See what is running (`ps`)

Every process that starts is given a number, called a PID (process ID).

PID   USER     COMMAND    1 root     init   78 learner -sh

They are handed out from 1 upwards and given back when the process finishes. The operations coming later — stopping something, sending it a signal — all work on this number.

So you point at things by number, not by name. It is quite ordinary for three programs with the same name to be running. Start three sleeps and you cannot tell them apart by name.

The number is a tag on the thing running at that moment. It is not attached to the program's file; it is handed out when the thing starts and given back when it ends. Type the same ls twice and the number differs both times.

The command that lists them is ps (process status).

~ $ psPID   USER     COMMAND    1 root     init    2 root     [kthreadd]   52 root     /sbin/syslogd -n   77 root     /usr/sbin/crond -f   78 learner -sh   84 learner ps

Three columns.

Look at the last line. ps itself is in the picture. It feels odd to be counted among the things you are counting, and it is correct: the moment you typed ps, ps was running as a process too.

Worth remembering for later. "There should be one and there are two" — one of them was you.

Look closely and many names are wrapped in [...].

    2 root     [kthreadd]    3 root     [pool_workqueue_]   14 root     [ksoftirqd/0]

Those are kernel threads, workers that the core of Linux (the kernel) runs for itself. They are not programs with a file in /bin.

Think of the brackets as the mark saying "this one is staff, not something you started". They write out to disk and tidy up memory behind the scenes.

About 31 of them run in this Linux. The number is a surprise, and nearly all of them are asleep and using no CPU.

They are best left alone, so you need not learn their names. Skip the brackets when you read — that is all you need.

When three columns are not enough, pick with -o, separated by commas.

~ $ ps -o pid,ppid,user,argsPID   PPID  USER     COMMAND    1     0 root     init   78     1 learner -sh

These are the columns you can pick.

The p of ppid is for parent. The next lesson goes into it properly, and the point is that every process has a parent.

Note that this Linux's ps will not take -o time or -o nice. Type them and you get ps: bad -o argument, along with the names you may use. The error doubles as the manual, which is kind of ps.

The number of the shell you are typing into is in $$.

~ $ echo $$78

$$ is a special way of writing that the shell replaces with its own number (chapter 10 does the mechanism).

Put them together and you can pull out just your own line.

~ $ ps -o pid,ppid,args | grep "^ *$$ "   78     1 -sh

There is also a tool for looking up a number from a name: pidof.

~ $ pidof init1

Number 1 is special. It is the first process Linux starts, named init in this course. Every process branches off from 1. It is the star of the next lesson.

When the list is long you narrow it with grep. And something annoying happens.

~ $ ps -o pid,args | grep sh   78 -sh   91 grep sh

The grep sh line is mixed in. grep is a process too, so it lands in ps. You wanted to count one and got two — a fine source of mistakes.

There is a long-standing way round it.

~ $ ps -o pid,args | grep "[s]h"   78 -sh

[s]h is the regular expression for "any one of s, then h", so it matches sh (the character class of chapter 3).

But what appears on grep's own command line is the four characters [s]h, and there is no sh in a row in there. Only itself slips through.

It looks like an incantation and the meaning is simple. Understand the trick and you will not forget it.

These are all the tools for this lesson.

ps                       list themps -o pid,ppid,user,args pick the columnspidof name               number from a nameecho $$                  your own shell's number

The results are long, so many questions keep them in a file and read that. The > of chapter 4 and the grep of chapter 3 work as they are.

One warning. The numbers change every time. The numbers on your screen differ from the ones written here, and that is right.

So the questions ask not "what is the number" but "what is running" and "who is the parent".