1 Linux中进程（process）
现代操作系统通常是多任务（multitasking），即通过快速的从一个正在执行的程序切换到另一个，给人以一种设备可以在一瞬间处理多个任务的假象。Linux内核通过使用进程来管理这一点。进程是Linux如何组织不同的程序在中央处理器等待它们的回合。
有时计算级变慢，或者应用停止响应。在命令行下我们可以使用下面的命令来检查活跃的程序以及如何关闭错误的进程。
-
ps—Report a snapshot of current processes. -
top—Display tasks. -
jobs—List active jobs. -
bg—Place a job in the background. -
fg—Place a job in the foreground. -
kill—Send a signal to a process. -
killall—Kill processes by name. -
shutdown—Shut down or reboot the system.
2 关于进程
2.1 进程如何工作
当系统启动，内核（kernel）使用进程的方式初始化自己活动（activities ）并且运行init程序。init程序依次运行一系列init script 的shell脚本（位于/etc中）来启动所有的系统服务。许多服务作为守护程序（daemon programs）来实现，程序在后台运行并且没有任何用户界面。因此即使没有登陆，系统也在执行这些程序。
一个程序启动其他程序的过程在进程（processes）体系中表示为父进程（parent process）产生子进程（child process）。
内核（kernel）维护有关每个进程（process）的信息，以帮助保持事物的组织。举例来说，每个进程被指派一个进程ID（process ID 缩写PID）。进程ID是递增的，因此init的PID总是1。内核还跟踪分配给每个进程的内存，以及准备恢复执行的进程。类似于文件，进程也有自己的所有者（owners ）以及用户ID（user IDs），有效的用户ID等等。
2.2 使用 ps 来查看进程（Processes ）
ps 简单的使用如下所示：
[me@linuxbox ~]$ ps
PID TTY TIME CMD
5198 pts/1 00:00:00 bash
10129 pts/1 00:00:00 ps
这个命令的结果列出两个进程：分别为 5198 号 bash 进程和 10129 号 ps 进程。默认情况下 ps 没有展示详细的信息，仅仅展示与现在终端会话（terminal session）有关的进程（processes ）。想要查看更多，需要在命令后面增加一些参数。在这个结果中 TTY（teletype ）意味着进程的控制终端（controlling terminal）。TIME 列是进程消耗的CPU时间量。
后面增加x参数，可以看到更多的关于进程的更多细节：
[root@izuf67yuy6secatlp4sztez ~]# ps x
PID TTY STAT TIME COMMAND
1 ? Ss 0:10 /usr/lib/systemd/systemd --switched-root --system --deserializ
2 ? S 0:00 [kthreadd]
3 ? S 2:37 [ksoftirqd/0]
5 ? S< 0:00 [kworker/0:0H]
6 ? S 0:05 [kworker/u2:0]
7 ? R 3:00 [rcu_sched]
8 ? S 0:00 [rcu_bh]
9 ? S 2:11 [rcuos/0]
...
x 参数（注意前面没有破折号）告诉 ps 显示无论被哪个终端（terminal）控制的所有的进程。上面结果中TTY列下的?表示没有控制终端（ontrolling terminal. ）。结果包含大量信息因此可以使用过滤器来处理结果。
STAT（state）列表示现在进程状态，如下表所示：
Table 10-1: Process States
| State | Meaning |
|---|---|
| R | Running. The process is running or ready to run. |
| S | Sleeping. The process is not running; rather, it is waiting for an event, such as a keystroke or network packet. |
| D | Uninterruptible sleep. Process is waiting for I/O such as a disk drive. |
| T | Stopped. Process has been instructed to stop (more on this later). |
| Z | A defunct or “zombie” process. This is a child process that has terminated but has not been cleaned up by its parent. |
| < | A high-priority process. It’s possible to grant more importance to a process, giving it more time on the CPU. This property of a process is called niceness. A process with high priority is said to be less nice because it’s taking more of the CPU’s time, which leaves less for everybody else. |
| N | A low-priority process. A process with low priority (a nice process) will get processor time only after other processes with higher priority have been serviced. |
值得注意的是 STAT 除了上面的字符外还可能显示其他字符来表示各种奇异的进程特征。
另外的常用的参数为 aux （同样无破折号），执行结果如下：
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.2 43520 4252 ? Ss Mar23 0:10 /usr/lib/systemd/systemd
root 2 0.0 0.0 0 0 ? S Mar23 0:00 [kthreadd]
root 3 0.0 0.0 0 0 ? S Mar23 2:37 [ksoftirqd/0]
root 5 0.0 0.0 0 0 ? S< Mar23 0:00 [kworker/0:0H]
root 6 0.0 0.0 0 0 ? S Mar23 0:05 [kworker/u2:0]
....
