OS Process Management

Life of a process

Program vs. Process Revisited

Programs

The applications that we can run, like the Chrome web browser.

Processes

Programs that are running.

• When you open a program, a process is started, and it gets the process ID or PID.
• Background or Daemon Processes are those who are always running in the background.

Windows: Process Creation and Termination

• When Windows boots up or starts, the first non-kernel user mode that starts is the Session Manager Subsystem or smss.exe.
  • It kicks start some processes before login
  • Then smss.exe starts winlogon.exe along with client/server runtime subsystem or csrss.exe, which handles GUI and CLI.
  • Unlike Linux, Windows’ processes can run own their own in their respective Environment created by smss.exe independent of their parent process.
• To terminate a process from CLI, taskkill utility is used, which can find and halt a process.
  • taskkill Uses PID to identify the process running.

  To kill notepad with taskkill from CLI:

  taskkill /pid 5856
  

  To forcefully kill a rogue process:

  taskkill /F /PID <PID>
  

Linux: Process Creation and Termination

• On Linux, process has parent child relationship.
• So every process that runs on the system has some parent process.
• init Is the parent process for the kernel

INIT Process

When you start up your computer, the kernel creates a process called init, which has a PID of 1.

Managing Processes

Windows: Reading Process Information

• Task Manager or taskmgr.exe is one way of obtaining processes information on Windows.

  To show all running processes in CLI:

  tasklist
  

  The PowerShell command for the same:

  Get-Process
  

Linux: Reading Process Information

To see process running on Linux:

  ps -x

The following STAT for ps -x command are used to show processes current status

• R: running
• T: stopped
• S interruptible sleep

To see full list of running processes, even by other users run:

  ps -ef #'f' for full

• UID: User ID
• PID: Process ID
• PPID: Parent Process ID
• C: Number of children processes
• STIME: Start Time of Process
• TTY: Terminal associated with the process
• TIME: Total CPU time process is taking up
• CMD: Name of the command running

Everything in a Linux is a file, even the processes. So we can view them in /proc.

  ls -l /proc

Windows: Signals

• If we want to close an unresponsive process, we use signals.

• The most common is SIGINT or signal interrupt. You can send this signal to a running process with the CTRL+C key combination.

  

Signal

A way to tell a process that something’s just happened.

Linux: Signals

There are lots of signals on Linux, starting with SIG. I.e. SIGTERM, SIGINT** etc.

Windows: Managing Processes

• To restart or pause a process and to do even much more, Process Explorer tool is used.

Process Explorer

A utility, Microsoft created to let IT Support Specialists, system admins and other users to look at running processes.

Linux: Managing Processes

• To terminate a process, kill command is used.
  • kill Without any parameters, sends SIGINT signal to the program/process to clean is running processes and close them properly

  To kill a process

  kill <PID>
  

  To send SIGKILL via kill command:

  kill -KILL <PID>
  

  -KILL Should the lost resort to stop a process, it doesn’t give time to the process for cleanup, it may cause more harm than good.

  To put process on pause instead of killing, SIGSTP or signal stop, is used

  kill -TSTP <PID>
  

  To resume from suspend:

  kill -CONT <PID>
  

Process Utilization

Windows: Resource Monitoring

• Resource Monitoring tool is used.

• To get resource monitoring from CLI

  Get-Process
  

  To get the three most resource heavy processes:

  Get-Process | Sort CPU -descending | Select -first 3 -Property ID,ProcessName,CPU
  

Linux: Resource Monitoring

top is a useful resource monitoring CLI tool:

  top

Another useful CLI tool is uptime, which show info about the current time, how long your computer running, how many users are logged on, and what the load average of your machine is.

When ejecting a USB drive, you get the error “Device or resource busy” though none of the files on the USB drive is in use or opened anywhere, or so you think. Using the lsof lists open files and what processes are using them.

• It is great for tracking down pesky processes that are holding open files.