See the parentage as a tree (`pstree`)

A new process is always born from a process that already exists.

~ $ ls

What happens here is this.

1. The shell makes a copy of itself
2. The copy replaces itself with ls
3. The shell waits for the copy to finish
4. When it does, it prints the prompt

The first is called fork (branching) and the second exec (replacing). You need not learn the names; just hold on to the shape, a parent copying itself to make a child.

That is why it becomes a tree. Every process is somebody's child, and following it all the way up always lands on init (number 1).

And notice "the shell waits". The & in the second half of this chapter is the mark that stops that waiting.

The command that draws the tree is pstree.

~ $ pstreeinit-+-crond     |-sh---pstree     `-syslogd

Reading it is simple.

• parent on the left, children on the right
• -+- is "branches split here"
• | is a branch continuing, and ` `` is the last branch
• --- is a single child

Those three lines hold the whole of this Linux. init has three children (crond, sh, syslogd), and sh (your shell) has pstree itself as its child.

Remember counting "init has three children" last lesson? You just saw the same thing as a picture. Quicker than counting.

When you want the numbers too, add -p.

~ $ pstree -pinit(1)-+-crond(77)        |-sh(78)-+-pstree(86)        |        `-...        `-syslogd(52)

The PID is in the brackets. This is how you hunt for the process you want to stop. You check its position in the tree and read off the number.

When you get to kill next lesson, this shape earns its keep. You can see with your eyes "the one I want is this branch, this number".

Aim badly and stopping a parent can take the branch below it with it. Looking at the tree first is the safe habit.

When several children have the same name, pstree gathers them up.

~ $ sleep 30 & sleep 31 & pstreeinit-+-crond     |-sh-+-pstree     |    `-2*[sleep]     `-syslogd

2*[sleep] means "two sleeps". With a hundred it would be 100*[sleep].

That is your first &. It is the mark for running in the background, and the prompt comes straight back. The second half of this chapter covers it; for now think of it as a tool for growing extra branches.

Gathering them up is kind. With something like a web server that starts fifty identical workers, the screen would otherwise fill up.

When you want each number, add -p. Then it lists them all separately, as sleep(99) and so on.

When the tree is big, you can hand it the part you want to see: a number, or a person's name.

~ $ pstree $$sh---pstree~ $ pstree learnersh---pstree

It draws only downwards from what you gave it. $$ was your own shell's number (last lesson).

And there is an important property. pstree only draws the tree of number 1.

The 31 things below [kthreadd] that you saw last lesson are a separate tree growing out of number 2. So they do not appear in pstree.

~ $ pstree 2kthreadd-+-cpuhp/0         |-kcompactd0         `-...

Hand it the number and you can see it. This Linux has two trees: the kernel's, and yours.

What becomes of a child whose parent finished first?

You can try it. Run something wrapped in brackets and the wrapping shell disappears first.

~ $ ( sleep 20 & )~ $ ps -o pid,ppid,args | grep "[s]leep 20"   94     1 sleep 20

The parent is 1. Not your shell (78) but init.

That is init's other job: taking in processes that have lost their parent.

Why is it needed? Because when a process finishes, the rule is that it tells its parent it has finished. With nobody to tell, it stays as a "zombie" — finished and not tidied away. So somebody always has to be the parent.

init quietly clears up after the children it takes in. The one at the top of the tree is everybody's tidier-up as well.

These are all the tools.

pstree           draw the treepstree -p        with the numberspstree $$        only from your shell downpstree learner  only that person'spstree 2         the kernel's tree

The tree is a picture made of characters, so many questions keep it in a file and read it with cat. On a narrow screen that is easier to read.

You also use & a little. It is only there to grow branches, so do not worry about the meaning yet.

One promise. Do not type kill 1. Stopping number 1 stops the whole of Linux. This course protects you from it, and on a real server it really does go down.