Processes and signals.
Every running program is a process with a PID, a parent, an owner, and a state. Watch a process move through its five states, learn the signals that push it between them, and the difference between asking it to stop and forcing it.
Linux processes and signals animated tutorial. Process anatomy, the five process states (running, sleeping, uninterruptible, stopped, zombie), job control, the signal catalog, SIGTERM vs SIGKILL, kill/pkill/killall, and nice/renice priority. RHCSA EX200 ready.A process is a running program the kernel tracks by PID. It's always in one of five states, and signals are how you (and the kernel) push it between them.
- ·Comfortable running commands and reading output at the shell
- ·Helpful: the command-line essentials lesson (pipes, ps | grep)
- ·Know roughly what 'the CPU' and 'I/O' mean
Read the STAT column, name the five states, use job control, send the right signal (15 before 9), and adjust priority with nice/renice.
pace: 10 minutes
A process is a running program with an identity
When you launch a program, the kernel creates a process: a PID (its unique number), a PPID (its parent — every process except PID 1 has one), an owner (UID), a state, and the command line. PID 1 is the init system (systemd). `ps` and `top` show all of this. A fresh process is in the Running/Runnable state, R.
$ps aux$ps -ef$top / htop$pgrep -a nginxThe golden rule of killing things: ask nicely, then force. Send SIGTERM (plain kill) first and give the process a couple of seconds to clean up. Only escalate to SIGKILL (-9) if it's unresponsive. Reaching for -9 first is a habit that leaves corrupt files, stale locks, and half-written state behind.
$ps aux / ps -ef$ps -o pid,ppid,stat,ni,comm$top / htop$pgrep -a sshd$pstree -p$kill 1234$kill -9 1234$kill -HUP 1234$kill -l$pkill -f pattern$killall firefox$jobs / fg / bg$nohup cmd & ; disown$nice -n 10 cmd$renice -n 5 -p 1234$/proc/<pid>/statusA process is stuck in state D (uninterruptible sleep) and `kill -9` does nothing. Why?
What's the difference between SIGTERM (15) and SIGKILL (9)?
What is a zombie (Z-state) process?
As a regular (non-root) user, you try `renice -n -5 -p 1234` and it's denied. Why?
These aren't graded — they're just for active recall, which is what actually makes the lesson stick.
Process explorer
Browse a sample process tree, see PIDs, states, and resource use, and practice picking the right signal — without touching a real system.
Read this lesson as text6 chapters · quiz answers
01A process is a running program with an identity
When you launch a program, the kernel creates a process: a PID (its unique number), a PPID (its parent — every process except PID 1 has one), an owner (UID), a state, and the command line. PID 1 is the init system (systemd).
psandtopshow all of this. A fresh process is in the Running/Runnable state, R.$ ps aux— every process, all users$ ps -ef— same, with PPID column$ top / htop— live, sortable view$ pgrep -a nginx— PIDs (and cmd) by name
02The five states
A process is always in one state, shown in the STAT column of ps. R = running or runnable (on or waiting for the CPU). S = sleeping (waiting for an event, interruptible — most processes most of the time). D = uninterruptible sleep (stuck in a kernel I/O call — can't even be killed until it returns). T = stopped (suspended). Z = zombie (finished, waiting for its parent to collect the exit code).
03Sleeping, and the danger of D
Most processes sleep (S) most of the time — waiting for input, a timer, or the network. They wake back to R when the event arrives. D (uninterruptible sleep) is special: the process is blocked inside a kernel call, usually disk or NFS I/O, and CANNOT be interrupted — not even by SIGKILL. A pile of D-state processes usually means storage is hung. You can't kill your way out; you fix the I/O.
04Stop and continue — job control
In a shell, Ctrl-Z sends SIGTSTP and suspends the foreground job → state T.
bgresumes it in the background (SIGCONT);fgbrings it back to the foreground.jobslists them. Add&to start in the background.nohup cmd &(ordisown) detaches a job so it survives you logging out.$ Ctrl-Z— suspend foreground job → T$ bg %1 / fg %1— resume in background / foreground$ jobs -l— list this shell's jobs$ nohup ./long.sh &— run detached, survives logout
05Signals — and asking nicely before forcing
A signal is a small message to a process. SIGTERM (15) is the polite 'please shut down' — the default for
kill, and the program can clean up first. SIGKILL (9) is the unblockable 'die now' — no cleanup, use it only when TERM didn't work. SIGHUP (1) traditionally means 'reload your config'. SIGINT (2) is Ctrl-C. SIGSTOP/SIGCONT pause and resume. The pattern: try 15, wait, then 9.$ kill 1234— send SIGTERM (15) — polite$ kill -9 1234— SIGKILL — force, no cleanup$ kill -HUP 1234— reload config (many daemons)$ pkill -f myscript— by command-line match$ killall nginx— by exact process name
06Priority — nice and renice
Every process has a niceness from -20 (highest priority, greediest for CPU) to +19 (lowest, most generous to others). Default is 0. Start a command nicer with
nice -n 10 cmd; change a running one withrenice. Only root can set NEGATIVE niceness (raise priority) — regular users can only be nicer, never greedier. Niceness is a hint to the scheduler, not a hard cap.$ nice -n 10 ./batch.sh— start with low priority$ renice -n 5 -p 1234— change a running process$ renice -n -5 -p 1234— raise priority (root only)$ ps -o pid,ni,comm— show niceness (NI column)
Quiz — answers
- A process is stuck in state D (uninterruptible sleep) and
kill -9does nothing. Why? - →D-state means it's blocked inside a kernel I/O call and can't be interrupted — not even by SIGKILL — until that call returns. Usually a sign of hung storage.SIGKILL can't reach a process that isn't running in a state where it can handle signals. D-state processes are waiting on the kernel (often disk/NFS). The fix is to resolve the I/O problem, not to send a bigger signal.
- What's the difference between SIGTERM (15) and SIGKILL (9)?
- →SIGTERM politely asks the process to shut down (it can catch the signal and clean up); SIGKILL forcibly kills it with no chance to clean up and cannot be caught or ignored.
killsends SIGTERM by default — give the program a chance to flush buffers, close files, and exit cleanly. Reach for SIGKILL (-9) only when TERM didn't work; it can leave temp files, locks, or corrupt state behind. - What is a zombie (Z-state) process?
- →A process that has finished executing but whose exit status hasn't been collected by its parent yet — it holds only a PID-table slot, no memory or CPU.A zombie has already exited; it's just waiting for its parent to call wait() and reap it. It uses no resources except a process-table entry. You can't kill a zombie (it's already dead) — if they pile up, the bug is in the PARENT not reaping them; kill or fix the parent.
- As a regular (non-root) user, you try
renice -n -5 -p 1234and it's denied. Why? - →Only root can set NEGATIVE niceness (raise priority). Regular users can only increase niceness (lower priority) — they can be nicer, never greedier.Niceness ranges -20 (greediest) to +19 (most generous). Letting any user raise their own priority would let them starve others, so negative niceness is root-only. Users can always go more positive.
keep going — these pair well with what you just learned.
SELinux contexts
Why Apache can't read your file. Watch the policy engine decide — and learn the workflow for fixing denials. RHCSA-ready.
Linux boot process
From power button to login prompt. Every stage in the chain — UEFI, GRUB, kernel, initramfs, systemd — with the rescue moves that save you. RHCSA-ready.
LVM stacking
Layer-by-layer build of an LVM stack: disks → PVs → VG → LVs → filesystem. Then extend live and snapshot. RHCSA-ready.