这组选项显示属于每个用户的进程。 使用不带前划线的参数将以“BSD样式”行为调用命令。 ps的Linux版本可以模拟几种在Unix实现的ps程序的行为。 使用这些参数，将获得表10-2中所示的其他列。
Table 10-2: BSD-Style ps Column Headers
| Header | Meaning |
|---|---|
| USER | User ID. This is the owner of the process. |
| %CPU | CPU usage as a percent. |
| %MEM | Memory usage as a percent. |
| VSZ | Virtual memory size. |
| RSS | Resident Set Size. The amount of physical memory (RAM) the process is using in kilobytes. |
| START | Time when the process started. For values over 24 hours, a date is used |
2.3 使用 top 观察动态的进程
虽然ps命令显示许多信息，但是它仅仅是提供了在命令执行时候的设备状态快照。因此可以使用top命令来查看动态的设备活动（activity）。
[me@linuxbox ~]$ top
top 命令显示实时更新的进程信息（默认情况每三秒一更新）。top 命令执行后显示的结果有两部分组成：上面的系统信息汇总以及下面的关于进程的表（使用CPU activity来排序），如下面所示：
top - 13:23:48 up 6 days, 23:22, 1 user, load average: 0.08, 0.20, 0.18
Tasks: 103 total, 2 running, 101 sleeping, 0 stopped, 0 zombie
%Cpu(s): 1.4 us, 1.7 sy, 0.0 ni, 96.5 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st
KiB Mem : 2048120 total, 73008 free, 428100 used, 1547012 buff/cache
KiB Swap: 0 total, 0 free, 0 used. 1432824 avail Mem
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
1220 root 10 -10 129952 9788 6804 S 1.7 0.5 158:48.98 AliYunDun
1026 root 20 0 1009344 10820 3340 S 1.3 0.5 125:45.46 staragent-core
3 root 20 0 0 0 0 S 0.3 0.0 2:39.39 ksoftirqd/0
1027 root 20 0 676628 7416 3172 S 0.3 0.4 48:17.35 staragent-ppf
...
上面的系统信息汇总各个字段意义如下表所示：
Table 10-3: top Information Fields
| Row | Field | Meaning |
|---|---|---|
| 1 | top | Name of the program |
| * | 13:23:48 | Current time of day |
| * | up 6 days | This called uptime. It is the amount of time since the machine was last booted. |
| * | 1 users | Two users are logged in. |
| * | load average: | Load average refers to the number of processes that are waiting to run; that is, the number of pro-cesses that are in a runnable state and are sharing the CPU. Three values are shown, each for a differ-ent period of time. The first is the average for the last 60 seconds, the next the previous 5 minutes, and finally the previous 15 minutes. Values under 1.0 indicate that the machine is not busy. |
| 2 | Tasks: | This summarizes the number of processes and their various process states. |
| * | 1.4 us | 1.4% of the CPU is being used for user processes. This means processes outside of the kernel itself |
