Process Management¶
11 cards — 🟢 3 easy | 🟡 5 medium | 🔴 3 hard
🟢 Easy (3)¶
1. Why should you always send SIGTERM before SIGKILL when stopping a process?
Show answer
SIGTERM (15) allows the process to catch the signal and shut down gracefully (flush buffers, close connections, remove PID files). SIGKILL (9) cannot be caught -- the kernel terminates the process immediately, leaving behind shared memory, temp files, and locks. Always SIGTERM first, wait, then SIGKILL only if needed.2. How do you view the process tree showing parent-child relationships?
Show answer
Use pstree -p to show the full process tree with PIDs. Alternatively, ps auxf or ps -ef --forest shows processes in a hierarchical tree format. This is critical for understanding which process spawned which child.3. How do you suspend a running foreground process and then resume it in the background?
Show answer
Press Ctrl+Z to suspend the foreground process (sends SIGTSTP, puts it in Stopped state). Then use bg %1 to resume it in the background. Use jobs -l to list all jobs with their status and PIDs. Use fg %1 to bring it back to the foreground.🟡 Medium (5)¶
1. What is a zombie process, and how do you eliminate one?
Show answer
A zombie is a process that has exited but whose parent has not called wait() to collect its exit status. It holds a PID slot but uses no CPU or memory. You cannot kill a zombie (it is already dead). You must fix or kill its parent process. When the parent dies, PID 1 (init/systemd) adopts and reaps the zombie.2. What is a D-state (uninterruptible sleep) process, and why can't you kill it?
Show answer
A D-state process is waiting for a kernel-level I/O operation and cannot be interrupted by any signal, including SIGKILL. Common causes: unreachable NFS server, failing disk, hung FUSE filesystem, dead iSCSI target. Find them with: ps aux | awk '$8 ~ /D/'. You fix the underlying I/O problem, or reboot.3. How do you ensure a process survives terminal logout?
Show answer
Use nohup ./script.sh > /var/log/output.log 2>&1 & to ignore SIGHUP (sent when the terminal closes). Modern alternatives: tmux or screen for interactive sessions, or systemd-run --unit=my-task for permanent background tasks. The shell sends SIGHUP to all children on exit, which kills them without protection.4. How do you find the open file descriptors and file descriptor count for a running process?
Show answer
List open file descriptors: ls -la /proc/5. Describe the fork-exec-wait process lifecycle in Linux.
Show answer
1) fork(): parent creates a child (near-exact copy with new PID). 2) exec(): child replaces its memory with a new program (PID stays the same). 3) exit(): child terminates, becomes a zombie. 4) wait(): parent collects exit status, zombie is reaped, PID is freed. Every process follows this pattern. PID 1 is the only exception (no parent).🔴 Hard (3)¶
1. What are the most common ulimit-related production failures, and how do you fix them?
Show answer
Too many open files -- increase nofile limit. "Cannot fork" -- hit max processes (nproc). "No core dump generated" -- core file size is 0. Set permanently in /etc/security/limits.conf (e.g., appuser soft nofile 65536) or in systemd unit files with LimitNOFILE=65536 and LimitNPROC=4096. Check current limits with cat /proc/2. What are the different ways to send signals to processes, and when would you use each?
Show answer
kill -SIGTERM3. Why do containers need a proper init process like tini or dumb-init?