What is a Process?

A process is a running instance of a launched, executable program. A process consists of:

• an address space of allocated memory,
  
• security properties including ownership credentials and privileges,
  
• one or more execution threads of program code, and
  
• the process state.
  

The environment of a process includes:

• local and global variables,
  
• a current scheduling context, and
  
• allocated system resources, such as file descriptors and network ports.
  

An existing (parent) process duplicates its own address space (fork) to create a new (child) process structure. Every new process is assigned a unique process ID (PID) for tracking and security. The PID and the parent's process ID (PPID) are elements of the new process environment. Any process may create a child process. All processes are descendants of the first system process, which is systemd(1) on a Red Hat Enterprise Linux 7 system.

Process life cycle

Through the fork routine, a child process inherits security identities, previous and current file descriptors, port and resource privileges, environment variables, and program code. A child process may then exec its own program code. Normally, a parent process sleeps while the child process runs, setting a request (wait) to be signaled when the child completes. Upon exit, the child process has already closed or discarded its resources and environment; the remainder is referred to as a zombie. The parent, signaled awake when the child exited, cleans the remaining structure, then continues with its own program code execution.

Process States

In a multitasking operating system, each CPU (or CPU core) can be working on one process at a single point in time. As a process runs, its immediate requirements for CPU time and resource allocation change. Processes are assigned a state, which changes as circumstances require.

Linux process states

The Linux process states are illustrated in the previous diagram and described in the following table.

Linux Process States

Name	Flag	Kernel-defined state name and description
Running	R	TASK_RUNNING: The process is either executing on a CPU or waiting to run. Process can be executing user routines or kernel routines (system calls), or be queued and ready when in the Running (or Runnable) state.
Sleeping	S	TASK_INTERRUPTIBLE: The process is waiting for some condition: a hardware request, system resource access, or signal. When an event or signal satisfies the condition, the process returns to Running.
	D	TASK_UNINTERRUPTIBLE: This process is also Sleeping, but unlike S state, will not respond to delivered signals. Used only under specific conditions in which process interruption may cause an unpredictable device state.
	K	TASK_KILLABLE: Identical to the uninterruptible D state, but modified to allow the waiting task to respond to a signal to be killed (exited completely). Utilities frequently display Killable processes as D state.
Stopped	T	TASK_STOPPED: The process has been Stopped (suspended), usually by being signaled by a user or another process. The process can be continued (resumed) by another signal to return to Running.
	T	TASK_TRACED: A process that is being debugged is also temporarily Stopped and shares the same T state flag.
Zombie	Z	EXIT_ZOMBIE: A child process signals its parent as it exits. All resources except for the process identity (PID) are released.
	X	EXIT_DEAD: When the parent cleans up (reaps) the remaining child process structure, the process is now released completely. This state will never be observed in process-listing utilities.

Listing Processes

The ps command is used for listing current processes. The command can provide detailed process information, including:

• the user identification (UID) which determines process privileges,
  
• the unique process identification (PID),
  
• the CPU and real time already expended,
  
• how much memory the process has allocated in various locations,
  
• the location of process STDOUT, known as the controlling terminal, and
  
• the current process state.
  

Important

The Linux version of ps supports three option formats, including:

• UNIX (POSIX) options, which may be grouped and must be preceded by a dash,
  
• BSD options, which may be grouped and must not be used with a dash, and
  
• GNU long options, which are preceded by two dashes.
  

For example, ps -aux is not the same as ps aux.

A common display listing (options aux) displays all processes, with columns in which users will be interested, and includes processes without a controlling terminal. A long listing (options lax) provides more technical detail, but may display faster by avoiding the username lookup. The similar UNIX syntax uses the options -ef to display all processes.

[student@serverX ~]$ ps aux
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.1  0.1  51648  7504 ?        Ss   17:45   0:03 /usr/lib/systemd/syst
root         2  0.0  0.0      0     0 ?        S    17:45   0:00 [kthreadd]
root         3  0.0  0.0      0     0 ?        S    17:45   0:00 [ksoftirqd/0]
root         5  0.0  0.0      0     0 ?        S<   17:45   0:00 [kworker/0:0H]
root         7  0.0  0.0      0     0 ?        S    17:45   0:00 [migration/0]
-- output truncated --
[student@serverX ~]$ ps lax
F   UID   PID  PPID PRI  NI    VSZ   RSS WCHAN  STAT TTY        TIME COMMAND
4     0     1     0  20   0  51648  7504 ep_pol Ss   ?          0:03 /usr/lib/systemd/
1     0     2     0  20   0      0     0 kthrea S    ?          0:00 [kthreadd]
1     0     3     2  20   0      0     0 smpboo S    ?          0:00 [ksoftirqd/0]
1     0     5     2   0 -20      0     0 worker S<   ?          0:00 [kworker/0:0H]
1     0     7     2 -100  -      0     0 smpboo S    ?          0:00 [migration/0]
-- output truncated --
[student@serverX ~]$ ps -ef
UID        PID  PPID  C STIME TTY          TIME CMD
root         1     0  0 17:45 ?        00:00:03 /usr/lib/systemd/systemd --switched-ro
root         2     0  0 17:45 ?        00:00:00 [kthreadd]
root         3     2  0 17:45 ?        00:00:00 [ksoftirqd/0]
root         5     2  0 17:45 ?        00:00:00 [kworker/0:0H]
root         7     2  0 17:45 ?        00:00:00 [migration/0]
-- output truncated --

By default, ps with no options selects all processes with the same effective user ID (EUID) as the current user and associated with the same terminal where ps was invoked.

• Processes in brackets (usually at the top) are scheduled kernel threads.
  
• Zombies show up in a ps listing as exiting or defunct.
  
• ps displays once. Use top(1) for a repetitive update process display.
  
• ps can display in tree format to view parent/child relationships.
  
• The default output is unsorted. Display order matches that of the system process table, which reuses table rows as processes die and new ones are created. Output may appear chronological, but is not guaranteed unless explicit -O or --sort options are used.