| * | 1.7 sy | 1.7% of the CPU is being used for system (kernel) processes. |
| * | 0.0 ni | 0.0% of the CPU is being used by nice (low-priority) processes. |
| * | 96.5 id | 96.5% of the CPU is idle. |
| * | 0.3 wa | 0.3% of the CPU is waiting for I/O |
| 4 | Mem: | Shows how physical RAM is being used. |
| 5 | Swap: | Shows how swap space (virtual memory) is being used. |
执行top命令后可以按下h键来进入帮助界面以及按q键退出。使用命令行显示相比于图形化可以更快的显示系统信息以及更加节省系统资源。
2.4 控制进程（Controlling Processes）
以xlogo程序为例，在执行命令后，将会弹出带有图标的窗口：
[me@linuxbox ~]$ xlogo
可以通过调整窗口大小来确认程序是否在运行，如果图标刷新了，证明程序正在运行。
执行命令后，shell没有返回，这是因为shell在等待程序结束，如果关闭程序，shell将会得到返回值。
打断进程
首先，执行 xlogo 命令并确认程序正确执行，接着返回到终端并且按下CTRL-C 来打断程序。这意味着有礼貌的要求结束程序，按下以后xlogo的窗口将会关闭并且程序将会返回（return）。
将进程（Process ）放在后台执行
假设我们想在不终止xlogo程序的情况下返回shell提示。 为此，我们可以将程序放在后台执行。 可以将终端想象为具有前台（foreground，在表面可见的东西，如shell提示）和后台（background ，在表面之下具有隐藏的东西）。 要启动程序将其放置在背景中，在命令后加上＆字符（＆）：
[me@linuxbox ~]$ xlogo &
[1] 28236
[me@linuxbox ~]$
输入命令后，将显示xlogo窗口，并返回shell提示。程序执行后打印的数字是称为作业控制（job control）的Shell功能的一部分。 通过此消息，shell告诉我们我们已经开始了作业号1（[1]），并且它具有PID 28236。如果运行 ps ，我们可以看到此进程。
[me@linuxbox ~]$ ps
PID TTY TIME CMD
10603 pts/1 00:00:00 bash
28236 pts/1 00:00:00 xlogo
28239 pts/1 00:00:00 ps
将进程返回到前台
在后台运行的进程不能获取到键盘输入，为了将进程返回前台（foreground）可以使用 fg 命令：
[me@linuxbox ~]$ jobs
[1]+ Running xlogo &
[me@linuxbox ~]$ fg %1
xlogo
命令 fg 后面跟一个百分号和作业编号(称为jobspec)就可以实现将进程返回到前台。如果只有一个后台作业，则jobspec是可选的。这时候要终止xlogo，可以输入CTRL-C来打断程序。
停止（暂停）进程
想要停止一个过程而不终止它。 通常这样做是为了将前台进程移至后台。 要停止前台进程，键入CTRL-Z。例如：在命令提示符下，键入xlogo，按 Enter 键，然后键入CTRL-Z：
[me@linuxbox ~]$ xlogo
[1]+ Stopped xlogo
[me@linuxbox ~]$
停止xlogo之后，我们可以通过尝试调整xlogo窗口的大小来验证程序是否已停止。 我们将看到它似乎已经没有响应了。 可以使用 fg 命令将程序还原到前台，也可以使用 bg 命令将程序移到后台：
[me@linuxbox ~]$ bg %1
[1]+ xlogo &
[me@linuxbox ~]$
与 fg 命令一样，如果只有一个作业（job），则jobspec是可选的。如果我们从命令中启动一个图形程序，但是忘记通过添加 & 来将它放在后台，那么将进程从前台移动到后台也是很方便的。
2.5 信号（Signals）
可以使用 kill 命令来关闭程序的执行。例如：
[me@linuxbox ~]$ xlogo &
[1] 28401
[me@linuxbox ~]$ kill 28401
[1]+ Terminated xlogo
首先在后台启动xlogo。 Shell将打印作业编号（jobspec） 和后台进程的PID。 接下来，可以使用 kill 命令并指定要终止的进程的PID。 也可以使用jobspec（例如％1）代替PID来指定进程。
kill 命令并不是“杀死”进程； 而是向进程发送信号。 信号是操作系统与程序通信的几种方式之一。 上面已经使用CTRL-C和CTRL-Z来发送可以发挥作用的信号。 当终端接收到这些击键之一时，它将向前台的程序发送信号。 在CTRL-C的情况下，将发送一个称为INT（Interrupt）的信号。 使用CTRL-Z，将发送一个称为TSTP（Terminal Stop）的信号。 程序依次“监听”信号，并在接收到信号时对其进行操作。 程序可以侦听信号并根据信号采取行动的事实使它可以执行一些操作，例如在发送终止信号时可以保存正在进行的工作。
通过 kill 向进程发送信号，
命令格式：
kill [-signal] PID...
