Understanding Linux Processes

Understanding Linux Processes

A process is a running instance of a program. Every command you run in the terminal, every service started by systemd, and every background daemon on Ubuntu is a process. Understanding how processes are structured — their hierarchy, identifiers, memory layout, and environment — is fundamental to diagnosing problems, understanding resource usage, and managing a server effectively.

What is a process

A process consists of:
  Program code (text segment)     — the executable instructions
  Data (data/BSS/heap segments)   — global variables, dynamic allocations
  Stack                           — local variables, function call frames
  File descriptors                — open files, sockets, pipes
  Environment variables           — inherited from parent
  Process credentials             — UID, GID, supplementary groups
  Signal handlers                 — what to do when signals arrive
  Virtual memory mappings         — which physical memory pages are mapped
  PID, PPID, PGID, SID            — process identity

Process hierarchy

Linux processes form a tree. Every process (except PID 1) has a parent. When you open a terminal and run a command, the terminal is the parent of the command process.

PID 1: systemd (init — the ancestor of all processes)
  ├── sshd (SSH daemon)
  │     └── sshd (child for your connection)
  │           └── bash (your shell)
  │                 └── top (command you ran)
  ├── nginx
  │     ├── nginx worker 1
  │     └── nginx worker 2
  └── cron

# View the full process tree
pstree
pstree -p    # Show PIDs
pstree -u    # Show users
pstree irfan # Show only irfan's process tree

Process identifiers

# Find your shell's PID
echo $$

# Show a process's complete identity
cat /proc/$$/status | grep -E "Pid|PPid|Uid|Gid|Name"

Output from /proc/PID/status

Name:   bash
Pid:    12345
PPid:   12300
Uid:    1001    1001    1001    1001
Gid:    1001    1001    1001    1001

Process memory layout

# View a process's memory map
cat /proc/$(pidof nginx | awk '{print $1}')/maps | head -20

# View memory usage summary
cat /proc/$(pidof mysqld)/status | grep -E "VmRSS|VmSize|VmSwap"

Process memory status fields

VmSize:  524288 kB   ← Virtual memory size (includes mapped but not loaded)
VmRSS:    65536 kB   ← Resident Set Size: actually in RAM right now
VmSwap:       0 kB   ← Pages currently swapped out

Process environment

# View environment variables of a running process
sudo strings /proc/PID/environ | sort

# Or with xargs for cleaner output
sudo xargs --null --show-limits < /proc/PID/environ 2>/dev/null | head -20

# View your current shell's environment
env | sort | head -20

# View a specific variable for a running process
sudo strings /proc/$(pidof nginx | awk '{print $1}')/environ | grep PATH

Viewing process details

# Everything about a process in /proc/PID/
ls /proc/$$
# Key files:
# cmdline   — exact command used to start the process
# status    — human-readable process information
# maps      — memory map
# fd/       — file descriptors (open files, sockets)
# environ   — environment variables
# cwd       — working directory (symlink)
# exe       — executable (symlink)

# View command a process was started with
cat /proc/$(pidof sshd | awk '{print $1}')/cmdline | tr '' ' '

# View open file descriptors
ls -la /proc/$(pidof mysqld)/fd | head -20

Conclusion

Every process on Ubuntu is a tree node descended from PID 1 (systemd). The /proc filesystem is the canonical source of process information — tools like ps, top, and lsof read from it. Understanding PIDs, PPIDs, and process groups helps when using signals (kill sends to a PID, killall to a process group), debugging process relationships, and understanding why killing one process kills its children. Monitor RSS (resident set size) for actual memory usage, not virtual size which is often misleadingly large.