3.3. Process and Job Management

Every running program is a process. Processes consume CPU, memory, and file descriptors. Runaway processes fill disk, starve other services of CPU, or hold locks that prevent clean operation. Process management is one of the highest-frequency troubleshooting skills on the exam — almost every performance or service problem begins with identifying what is running and why.

💡 First Principle: Every process has a PID (Process ID) and a PPID (Parent Process ID). When a process creates a child (via fork()), the child inherits the parent's environment, open file descriptors, and signal handlers. When the parent dies before the child, the child becomes an orphan and is re-parented to systemd (PID 1). When a child dies before the parent calls wait(), it becomes a zombie — consuming a PID slot but no CPU or memory.

⚠️ Common Misconception (M3): kill -9 feels like the most powerful and reliable way to terminate a process. In practice, SIGKILL bypasses all application-level cleanup — the kernel does close file descriptors and release memory, but temporary files persist, database write caches go unflushed, and advisory locks remain held. Always try SIGTERM (15) first and wait a few seconds. Use SIGKILL only when SIGTERM doesn't work.