Processes and Signals

• Process = running program with a PID and PPID (parent)
• Every process has a parent; PID 1 (init/systemd) is the ancestor

• Foreground jobs own the terminal
• Background jobs die on hangup unless nohup or disown

• Zombie vs orphan? Zombie: exited, parent never called wait. Orphan: parent died, child still runs
• Why can't kill -9 remove a zombie? Already dead; only the parent's wait reaps it
• PID 1 and orphans? It adopts them and reaps them on exit

• ps = one-time snapshot, use it in scripts
• top = live refresh, use it to watch load
• ps aux (BSD): USER PID %CPU %MEM VSZ RSS STAT COMMAND
• ps -ef (POSIX): adds PPID and the full command line

• ps -p PID shows one process
• pgrep -a nginx lists PID and command by name
• ps aux | grep [n]ginx: the [n] trick stops grep matching itself

• Load average = 1, 5, 15 min values
• Load above the core count = saturated

• VSZ vs RSS? VSZ is virtual size; RSS is real RAM in use
• Top memory user? ps aux --sort=-%mem | head, or M in top
• Load average? Runnable and waiting tasks, averaged over 1/5/15 min

• jobs lists this shell's jobs as [1]+
• fg %1 brings job 1 to the foreground
• bg %1 resumes a stopped job in the background

• Closing the terminal sends SIGHUP, which kills background jobs
• nohup cmd & ignores HUP; output goes to nohup.out
• disown -h %n protects a job that is already running

nohup ./backup.sh &   # job %1
sleep 600 &           # job %2
disown -h %2          # already running

disown -h takes the job number

• Foreground to background? Ctrl+Z, then bg
• Why do jobs die on SSH close? SIGHUP. Use nohup or disown -h
• jobs vs ps? jobs shows this shell's jobs; ps shows system processes

• kill PID sends SIGTERM (15): catchable, so the process cleans up and exits
• kill -9 PID sends SIGKILL: cannot be caught or ignored, no cleanup

• killall name: by process name
• pkill -f pattern: by full command line
• Preview first with pgrep -a pattern: matches can hit unrelated processes

• Why TERM before KILL? TERM lets the process clean up; KILL skips cleanup
• What does 137 mean? 128+9: killed by SIGKILL, often OOM or a stop timeout
• Did the last command succeed? echo $?, and 0 means yes

• PID 1 starts and supervises every service
• Unit file: /etc/systemd/system/app.service
• [Unit] ordering, [Service] how to run, [Install] boot target

• Edited a unit? Run systemctl daemon-reload
• systemctl status app shows state; systemctl --failed lists failures

• Crash loop: systemctl status app, then journalctl -u app -b -p err

• ps aux / ps -ef: snapshot; pgrep -a name: find PIDs
• top keys: P CPU, M mem, 1 cores, k kill, q quit
• STAT: R run, S sleep, D I/O wait, T stopped, Z zombie

• Read the last code with echo $?
• systemctl start|stop|restart|status app
• enable --now = boot + start; daemon-reload after unit edits