Chapter Six

Processes and Signals

How the kernel turns a program into a running process, tracks it through the process tree, and lets you steer it with signals, priority, and the /proc filesystem.

5 topics

A process is the kernel's accounting unit for a running program: an address space, a set of open file descriptors, a scheduling state, and a numeric PID. Every process except PID 1 has a parent, so the live system forms a single tree rooted at the init process — on Debian and Ubuntu that is systemd, started by the kernel as PID 1 once the initramfs hands off. Understanding that tree, and the rules for how processes are created, signaled, and reaped, is the difference between guessing at a stuck service and knowing exactly what to send it.

This chapter works from the bottom up. It starts with the fork/exec model and process states, moves to signals as the kernel's primary out-of-band control channel, then covers the tools you reach for under load — ps, top, and friends — followed by how the scheduler decides who runs and how you bias it with nice values and cgroups. It closes with /proc, the synthetic filesystem that exposes nearly all of this state as readable files.

The life of a process
forkcopy the parent
execreplace the image
runningscheduled on a CPU
exitbecomes a zombie
waitreaped by parent

Topics in This Chapter