Linux Process Management

A Linux process is a running program represented by kernel-managed state. That state includes an identifier, credentials, memory mappings, open files, signal settings, scheduling attributes, and one or more threads. The kernel scheduler selects runnable threads for CPUs. User-space tools read process state and request changes through system calls.

Process management is therefore a control loop: identify the correct task, inspect its state and relationships, choose the least disruptive action, then verify the result. A process identifier, or PID, is useful for locating a task, but PIDs can be reused after exit. Names alone are also ambiguous because several processes may run the same executable.

The process lifecycle

A program commonly creates work with fork() or a related interface. fork() creates a child process with a separate address space that initially uses copy-on-write pages. The child often calls execve() next. That call replaces the current process image while retaining the same PID.

The parent and child form a process tree. The child receives a parent process identifier, or PPID. A service manager or shell may sit above several related descendants. Process groups collect processes for signal delivery and terminal job control. Sessions collect related process groups and establish a controlling-terminal boundary.

When a process exits, the kernel retains its termination status until its parent calls a wait interface. During that interval the process is a zombie: it no longer executes, but it still occupies a process-table slot. An orphan is different. Its parent exited first, so another process, commonly PID 1 or a configured child subreaper, adopts it.

Linux Process Management

The process lifecycle

Relevant careers