than the process with the niceness of 10.

To view the niceness value of a given process, use the -l option of the ps command. The niceness value is listed in the NI column. In this example, the niceness value is 0 for both processes shown.

$ ps -l

F S UID PID PPID C PRI NI ADDR SZ WCHAN TTY TIME CMD

0 S 1000 1972 1971 0 80 0 - 28838 wait pts/0 00:00:00 bash

0 R 1000 22893 1972 0 80 0 - 30319 - pts/0 00:00:00 ps

You can also give ps a format to use with the -o option followed by a comma separated list of columns you would like to display. This command displays the PID, the niceness, and the command.

$ ps -o pid,nice,cmd

PID NI CMD

1972 0 -bash

22922 0 ps -o pid,nice,cmd

Additionally, you can also use the top command to view the niceness of processes. Like the ps command, the niceness value is listed in the NI column.

top - 22:25:27 up 2:55, 1 user, load average: 0.00, 0.01, 0.05

Tasks: 82 total, 2 running, 80 sleeping, 0 stopped, 0 zombie

%Cpu(s): 0.0 us, 0.0 sy, 0.0 ni,100.0 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st

KiB Mem : 1018256 total, 272180 free, 114936 used, 631140 buff/cache

KiB Swap: 2047996 total, 2047988 free, 8 used. 721392 avail Mem

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND

1 root 20 0 54180 3900 2412 S 0.0 0.4 0:00.90 systemd

2 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kthreadd

3 root 20 0 0 0 0 S 0.0 0.0 0:00.30 ksoftirqd/0

5 root 0 -20 0 0 0 S 0.0 0.0 0:00.00 kworker/0:0H

6 root 20 0 0 0 0 S 0.0 0.0 0:00.11 kworker/u2:0

7 root rt 0 0 0 0 S 0.0 0.0 0:00.00 migration/0

To view the default niceness value, use the nice command without any arguments. Typcially, the default niceness value for normal users is 0.

$ nice

0

$

To start a process, or program, with a different niceness level, run nice -n ADJUSTMENT COMMAND. Let’s assume you want to convert a very large video file from one format to another. This type of process will be very CPU intensive. You don’t want this process to make your Linux system unresponsive because you are currently using it for other, more important tasks. Additionally, you are not concerned with the amount of time it takes to convert the video. You can start this process at a lower priority by running the following command.

$ nice -n 10 avconv -i movie.avi movie.mp4

Since the default nicencess value is 0 and an offset of 10 was applied, the niceness value of the process will be 10. Let’s check the niceness of this process with the ps command.

$ ps -o pid,nice,cmd

1394 0 /bin/bash

3815 10 avconv -I movie.avi movie.mp4

What if you want to change the niceness of a process that is already running? Use the renice command, supplying the new niceness value after -n and end the command with the PID of the process you are altering. Let’s change the niceness value to the lowest priorty with this command.

$ renice -n 19 3815

3815 (process ID) old priority 10, new priority 19

If you attempt to lower the niceness value, you will get a permission denied error. This is because only the superuser can set the niceness value to a lower number, giving a process a higher priority than it currently has. Said another way, normal users can only make their processes nicer.

$ renice -n 0 3815

renice: failed to set priority for 3815 (process ID): Permission denied

$ su -

Password:

# renice -n 0 3815

3815 (process ID) old priority 19, new priority 0

Processes and Disconnecting from Your Session

When you log out of a Linux system, all of your processes associated with that session are sent the SIGHUP, or hangup, signal. This effectively kills all of the processes associated with your session. If you want to leave a process running after you log out, you can use the nohup command. The nohup command will ignore the SIGHUP signal, allowing the process to continue running.

nohup COMMAND [command_arguments]

The output generated by the command supplied to nohup will be saved in a file called nohup.out, located in the directory in which you started the process. To save the output to a different file, use redirection.

Typically, the nohup command is used to background a process. This example starts a shell script called do-backup.sh in the background with the nohup command. If you log out and log back in again, you can see that the process is still running and the output is being sent to thenohup.out file.

$ nohup do-backup.sh &

[1] 23364

nohup: ignoring input and appending output to ‘nohup.out’

$ exit

Connection to linuxsvr closed

$ ssh linuxsvr

$ ps -fp 23364

UI PID PPID C STIME TTY TIME CMD

jason 23364 1 0 18:31 ? 00:00:00 do-backup.sh

$ cat nohup.out

Apr 5 18:34:20 - Creating backup.

$

If we wanted to redirect the output to a file other than nohup.out, we would use the greater-than sign followed by a file.

$ nohup do-backup.sh > /var/tmp/backup.log &

[1] 23401

nohup: ignoring input and redirecting stderr to stdout

$ cat /var/tmp/backup.log

Apr 5 18:37:24 - Creating backup.

$

You can also use a terminal multiplexer to accomplish the same task. The two most popular terminal multiplexers are GNU Screen and tmux. To leave processes running in the background, first start the terminal multiplexer program. Next, start the process you would like to keep running after you log out. Finally, detach from your terminal multiplexer. When you log out, the terminal multiplexer and all of its child processes are still running. You can then come back at a later time and reattach to the session.

