System Processes and Memory Management
Objectives
Upon completion of this module, you should be able to:
• Identify processes on your system using the ps command
• Find a process using the pgrep command
• Control processes using the jobs command
• Terminate unwanted processes using the kill and pkill commands
Discussion – At times an application that you are running will freeze or cause your system to
become inaccessible. How would you regain control of your workstation?
System Process Overview
Each task you perform in the Linux environment starts a process. An example of a process is
using vi to edit a letter, or sending a file to the printer. Each process is assigned a unique
process identification number (PID), which is used by the system to identify the process.
The following pages define useful commands on how to locate a process and terminate processes.
Process Hierarchy
There are five types of processes on a Linux system:
• Daemon
• Parent
• Child
• Orphan
• Zombie or defunct
Daemon processes are processes that are started by the kernel and exist for a specific purpose. For
instance, the lpd daemon exists for the sole purpose of handling print jobs. When no printing is
taking place on the system, the lpd daemon is running but inactive. When a print job is
submitted, this daemon becomes active until the job is finished. The login daemon provides
the CDE login screen at the beginning of a user’s session and again after the user exits CDE.
Following system boot-up, a process called init is invoked. This process is at the top of the
process hierarchy and is responsible for spawning many system processes. The login daemon
is spawned by init and init is, therefore, referred to as the parent process of the login
daemon.
When a user is working in a terminal window in CDE, that terminal’s PID is the parent process

root 236 1 80 16:48:08 ? 0:01 /usr/lib/saf/sac
root 844 1 54 12:12:10 ? 0:00 /usr/lib/lpsched
aster 1292 1 80 06:48:51 console 0:01 -ksh
root 241 236 69 16:48:14 ? 0:01 /usr/lib/saf/ttymon
rose 1400 321 80 20:03:11 ? 0:00 /usr/openwin/bin/clock
--More—
Table 16-1 describes the column headings.
Table 16-1 Column Headings
Value Description
PID The process identification number of the
process
PPID The parent process identification number of
the process
TTY The controlling terminal for the process
a
TIME The amount of CPU time used by the process
CMD The command name
b
a
The controlling terminal for system daemons appears as a question mark (?).
b
<defunct> will appear in the the CMD column if a process is a zombie or defunct process. Also,
the CPU time may be a bit higher for a defunct process than for other processes.
Searching for a Specific Process
A quicker way of determining the correct PID is to pipe the output of the ps command
through grep, searching for the specific process you want to terminate.
$ ps -e | grep lp
225 ? 0:01 lpNet
217 ? 0:0 lpsched
260 ? 0:01 lpNet

directory stucture with the find command. For example:
$ find / -name core > trash 2> /dev/null &
[1] 3923
In this example, each argument has the following meaning:
Table 16-3 Command Arguments
Argument Meaning
> Redirect standard output (1) to filename
trash The file used to capture standard output
2> Redirect standard error (2) to filename
/dev/null Data written to this file is discarded
& Process job in the background
The responses displayed by the system have the following meaning:
Table 16-4 Responses
Response Meaning
[1] The job ID number
3923 The process ID number
If you are still working in the shell, the next time you press Return you will see a message
indicating that the background process has completed.
[job-id] + Done job description . . .
• Use the jobs command to list your active jobs.
$ jobs
[1] + Running find / -name core> trash 2> /dev/null &
• If you bring the background job back to the foreground, it will tie up your shell until the
job is completed or placed back in the background.
$ fg %1
find / -name core > trash 2> /dev/null
• To put the same job in the background, suspend it first.
find / -name core > trash 2> /dev/null
^Z
[1] + Stopped(SIGTSTP) find / -name core> trash \