Linux Process States

List of Topics

1) List of Linux process states
2) Special symbol process states
3) Sample PS Command output

1) List of Linux process states

In Linux we have below process state's, which we can see as a part of TOP command output. Some of the main Process states and its symbol how it is displayed in the TOP command.

D - Process in uninterruptible sleep

R - Running process

S - Interruptible sleep (waiting for an event to complete)

T - Stopped, either by a job control signal or because it is being traced.

W - paging (not valid since the 2.6.xx kernel)

X - dead (should never be seen)

Z - Defunct ("zombie") process, terminated but not reaped by its parent.

2) Special symbol process states

Apart from regular process states we can see below special characters also in process states. Below are the explanation for the special symbol process states:

< - high-priority (not nice to other users)

N - low-priority (nice to other users)

L - has pages locked into memory (for real-time and custom IO)

s - is a session leader

l - is multi-threaded 

+ - is in the foreground process group 


3) Sample PS Command output

The states of the process can be identified from ps command output from STAT field. Below is the sample output of ps command. In the STAT field we can see the characters which we have explained in the previous section. 

[test@XXXXX ~]# ps aux

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND

root         1  0.0  0.0  10372   572 ?        Ss    2016   0:10 init [3]

root         2  0.0  0.0      0     0 ?        S<    2016   0:11 [migration/0]

root         3  0.0  0.0      0     0 ?        SN    2016   0:00 [ksoftirqd/0]

root         4  0.0  0.0      0     0 ?        S<    2016   0:00 [watchdog/0]

root         5  0.0  0.0      0     0 ?        S<    2016   0:10 [migration/1]

root         6  0.0  0.0      0     0 ?        SN    2016   0:01 [ksoftirqd/1]

root         7  0.0  0.0      0     0 ?        S<    2016   0:00 [watchdog/1]

root         8  0.0  0.0      0     0 ?        S<    2016   0:01 [migration/2]

root         9  0.0  0.0      0     0 ?        SN    2016   0:01 [ksoftirqd/2]

root        10  0.0  0.0      0     0 ?        S<    2016   0:00 [watchdog/2]

root        11  0.0  0.0      0     0 ?        S<    2016   0:01 [migration/3]

root        12  0.0  0.0      0     0 ?        SN    2016   0:01 [ksoftirqd/3]

root        13  0.0  0.0      0     0 ?        S<    2016   0:00 [watchdog/3]

root        14  0.0  0.0      0     0 ?        S<    2016   0:01 [migration/4]

root        15  0.0  0.0      0     0 ?        SN    2016   0:01 [ksoftirqd/4]

NI is the nice value, which is a user-space concept. PR is the process's actual priority, as viewed by the Linux kernel.]

op, by default, lists both columns. I am curious as to what is the difference. I checked out the man pages and cannot figure it out:

Priority:

h: PR  --  Priority The priority of the task.

Nice value: NI  --  Nice value

T

he nice value of the task.  A negative nice value means higher  priority, whereas  a  positive  nice value means lower priority.  Zero in this field simply means priority will not be adjusted in determining  a  task’s  dispatchability.

I understand that Nice value is related to the Kernel's CPU scheduler queue; then what does Priority indicate? Something regarding I/O perhaps?

The difference is that PR is a real priority of a process at the moment inside of the kernel and NI is just a hint for the kernel what the priority the process should have.

In most cases PR value can be computed by the following formula: PR = 20 + NI. Thus the process with niceness 3 has the priority 23 (20 + 3) and the process with niceness -7 has the priority 13 (20 - 7). You can check the first by running command nice -n 3 top. It will show that top process has NI 3 and PR 23. But for running nice -n -7 top in most Linux systems you need to have root privileges because actually the lower PR value is the higher actual priority is. Thus the process with PR 13 has higher priority than processes with standard priority PR 20. That's why you need to be root. But minimum niceness value allowed for non-root process can be configured in /etc/security/limits.conf.

Theoretically the kernel can change PR value (but not NI) by itself. For example it may reduce the priority of a process if it consumes too much CPU, or it may increase the priority of a process if that process had no chance to run for a long time because of other higher priority processes. In these cases the PR value will be changed by kernel and NI will remain the same, thus the formula "PR = 20 + NI" will not be correct. So the NI value can be interpreted as hint for the kernel what the priority the process should have, but the kernel can choose real priority (PR value) on its own depending on the situation. But usually the formula "PR = 20 + NI" is correct.

The nice value is a "global" mechanism, whereas priority is relevant for the task switcher right now

Process

In computing, a process is an instance of a computer program that is being executed. Depending on the operating system (OS), a process may be made up of multiple threads of execution that execute instructions concurrently.

Parent Process

In the operating system Unix, every process except process 0 (the swapper) is created when another process executes the fork() system call. The process that invoked fork is the parent process and the newly-created process is the child process. Every process (except process 0) has one parent process, but can have many child processes.

The operating system kernel identifies each process by its process identifier. Process 0 is a special process that is created when the system boots; after forking a child process (process 1), process 0 becomes the swapper process (sometimes also known as the “idle task”). Process 1, known as init, is the ancestor of every other process in the system.

Child process

A child process in computing is a process created by another process (the parent process).

A child process inherits most of its attributes, such as open files, from its parent. In UNIX, a child process is in fact created (using fork) as a copy of the parent. The child process can then overlay itself with a different program (using exec) as required.

Each process may create many child processes but will have at most one parent process; if a process does not have a parent this usually indicates that it was created directly by the kernel. In some systems, including UNIX based systems such as Linux, the very first process (called init) is started by the kernel at booting time and never terminates (see Linux startup process); other parentless processes may be launched to carry out various daemon tasks in userspace. Another way for a process to end up without a parent is if its parent dies, leaving an orphan process; but in this case it will shortly be adopted by init.

System call fork() is used to create processes. The purpose of fork() is to create a new process, which becomes the child process of the caller.

Orphan Process

An orphan process is a computer process whose parent process has finished or terminated, though it remains running itself.

In a Unix-like operating system any orphaned process will be immediately adopted by the special init system process. This operation is called re-parenting and occurs automatically.
Even though technically the process has the init process as its parent, it is still called an orphan process since the process that originally created it no longer exists.

Daemon

A daemon is a computer program that runs as a background process, rather than being under the direct control of an interactive user. Typically daemon names end with the letter d: for example, syslogd is the daemon that implements the system logging facility and sshd is a daemon that services incoming SSH connections.

Daemon is usually created by a process forking a child process and then immediately exiting, thus causing init to adopt the child process. Daemon process is a process orphaned intentionally.

What is Zombie Process

Zombie process is a defunct process that has completed its execution but still has an entry in the process table. This entry is still needed to allow the parent process to read its child’s exit status. Also, unlike normal processes, the kill command has no effect on a zombie process.

When a process ends, all of the memory and resources associated with it are deallocated so they can be used by other processes. However, the process’s entry in the process table remains. The parent can read the child’s exit status by executing the wait system call, whereupon the zombie is removed. The wait call may be executed in sequential code, but it is commonly executed in a handler for the SIGCHLD signal, which the parent receives whenever a child has died.

Difference Between Zombie and Orphan

A zombie process is not the same as an orphan process. An orphan process is a process that is still executing, but whose parent has died. They do not become zombie processes; instead, they are adopted by init (process ID 1), which waits on its children.