Processes and Services

ps lists processes. On its own it shows only those in your own terminal; ps aux shows everything on the machine:

$ ps aux
USER   PID %CPU %MEM    VSZ   RSS TTY  STAT START  TIME COMMAND
root     1  0.0  0.4  21244 11520 ?    Ss   09:00  0:00 /sbin/init
gwen   412  0.0  0.1   7064  3712 pts/0 Ss  09:02  0:00 -bash

The columns you'll use most:

• USER: who the process runs as. It has that user's permissions.
• PID: the process ID, a unique number you use to refer to it.
• COMMAND: the program and its arguments, exactly as it was started.

ps aux cuts long lines off at the edge of your screen. Add ww (ps auxww) to see every command line in full. Pipe it into grep to pick out one program: ps auxww | grep ssh. Or use pgrep -af ssh, which searches the full command lines and prints each match with its PID. (Plain pgrep only looks at the program's name, and a program can run under a different name than you'd expect.)

top (or the friendlier htop, where installed) shows a live view, sorted by CPU use, that refreshes every few seconds. Press q to leave it.

One more thing: every user can see every process's command line. So a secret passed as a command-line argument, like --password=..., isn't secret at all.

kill sends a signal to a process, chosen by its PID:

$ kill 412          # politely ask it to stop (signal 15, TERM)
$ kill -9 412       # force it to stop, immediately (signal 9, KILL)

A process can catch TERM (15, the default) and tidy up before it exits, like saving files and closing connections. That's why you always try it first. KILL (9) can't be caught or ignored: the kernel ends the process on the spot, which can leave half-written files behind.

pkill NAME does the same by name instead of PID.

You can only signal your own processes. Trying to kill another user's process fails with Operation not permitted. Only root can stop anyone's.

Most modern Linux systems run their services with systemd, and you manage them with systemctl:

$ systemctl status ssh          # is it running? since when? recent log lines
$ sudo systemctl restart ssh    # stop and start it
$ sudo systemctl stop ssh
$ sudo systemctl enable ssh     # start it automatically at boot

status works for everyone. Starting, stopping and enabling services changes the system, so it needs root (hence sudo).

Services write their messages to the journal. journalctl reads it:

$ journalctl -u ssh             # everything the ssh service logged
$ journalctl -u ssh -n 20       # just the last 20 lines
$ journalctl -u ssh -f          # follow new messages as they arrive (Ctrl+C to stop)

systemd can also restart a service by itself if it dies. That's why killing a service's process often does nothing useful: a few seconds later, it's back.

Gwen's machine runs a service called ticker. Someone set it up in a hurry.

1. Press Launch in CybRange at the top of this page, then Open terminal next to box once it's ready. You're logged in as gwen.
2. Check on the service: systemctl status ticker, then journalctl -u ticker.
3. Look at its process: ps auxww | grep ticker. Who runs it, and what's on its command line?
4. Try to stop it with kill. What happens, and why?