Here is an example using GNU Screen. To start Screen, run the screen command. It may not appear as if anything has happened, but you are now in a screen session. To list the sessions, use the -ls option. Now you can start the process you want to ensure stays running after you have disconnected. We won’t bother starting it in the background since screen will be caputuring the output. To disconnect from the screen session, type Ctrl-A followed by D. If you run screen -ls again, it will show that a screen session is running, but you are not attached to it. At this point, you can disconnect from the server and Screen, as well as any processes started with it, will continue to run. To reconnect to a screen session, use the -r option. If there are multiple screen sessions, you will need to supply the session name as it is displayed in the screen -ls output.

[jason@laptop ~]$ ssh linuxsvr

[jason@linuxsvr ~]$ screen

[jason@linuxsvr ~]$ screen -ls

There is a screen on: 23478.pts-0.linuxsvr (Attached)

1 Socket in /var/run/screen/S-jason.

[jason@linuxsvr ~]$ do-backup.sh

Apr 5 18:42:51 - Creating backup

[detached from 23478.pts-0.linuxsvr]

[jason@linuxsvr ~]$ screen -ls

There is a screen on: 23478.pts-0.linuxsvr (Detached)

1 Socket in /var/run/screen/S-jason.

[jason@linuxsvr ~]$ exit

Connection to linuxsvr closed.

[jason@laptop ~]$ ssh linuxsvr

[jason@linuxsvr ~]$ screen -r

Apr 5 18:53:51 - Backup complete

[jason@linuxsvr ~]$

Load Average

You may have noticed the words load average followed by a series of three numbers in the output of the top command. The first number is the load average over the last minute, the second number is the load average over the last five minutes, and the final number is the load average over the last 15 minutes. Here is some example output from the top command.

top - 20:41:23 up 5:07, 2 users, load average: 0.90, 2.32, 1.05

The load average represents how busy a system is. A system with a load average of 0.00 is completely idle. In general, you can think of load average as the number of processes using or waiting for CPU time. The actual calculation is a bit more complex and includes processes that are waiting on other resources including I/O operations such as reading from or writing to a disk. However, a load average without context is meaningless. You need to know how many CPUs a system has in order to determine what a given load average means.

Let’s say a single CPU Linux system has the following load average: 0.80, 1.75, and 5.00. This means that over that last minute the CPU was utilized 80% of the time. You could also say that the CPU was idle 20% of the time. Over the last five minutes, the CPU was overloaded by 75% on average. A load average of 1.75 on a single CPU system means that .75 processes had to wait for a turn to run on that CPU. Over the last 15 minutes, the load was 5.00, meaning that the system was overloaded by 400%.

If we take the same load averages of 0.80, 1.75, and 5.00 on a system that has 16 CPUs, then the meaning of those numbers change dramatically. Having a load average of 5.00 on a single CPU system is a very high load average, while having that same load average on a 16 CPU system means that only about 31% of the system resources are in use.

To view the number of CPUs in your system, look at the /proc/cpuinfo fie. Here is a single CPU system.

$ cat /proc/cpuinfo

processor : 0

vendor_id : GenuineIntel

cpu family : 6

model : 61

model name : Intel(R) Core(TM) i7-5557U CPU @ 3.10GHz

stepping : 4

microcode : 0x19

cpu MHz : 3103.175

cache size : 6144 KB

physical id : 0

siblings : 1

core id : 0

cpu cores : 1

apicid : 0

initial apicid : 0

fpu : yes

fpu_exception : yes

cpuid level : 5

wp : yes

flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 syscall nx rdtscp lm constant_tsc rep_good nopl pni monitor ssse3 lahf_lm

bogomips : 6206.35

clflush size : 64

cache_alignment : 64

address sizes : 39 bits physical, 48 bits virtual

power management:

In addition to the top command, you can view the load average with the uptime and w commands.

$ uptime

21:11:53 up 5:38, 2 users ,load average: 1.08, 2.03, 4.35

$ w

21:11:59 up 5:38, 2 users ,load average: 1.08, 2.03, 4.35

USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT

jason pts/0 10.0.2.2 18:52 4.00s 0.01s 0.01s screen -r

ellen pts/1 :pts/0:S.0 18:52 4.00s 47.65s 0.00s w

Memory Usage

The top command also displays memory utilization for a system.

top - 21:16:03 up 5:42, 2 users, load average: 1.07, 0.60, 0.28

Tasks: 89 total, 3 running, 86 sleeping, 0 stopped, 0 zombie

%Cpu(s): 94.2 us, 5.8 sy, 0.0 ni, 0.0 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st

KiB Mem : 1018256 total, 223076 free, 117360 used, 677820 buff/cache

KiB Swap: 2047996 total, 2047988 free, 8 used. 718068 avail Mem

You can also use the free command to display memory usage. To display in units of megabytes, use the -m option. To display in gigabytes, use the -g option. Use the -t option to display the totals.