如果在命令行上没有指定信号，则默认发送 TERM (terminal -ate)信号。kill 命令最常用于发送表10-4中所示的信号。
Table 10-4: Common Signals
| Number | Name | Meaning |
|---|---|---|
| 1 | HUP | Hang up. This is a vestige of the good old days when terminals were attached to remote computers with phone lines and modems. The signal is used to indicate to programs that the controlling ter-minal has “hung up.” The effect of this signal can be demonstrated by closing a terminal session. The foreground program running on the terminal will be sent the signal and will terminate.This signal is also used by many daemon programs to cause a reinitialization. This means that when a daemon is sent this signal, it will restart and reread its configuration file. The Apache web server is an example of a daemon that uses the HUP signal in this wa |
| 2 | INT | Interrupt. Performs the same function as the CTRL-C key sent from the terminal. It will usually terminate a program. |
| 9 | KILL | Kill. This signal is special. Whereas programs may choose to handle signals sent to them in different ways, including by ignoring them altogether, the KILL signal is never actually sent to the target program. Rather, the kernel immediately termin-ates the process. When a process is terminated in this manner, it is given no opportunity to “clean up” after itself or save its work. For this reason, the KILL signal should be used only as a last resort when other termination signals fail. |
| 15 | TERM | Terminate. This is the default signal sent by the kill command. If a program is still “alive” enough to receive signals, it will terminate |
| 18 | CONT | Continue. This will restore a process after a STOP signal. |
| 19 | STOP | Stop. This signal causes a process to pause without terminating. Like the KILL signal, it is not sent to the target process, and thus it cannot be ignored. |
例如：
[me@linuxbox ~]$ xlogo &
[1] 13546
[me@linuxbox ~]$ kill -1 13546
[1]+ Hangup xlogo
在此示例中，在后台启动xlogo程序，然后向其发送HUP信号。 xlogo程序终止，并且外壳程序指示后台进程已接收到挂断信号。 在这期间可能需要几次按ENTER键才能看到消息。信号可以通过数字或对应的名称来指定，包括以字母SIG开头的名称：
[me@linuxbox ~]$ xlogo &
[1] 13601
[me@linuxbox ~]$ kill -INT 13601
[1]+ Interrupt xlogo
[me@linuxbox ~]$ xlogo &
[1] 13608
[me@linuxbox ~]$ kill -SIGINT 13608
[1]+ Interrupt xlogo
进程（与文件类似）具有所有者（owner），并且必须是进程的所有者（或超级用户），才能通过kill发送信号。下面还有一些常用的信号：
Table 10-5: Other Common Signals
| Number | Name | Meaning |
|---|---|---|
| 3 | QUIT | Quit |
| 11 | SEGV | Segmentation violation. This signal is sent if a program makes illegal use of memory; that is, it tried to write somewhere it was not allowed to。 |
| 20 | TSTP | Terminal stop. This is the signal sent by the terminal when CTRL-Z is pressed. Unlike the STOP signal, the TSTP signal is received by the program but the pro-gram may choose to ignore it。 |
| 28 | WINCH | Window change. This is a signal sent by the system when a window changes size. Some programs, like top and less, will respond to this signal by redrawing themselves to fit the new window dimensions. |
可以使用kill -l来查看所有的信号：
[me@linuxbox ~]$ kill -l
使用 killall 向多个进程发送信号
也可以使用 killall 命令将信号发送到与指定程序或用户名匹配的多个进程：
killall [-u user] [-signal] name...
下面是例子：
[me@linuxbox ~]$ xlogo &
[1] 18801
[me@linuxbox ~]$ xlogo &
[2] 18802
[me@linuxbox ~]$ killall xlogo
[1]- Terminated xlogo
[2]+ Terminated xlogo
首先启动了两个xlogo进程，接着使用 killall 将默认的 KILL 信号发送给这两个进程。与 kill 一样，必须具有超级用户特权才能将信号发送到不属于此用户的进程。
2.6 更多与进程相关的命令
Table 10-6: Other Process-Related Commands
| Command | Description |
|---|---|
| pstree | Outputs a process list arranged in a tree-like pattern showing the parent/child relationships between processes. |
| vmstat | Outputs a snapshot of system resource usage including memory, swap, and disk I/O. To see a continuous display, follow the command with a time delay (in seconds) for updates (e.g., vmstat 5). Terminate the output with CTRL-C. |
| xload | A graphical program that draws a graph showing system load over time. |
| tload | Similar to the xload program, but draws the graph in the terminal. Terminate the output with CTRL-C. |
