After read some linux article, and having some basic knowledge, now can have basic understanding on linux processes, a process is a single program that is executed within its own virtual address space. For example, a shell is a process that is created each time a user logs in to the system. It creates a new process every time it implements a program such as a system command. A system command is an example of a collection of related commands called a job. Jobs create a series of separate processes from a single command line. So, in fact, every program running under Linux is a process.

The following table shows the three main categories of processes.

Linux can share its processing power, storage capabilities, and input and output mechanisms with several users, or with several processes created by one user. Processes such as user jobs, operating system tasks, mail, and background jobs like printing need to be monitored simultaneously by Linux.

PIDs
When a request is made to the shell, it assigns a specific identity number called a process identifier (PID) to the corresponding process. PIDs enable the shell to identify the process it’s working on and helps it to monitor the progress of this process. PIDs start at zero, beginning at boot time, and increase by one for each process being run. Once the highest system-determined number has been reached, such as 65,564, the procedure starts from zero again, skipping the PIDs for processes that are still active. Every new command creates at least one extra process. For example, to print a file called report.txt, you enter

$ lp report.txt

This creates an extra process – lp – on top of the already existing shell process that is running in the foreground. So the shell prompt reappears onscreen only after the lp command is finished, because only one process can occupy the foreground at any one time.

Parent and child processes
Each existing process becomes a parent process when it initiates a new process. The new process is referred to as a child process. For example, say you run a shell script called shellscript1 that contains an ls command. The shell executes a process called shellscript1, which in turn generates a process called ls. So the shell process becomes the parent of shellscript1, and shellscript1 then becomes the parent of ls.

A parent process bestows its environment upon the child process. A child process will include standard input (stdin), standard output (stdout), and standard error (stderr). So if you open a file in a shell script (its parent), the commands that follow in the script will retain the open file in their environment. However, the parent and child processes will remain unaffected by any changes in the environment that occur during the execution of a process. This is because the processes run independently of each other. Therefore, after the child process has been initiated, any files opened in either the parent or the child will not be available to the other process.

Using the ps command
You use the ps command to identify which processes are currently running in the system. It helps you to monitor the process running in the foreground, and allows you, as root, to see what other processes are running.

To list all current processes running under a User ID (UID), you type ps without using options or arguments. This returns the PIDs of the processes, the terminal they originated from, their current status, the CPU time used, and the command running in the processes. For example, the command could return output such as

$ ps
PID TTY TIME CMD
511 tty1 00:00:00 login
7062 tty1 02:34:59 bash
17079 tty1 00:00:00 ps

This output shows that the user’s startup shell is bash (PID 7062). The startup shell sometimes has a hyphen placed before it to differentiate it from any shells started afterwards. But some versions of the ps command don’t do this.

General users can display their own processes only using the ps command. However, superusers can use the ps command to list every process running in the system.

There are many complex options for the ps command. Some options determine the sets of processes to be produced, whereas others determine the output format. Some options are preceded by a dash (–) in the traditional Linux manner, but others are not. And sometimes the same letter produces completely different output depending on whether it has a dash or not. For instance, $ ps -a produces a full listing of all processes, but $ ps a produces a modified listing of all the processes in the current terminal. For a full listing of the different ps options, you can consult the man pages for ps.

For most purposes, a simple set of common options for the ps command provide sufficient power and flexibility. The -a option provides a listing of all processes currently running on all the terminals. The listing below shows the processes running under tty1 and tty2, for example:

$ ps -a
PID TTY TIME CMD
7062 tty1 02:34:5 bash
16894 tty2 00:00:00 bash
16906 tty2 00:00:00 startx
16913 tty2 00:00:00 xinit
16917 tty2 00:00:00 gnome-session
16927 tty2 00:00:00 gnome-smproxy
16933 tty2 00:00:00 enlightenment
16952 tty2 00:00:00 magicdev
16969 tty2 00:00:00 panel
16971 tty2 00:00:00 gmc
16988 tty1 00:00:00 ps

The f option, without a dash, uses ASCII characters to graphically represent a hierarchical view of the parent-child relationships between processes. This is particularly useful if you’re considering killing processes, because it helps you ensure that you don’t kill a child process accidentally when you kill a parent process. In the listing below, process 16906 is the parent of 16913, which in turn is the parent of 16917:

$ ps f –a
PID TTY STAT TIME COMMAND
16894 tty2 S 0:00 -bash
16906 tty2 S 0:00 sh /usr/X11R6/bin/startx
16913 tty2 S 0:00 \_ xinit /etc/X11/xinit/xinitrc — :0 –auth /root/.X
16917 tty2 S 0:00 \_ /usr/bin/gnome-session
7062 tty1 S 154:59 -bash
17105 tty1 R 0:00 ps f –a
16971 tty2 S 0:00 gmc –sm-client-id default10
16969 tty2 S 0:00 panel –sm-client-id default8
16952 tty2 S 0:00 magicdev –sm-client-id=default12
16933 tty2 S 0:00 enlightenment –clientId default2
16927 tty2 S 0:00 gnome-smproxy –sm-client-id default

Using the -l option with the ps command shows more detailed information in the process entry. This includes the parent PID (PPID), the size, the UID, the status, and the priority of a process. For example, the ps -l command might return output such as

$ ps -l
F S UID PID PPID C PRI NI ADDR SZ WCHAN TTY TIME CMD
100 S 0 511 1 0 60 0 – 549 wait4 tty1 00:00:00 login
100 S 0 7062 511 0 70 0 – 808 wait4 tty1 02:34:59 bash
100 R 0 17115 7062 0 73 0 – 627 – tty1 00:00:00 ps

The PPID column shows the process that started each process. This is useful if you need to identify child processes.