Lion Cipher Lab

Linux processes, jobs, and signals: ps, top, kill, and job control

• Foundations
• Beginner
• ~40 min
• Free · no account required

Why it matters

Almost everything you will ever do at a Linux command line is really you starting, watching, pausing, resuming, and stopping PROCESSES — running programs the kernel tracks by number. Yet most people learn the terminal without ever learning the model underneath it, so they hit walls that feel like magic: a program freezes and Ctrl-C does nothing, a long download dies the instant they close the laptop, a server 'won't die' so they smash `kill -9` and later find corrupt files and stuck locks. Every one of those is a process-and-signals problem, and once you hold the model they stop being…

What you'll learn

• explaining what a process is — a running program the kernel tracks by a numeric PID (process ID), with a PPID (parent process ID) linking it to the process that started it, forming the parent/child tree you see in ps and top
• listing and reading running processes with `ps aux` and `ps -ef`, understanding each is just a different column layout for the same data, and finding a process by name with pgrep instead of eyeballing a huge list
• watching processes live with top (and htop if installed) — reading CPU%, MEM%, and the PID column, and spotting a runaway process that is pinning a core
• using shell job control: running a command in the background with &, suspending the foreground job with Ctrl-Z, listing jobs with `jobs`, and resuming a job in the foreground (fg) or background (bg)
• keeping a background job alive after you log out with nohup or disown, and explaining WHY a plain background job dies on logout — the shell sends SIGHUP to its children when the terminal closes
• explaining what a signal is (a small numbered message the kernel delivers to a process) and the difference between SIGINT (Ctrl-C, polite interrupt), SIGTERM (default `kill`, polite 'please exit'), SIGKILL (`kill -9`, forced, uncatchable), SIGHUP (hang-up), and SIGSTOP/SIGCONT (pause/resume)
• sending signals deliberately with `kill PID`, `kill -9 PID`, `kill -STOP`/`kill -CONT`, listing signal numbers with `kill -l`, and killing by name with pkill / killall
• writing a trap handler in a shell script so a process can catch SIGTERM/SIGINT and clean up (remove a lock file, flush state) before exiting — and proving that SIGKILL cannot be trapped
• applying the pro shutdown discipline — send SIGTERM, give the process a moment to clean up, and only escalate to SIGKILL if it refuses — and explaining why `kill -9` as a first move leaves orphaned locks, temp files, and corrupt state

Steps in this lab

1. What a process actually is — PID, PPID, and the family tree
2. Open a terminal and see your own processes
3. Watch processes live with top (and htop)
4. Job control: background with &, suspend with Ctrl-Z, jobs / fg / bg
5. What a signal is — and sending SIGTERM, SIGKILL, SIGSTOP with kill
6. Why background jobs die on logout — and nohup / disown
7. trap: let a process catch SIGTERM and clean up — and prove SIGKILL can't be trapped
8. The pro move: SIGTERM first, SIGKILL only if it won't die

Open the full interactive lab →