3.1 Looking at Processes

Even as you sit down at your computer, there are processes running. Every executing program uses one or more processes. Let's start by taking a look at the processes already on your computer.

3.1.1 Process IDs

Each process in a Linux system is identified by its unique process ID, sometimes referred to as pid. Process IDs are 16-bit numbers that are assigned sequentially by Linux as new processes are created.

Every process also has a parent process (except the special init process, described in Section 3.4.3, "Zombie Processes"). Thus, you can think of the processes on a Linux system as arranged in a tree, with the init process at its root. The parent process ID, or ppid, is simply the process ID of the process's parent.

When referring to process IDs in a C or C++ program , always use the pid_t typedef, which is defined in <sys/types.h>. A program can obtain the process ID of the process it's running in with the getpid() system call, and it can obtain the process ID of its parent process with the getppid() system call. For instance, the program in Listing 3.1 prints its process ID and its parent's process ID.

Listing 3.1 (print-pid.c) Printing the Process ID
#include <stdio.h> 
#include <unistd.h> 
int main ( ) 
  printf ("The process ID is %d\n", (int) getpid ()) ; 
  printf ("The parent process ID is %d\n", (int) getppid ()) ; 
  return 0 ; 

Observe that if you invoke this program several times, a different process ID is reported because each invocation is in a new process. However, if you invoke it every time from the same shell, the parent process ID (that is, the process ID of the shell process) is the same.

3.1.2 Viewing Active Processes

The ps command displays the processes that are running on your system. The GNU/Linux version of ps has lots of options because it tries to be compatible with versions of ps on several other UNIX variants. These options control which processes are listed and what information about each is shown.

By default, invoking ps displays the processes controlled by the terminal or terminal window in which ps is invoked. For example:

% ps 
21693 pts/8 00:00:00 bash 
21694 pts/8 00:00:00 ps 

This invocation of ps shows two processes. The first, bash, is the shell running on this terminal. The second is the running instance of the ps program itself. The first column, labeled PID, displays the process ID of each.

For a more detailed look at what's running on your GNU/Linux system , invoke this:

% ps -e -o pid,ppid,command 

The -e option instructs ps to display all processes running on the system. The -o pid,ppid,command option tells ps what information to show about each process— in this case, the process ID, the parent process ID, and the command running in this process.

ps Output Formats

With the -o option to the ps command, you specify the information about processes that you want in the output as a comma-separated list. For example, ps -o pid,user,start_time,command displays the process ID, the name of the user owning the process, the wall clock time at which the process started, and the command running in the process. See the man page for ps for the full list of field codes. You can use the -f (full listing), -l (long listing), or -j (jobs listing) options instead to get three different preset listing formats.

Here are the first few lines and last few lines of output from this command on my system. You may see different output, depending on what's running on your system.

% ps -e -o pid,ppid,command 
    1     0 init [5] 
    2     1 [kflushd] 
    3     1 [kupdate] 
21725 21693 xterm 
21727 21725 bash 
21728 21727 ps -e -o pid,ppid,command 

Note that the parent process ID of the ps command, 21727, is the process ID of bash, the shell from which I invoked ps. The parent process ID of bash is in turn 21725, the process ID of the xterm program in which the shell is running.

3.1.3 Killing a Process

You can kill a running process with the kill command. Simply specify on the command line the process ID of the process to be killed.

The kill command works by sending the process a SIGTERM, or termination, signal. [1] This causes the process to terminate, unless the executing program explicitly handles or masks the SIGTERM signal. Signals are described in Section 3.3, "Signals."

[1] You can also use the kill command to send other signals to a process. This is described in Section 3.4, "Process Termination."