Linux Essentials Preparation · lesson 15 of 23 · 25 min
Process Management
Every running program is a process with a unique PID (Process ID). Processes have a parent-child relationship — the first process (PID 1) is systemd (or init on older systems).
ps — snapshot of current processes. ps aux (all processes, all users, detailed). ps -ef (full format). Columns: USER, PID, %CPU, %MEM, COMMAND.
top — real-time process monitor. Shows CPU/memory usage, load average, and process list sorted by CPU. Press q to quit, k to kill a process, M to sort by memory.
htop — improved interactive version of top (may need to install). Color-coded, mouse support.
kill — send a signal to a process. kill PID (sends SIGTERM — graceful shutdown), kill -9 PID (sends SIGKILL — immediate termination, cannot be ignored). killall processname — kill all processes with that name.
nice / renice — set process priority. Nice values range from -20 (highest priority) to +19 (lowest). nice -n 10 command (start with lower priority), renice 5 -p PID (change running process priority). Only root can set negative nice values.
Background/foreground: command & (run in background), jobs (list background jobs), fg %1 (bring job 1 to foreground), bg %1 (resume job 1 in background), Ctrl+Z (suspend foreground process).
systemd and Service Management
systemd is the init system and service manager on most modern Linux distributions. It manages services (daemons), mounts, timers, and more.
systemctl — the primary tool for managing systemd services:
systemctl start service — start a service now.
systemctl stop service — stop a service.
systemctl restart service — stop and start (applies config changes).
systemctl reload service — reload config without full restart (if supported).
systemctl enable service — start service automatically at boot.
systemctl disable service — prevent service from starting at boot.
systemctl status service — show service status, recent logs, and PID.
systemctl is-active service — returns “active” or “inactive”.
systemctl list-units --type=service — list all loaded services.
Common Services
sshd (SSH server), apache2/httpd (web server), nginx (web server), mysql/mariadb (database), cron (scheduled tasks), NetworkManager (network management), firewalld/ufw (firewall).
journalctl — Viewing System Logs
journalctl queries the systemd journal (binary log database). More powerful than reading /var/log files directly.
journalctl — show all logs (oldest first).
journalctl -f — follow (like tail -f) — live log stream.
journalctl -u sshd — logs for a specific service.
journalctl -n 50 — last 50 lines.
journalctl --since "2024-01-01" --until "2024-01-02" — time range.
journalctl -p err — only error-level and above.
journalctl -b — logs from current boot. journalctl -b -1 — previous boot.
Hardware Information Commands
lscpu — CPU information (architecture, cores, threads, speed, cache).
lsmem — memory information. free -h — show RAM and swap usage in human-readable format.
lsblk — list block devices (disks, partitions). df -h — disk space usage by filesystem.
lspci — list PCI devices (network cards, graphics, storage controllers).
lsusb — list USB devices.
uname -a — kernel version, hostname, architecture.
dmidecode — detailed hardware info from DMI/SMBIOS (requires root). Shows BIOS version, memory slots, CPU details.
dmesg — kernel ring buffer messages — hardware detection during boot, driver errors. dmesg | grep -i error to find hardware errors.
uptime — how long the system has been running, load average (1, 5, 15 minute averages).
Key Terms
Key Terms
Knowledge Check — 12 Questions
Linux — Processes, Hardware & systemd
Which command shows a real-time view of running processes and CPU/memory usage?
- ps aux
- top
- jobs
- lscpu
Answer: top
top provides a real-time, continuously updated view of processes sorted by CPU usage.
kill -9 PID sends which signal?
- SIGTERM
- SIGHUP
- SIGKILL
- SIGSTOP
Answer: SIGKILL
Signal 9 is SIGKILL — immediately terminates the process. It cannot be caught, blocked, or ignored.
Which systemctl command configures a service to start automatically at boot?
- systemctl start
- systemctl enable
- systemctl activate
- systemctl boot
Answer: systemctl enable
systemctl enable creates the necessary symlinks so the service starts at boot. systemctl start only starts it now.
journalctl -u sshd shows:
- All system logs
- Logs for the sshd service only
- SSH connection attempts only
- Failed login attempts only
- Answer: Logs for the sshd service only
journalctl -u filters logs by systemd unit (service). -u sshd shows only SSH daemon logs.
Which command shows disk space usage by filesystem?
- lsblk
- du -h
- df -h
- fdisk -l
Answer: df -h
df -h (disk free, human-readable) shows filesystem disk space usage. lsblk lists block devices; du shows directory sizes.
A nice value of -10 compared to +10 means:
- Lower priority
- Higher priority
- The process is paused
- The process runs in the background
- Answer: Higher priority
Lower nice values = higher priority. -20 is highest priority; +19 is lowest. Only root can set negative nice values.
Which command shows kernel version and system architecture?
- lscpu
- uname -a
- dmesg
- uptime
Answer: uname -a
uname -a shows kernel name, hostname, kernel version, build date, and architecture.
dmesg is used to:
- View systemd service logs
- View kernel ring buffer messages (hardware detection, driver errors)
- Monitor real-time processes
- List installed packages
- Answer: View kernel ring buffer messages (hardware detection, driver errors)
dmesg shows kernel messages — hardware detection during boot, driver loading, and hardware errors.
To run a command in the background, append _____ to the command.
Answer: &
Appending & runs the command in the background, returning the shell prompt immediately.
Which command lists all PCI devices (network cards, graphics)?
- lsusb
- lspci
- lsblk
- lscpu
Answer: lspci
lspci lists all PCI/PCIe devices — network cards, graphics cards, storage controllers, etc.
journalctl -b shows:
- Logs from all boots
- Logs from the current boot only
- Boot configuration
- BIOS messages
- Answer: Logs from the current boot only
journalctl -b shows logs from the current boot. -b -1 shows the previous boot, -b -2 the one before that. free -h shows:
- Disk space usage
- RAM and swap usage in human-readable format
- Free inodes
- Available package updates
- Answer: RAM and swap usage in human-readable format
free -h displays total, used, and available RAM and swap space in human-readable units (MB, GB).
Previous lesson: Linux file system hierarchy: /, /etc, /var, /home, /tmp, /proc, /dev, /usr, /bin; file types
Back to Linux Essentials Preparation
Next lesson: Disk management: fdisk, lsblk, df, du, mount, umount, /etc/fstab