When you run a program whose executable binary image is stored in a file on disk (perhaps in /bin or /usr/bin), the executable machine code, along with some initialised data, is copied from the file into memory. Here it joins up with an environment provided by Linux to enable it to run. The code and data stored on disk is called a program. Once the program is in memory and joined to its run time environment it becomes a process. In effect, a program is a static thing stored on disk, whereas a process is dynamic a program in execution.
Each process in the system is identified by a unique integer value called its process identity number (PID)
In Linux, a new process can only be created when an existing process splits into two. The new process is called the child of the existing process, and the existing process becomes the parent. A single parent process can spawn many child processes, which in turn can then spawn their own child processes. This means that the set of all processes running on a Linux machine forms a tree structured hierarchy, from child to parent to grandparent, and so on. The root of this tree structured hierarchy of processes is a single common ancestor, called the init process, which has a PID value of 1, being the first real process to run when the system boots up.
There are several commands available which will give all sorts of vital statistics about processes. The first one to look at is called ps. Just entering the ps command on its own will tell you what processes you have running specifically for you and will typically generate output like the following:
$ ps PID TTY STAT TIME COMMAND 325 v0l S 0:00 -bash 359 v0l R 0:00 ps
This shows two processes running for the user. The first one, with a PlD of 325, is the users login shell (bash). The second, with a PID of 359, is the ps command which produced the output. The hyphen in front of the bash command shows this is a program run as a login shell for a user rather than as a user command at the keyboard. The ps process was created by the shell in response to your command. The other three columns in the output: TTY, STAT and TIME show the process's controlling terminal, its system status and its CPU usage time respectively.
It is possible to obtain a great deal more information out of ps with suitable command line switches. Sadly, much of this will be meaningless to a novice user. There are some worthwhile items however. The -j switch will show the PlD of a process's parent under the PPID column:
$ ps -j
PPID PID PGID SID TTY TPGID STAT UID TIME COMMAND
1 325 325 325 v0l 393 S 500 0:00 -bash
325 393 393 325 v0l 393 R 500 0:00 ps -j
Notice that the parent process of the user's shell is the init process as it has a PPID of 1. Also notice that the shell is the parent of the ps process and that the PlD of the ps process is different from that of the previous example, showing that even though the same program is running, it is a different process.
It is possible for the ps output to become quite lengthy especially if you get it to output a list of all the process on the system, not just your own. This can be done with two more command line switches: -x which will list processes without a terminal to control them and -a to obtain a list of processes run by all the other users on the system as well as your own. The following, slightly abbreviated, list gives some typical output:
$ ps -ax
PlD TTY STAT TIME COMMAND
1 ? S 0:00 init
6 ? S 0:00 bdflush (daemon)
7 ? S 0:00 update (bdf lush)
25 ? S 0:00 /usr/sbin/crond -110
41 ? S 0:00 /usr/sbin/syslogd
43 ? S 0:00 /usr/sbin/klogd
45 ? S 0:00 /usr/sbin/inetd
47 ? S 0:00 /usr/sbin/lpd
61 v03 S 0:00 /sbin/agetty 38400
62 v04 S 0:00 /sbin/agetty 38400
63 v05 S 0:00 /sbin/agetty 38400
64 v06 S 0:00 /sbin/agetty 38400
325 v0l S 0:00 -bash
460 v02 S 0:00 -bash
547 v02 R 0:00 ps-ax
Linux is a true multi-user multi-tasking operating system, which means that it can handle multiple users logged in simultaneously, all running multiple processes. It is possible to login to a Linux machine in several different ways using one of several entry points. The most common way to login is to use the keyboard and screen built into the machine. Even in this situation it is possible to have multiple users logged in to the system or even a single user logged in multiple times. This can be done because Linux makes provision to support multiple virtual terminals. At any point in time, one of these virtual terminals will be connected to the real keyboard and screen. In effect, the keyboard and screen can be switched between the set of virtual terminals allowing multiple login sessions to be created. The use of these virtual terminals is only possible from the main system keyboard and screen. The selection between the virtual terminals is made by holding the Alt key pressed while pressing one of the function keys, usually Fl to F6. This gives easy access to one of six different login sessions. When the system first boots up, the Alt-Fl terminal is the one used by default. I find virtual terminals most useful when I am developing software - I can be editing code on one terminal, compiling the results on another and looking up information on yet a third.
In the previous ps listing, notice the numbers in the TTY column. They show which processes are associated with each of the virtual terminals (v0l to v06). Notice that the shell with the PlD of 325 is the login shell for a user on virtual terminal one. However, the ps command which generated the output listing was executed by a user on virtual terminal two. The other four virtual terminals all have copies of the program
/sbin/agetty
running against them. This is the program that gives you a login prompt and waits for you to enter your login name. See how all four copies of the program are running as separate processes (i.e. they all have different PIDs).
Normally, when a user logs out, all the processes controlled by the same terminal (in the TTY column) that the user was logged in to will be terminated. However, the processes that have a question mark (or query '?') in the TTY column are all running without an associated terminal, which means that they can continue to run even when there are no users logged in.
If you want to find out quickly what terminal you are logged in to, you can do so by using the tty command:
$ tty /dev/ttyl
As you can see, the full name for virtual terminal 1 is /dev/ttyl. Similarly, virtual terminal 2 would be /dev/tty2, and so on. If you remember, the /dev directory is where the system keeps its special files by convention, and the virtual terminals are one example of what the special files are used for.
Sometimes it can be necessary to force the termination of a process. As long as it is a process over which you have control, usually because you executed it, then it is a simple matter to terminate it using the kill command. All you do is to pass the PlD of the process whose execution you wish to terminate as a parameter to the kill command and kill will then send a signal to the process to terminate it. It is possible for a process to ignore the default signal sent to it by kill, in which case a -9 switch to the kill command will send a signal that cannot be ignored. Consider the following command sequence, which demonstrates these points:
$ tty
/dev/tty2
$ ps
PlD TTY STAT TIME COMMAND
325 vOl S 0:00 -bash
460 v02 S 0:00 -bash
557 v02 R 0:00 ps
$ kill 325
$ ps
PlD TTY STAT TIME COMMAND
325 v0l S 0:00 -bash
460 v02 S 0:00 -bash
559 v02 R 0:00 ps
$ kill -9 325
$ ps
PlD TTY STAT TIME COMMAND
460 v02 S 0:00 -bash
561 v02 R 0:00 ps
First, the tty command shows that the user is currently switched to virtual terminal 2. A ps command then gives the PlD of the shell on virtual terminal 1 as 325. A kill command to this PlD followed by a second ps shows that the shell is able to ignore the default signal to terminate. However, a second kill command to the same PlD using a -9 switch does terminate the shell, as seen from the final call to ps.