$ free -m

total used free shared buff/cache available

Mem: 994 114 217 6 661 701

Swap: 1999 0 1999

$ free -mt

total used free shared buff/cache available

Mem: 994 114 217 6 661 701

Swap: 1999 0 1999

Total: 2994 114 2217

Scheduling Repeated Jobs with Cron

If you need to repeat a task on a schedule, you can use the cron service. Every minute,the cron service checks to see if there are any scheduled jobs to run and if so runs them. Cron jobs are often used to automate a process or perform routine maintenance. You can schedule cron jobs by using thecrontab command.

cron - A time based job scheduling service. This service is typically started when the system boots.

crontab - A program to create, read, update, and delete your job schedules.

A crontab (cron table) is a configuration file that specifies when commands are to be executed by cron. Each line in a crontab represents a job and contains two pieces of information: 1) when to run and 2) what to run. The time specification consists of five fields: minute, hour, day of the month, month, and day of the week. After the time specification, you provide the command to be executed.

Crontab Format

* * * * * command

| | | | |

| | | | +-- Day of the Week (0-6)

| | | +---- Month of the Year (1-12)

| | +------ Day of the Month (1-31)

| +-------- Hour (0-23)

+---------- Minute (0-59)

The command will only be executed when all of the time specification fields match the current date and time. You can specify that a command be run only once, but this is not the typical use case for cron. Typically, one or more of the time specification fields will contain an asterisk (*) which matches any time or date for that field. Here is an example crontab.

# Run every Monday at 07:00.

0 7 * * 1 /opt/sales/bin/weekly-report

Here is a graphical representation of the above crontab entry.

0 7 * * 1 /opt/sales/bin/weekly-report

| | | | |

| | | | +-- Day of the Week (0-6)

| | | +---- Month of the Year (1-12)

| | +------ Day of the Month (1-31)

| +-------- Hour (0-23)

+---------- Minute (0-59)

This job will run only when the minute is 0, the hour is 7, and the day of the week is 1. In the day of the week, field 0 represents Sunday, 1 Monday, etc. This job will run on any day and during any month since the asterisk was used for those two fields.

If any output is generated by the command,it is mailed to you. You can check your local mail with themail command. If you prefer not to get email, you can redirect the output of the command as in this example.

# Run at 02:00 every day and send output to a log.

0 2 * * * /opt/acme/bin/backup > /tmp/backup.log 2>&1

You can provide multiple values for each of the fields. If you would like to run a command every half-hour, you could do this.

# Run every 30 minutes.

0,30 * * * * /opt/acme/bin/half-hour-check

# Another way to do the same thing.

*/2 * * * * /opt/acme/bin/half-hour-check

Instead of using0,30 for the minute field,you could have used*/2. You can even use ranges with a dash. If you want to run a job every minute for the first four minutes of the hour,you can use this time specification:0-4 * * * * command.

There are several implementations of the cron scheduler and some allow you to use shortcuts and keywords in your crontabs. Common keywords have been provided below, but refer to the documentation for cron on your system to ensure these will work.

Using the Crontab Command

Use thecrontab command to manipulate cron jobs.

crontab file - Install a new crontab from file.

crontab -l - List your cron jobs.

crontab -e - Edit your cron jobs.

crontab -r - Remove all of your cron jobs.

$ crontab -l

no crontab for bob

$ cat my-cron

# Run every Monday at 07:00.

0 7 * * 1 /opt/sales/bin/weekly-report

$ crontab my-cron

$ crontab -l

# Run every Monday at 07:00.

0 7 * * 1 /opt/sales/bin/weekly-report

$ crontab -e

# $EDITOR is invoked.

$ crontab -r

$ crontab -l

no crontab for bob

$

Summary

In this chapter, you learned how to view the running processes with the ps, pstree, top, and htop commands. Next, you learned how to start jobs in the background as well as how to view, suspend, resume, and kill those jobs. You also learned how to kill processes with the kill, pkill, andkillall commands. Next, process priority and niceness were covered. You learned how to use the nohup command to ensure a long running process continues to run even if you disconnect from the Linux system. You also learned about load averages and how to determine the number of CPUs in a Linux system. Finally, you learned how to schedule jobs using the cron service.

Quiz

1. Which command is used to view running processes?

1. ps

2. pid

3. proc

4. lsproc

2. What character is placed at the end of a command line to start the command in the background?

1. -

2. ?

3. \

4. &

3. The kill command can be used to kill processes and jobs.

1. True

2. False

4. Which command is used to create, read, update, and delete cron jobs?

1. cron

2. crond

3. crontab

4. vicron

5. Which of the following cron jobs will run at 08:00 AM every day?

1. 8 0 0 * * /opt/acme/bin/backup

2. 8 0 * * * /opt/acme/bin/backup

3. 8 * * * * /opt/acme/bin/backup

4. 0 8 * * * /opt/acme/bin/backup

Quiz Answers

1. A

2. D

3. A

4. C

5. D