Quiz: Process Management¶
7 questions
L0 (2 questions)¶
1. What is the difference between SIGTERM and SIGKILL, and why should you always send SIGTERM first?
Show answer
SIGTERM (15) asks the process to shut down gracefully — it can catch the signal, flush buffers, close connections, and clean up. SIGKILL (9) terminates immediately — the process cannot catch it, so shared memory, temp files, and locks are left behind. Always SIGTERM first, wait, then SIGKILL only if needed. This is what Docker and Kubernetes do during pod termination.2. What is the difference between SIGTERM and SIGKILL and why does it matter?
Show answer
SIGTERM (15) asks a process to terminate gracefully — the process can catch it, clean up (close files, release locks, save state), and exit. SIGKILL (9) forces immediate termination — the process cannot catch or ignore it, so no cleanup happens. Always try SIGTERM first (kill PID or kill -15 PID). Only use SIGKILL (kill -9 PID) if the process is stuck. Consequences of SIGKILL: orphaned lock files, corrupted state, unfinished transactions, zombie children.L1 (2 questions)¶
1. What is a zombie process and how do you eliminate one?
Show answer
A zombie is a process that has exited but whose parent has not called wait() to collect its exit status. It holds a PID slot but uses no CPU or memory. You cannot kill a zombie — it is already dead. Fix by killing or fixing the parent process so it reaps children properly. When the parent dies, zombies are adopted by PID 1 (init/systemd) which reaps them.2. How do you use strace to debug a failing process?
Show answer
strace -p PID attaches to a running process. strace -f command traces child processes too. Key flags: -e trace=open,read,write (filter syscalls), -T (show time spent in each call), -c (summary of call counts and times). Common uses: find which config file a program is reading, see why a connect() fails (wrong IP/port), discover missing library paths. Use -o file to avoid mixing output with stderr.L2 (2 questions)¶
1. A process is stuck in D-state (uninterruptible sleep) and cannot be killed even with SIGKILL. What does this mean and what can you do?
Show answer
D-state means the process is waiting for a kernel-level I/O operation that cannot be interrupted. Common causes: NFS server unreachable, failing disk, hung FUSE filesystem, or lost iSCSI target. You cannot kill D-state processes. You must fix the underlying I/O problem (restore NFS, fix the disk) or reboot. Check what it is waiting on with 'cat /proc/2. How does the OOM killer decide which process to kill and how do you influence it?
Show answer
The kernel computes an oom_score for each process (0-1000) based on memory usage, age, and privileges. Higher score = more likely to be killed. Influence via /proc/PID/oom_score_adj: range -1000 to +1000. Set -1000 to exempt (e.g., database). Set +1000 to prefer killing. For systemd services: OOMScoreAdjust=-900 in the unit file. Also: oom_kill_disable on cgroups (dangerous — can cause system hang). Check current scores: cat /proc/*/oom_score | sort -rn.L3 (1 questions)¶
1. A container accumulates zombie processes over time. What is the root cause and what are two solutions?
Show answer
The container's PID 1 is not a proper init process — it does not reap adopted orphan/zombie children. When child processes are orphaned, they are reparented to PID 1, but if PID 1 never calls wait(), zombies accumulate. Solutions:1. Use tini or dumb-init as the ENTRYPOINT (e.g., ENTRYPOINT ["tini", "--"]) to act as a minimal init.
2. On Docker, use --init flag which injects tini automatically.