Linux Processes & Signals: ps, top, kill, SIGTERM vs SIGKILL & /proc | Zero to LLMOps (Day 8)

Day 8 of a free 180-day DevOps course. Welcome to Week 2. Everything in Week 1 was about things that sit still — files, users, permissions, text. Today is about the machine when it is alive and executing. Half of production operations boils down to one sentence: "something is running that shouldn't be, or something isn't running that should." Today you master finding any process on a Linux box, checking its resource usage, inspecting its open files and listening ports, adjusting its priority, and shutting it down cleanly. What we cover today: • ps syntax decoded: BSD style (ps aux) for CPU and memory percentages vs System V style (ps -ef) for clear parent PID (PPID) ancestry. • Process states in STAT: R (running), S (sleeping — normal healthy state), D (uninterruptible sleep waiting on I/O — cannot be killed, not even with kill -9), T (stopped/suspended), and Z (zombie — dead process waiting to be reaped; fix the parent, not the zombie). • Live monitoring & process trees: top (press M to sort memory, P to sort CPU, 1 for per-core view) and pstree / ps -ef --forest tracing back to PID 1 (systemd). • Signals: asynchronous notifications delivered by the kernel. SIGTERM (15 — polite shutdown, catchable), SIGKILL (9 — brutal, uncatchable, unignorable, corrupts state), SIGHUP (1 — reload daemon configuration without dropping connections), SIGINT (2 — Ctrl-C). • Process termination: kill, killall, pkill, and the golden discipline: always run pgrep -af first to verify matches before shooting with pkill. • Signal trapping demo: trapdemo.sh catches SIGTERM and exits cleanly; kill -9 kills instantly in total silence. • kill -0: silent liveness and permission check without delivering an actual signal. • Process priority: nice values from -20 (highest priority/least nice) to 19 (lowest priority/most nice). The privilege boundary: only root can go negative. • Job control: running in background (&), listing jobs (jobs -l), suspending (Ctrl-Z), resuming (bg/fg), and surviving terminal logout with nohup and disown. • The /proc filesystem: kernel state exposed as files (/proc/PID/cmdline, environ, status, cwd, and fd/). • lsof forensics: listing open files for a process (lsof -p) and checking what service is listening on a network port (lsof -i :22). • 5 triage rules when an incident breaks at 2 AM. ⏱ Chapters 00:00 Intro: Welcome to Week 2 & Going Operational 01:05 Recall: sort/uniq Idiom, NF, -aG Trap & SGID 01:55 Hook: Inspecting PID 1 (systemd) 02:26 ps aux vs ps -ef (BSD vs System V Syntax) 03:27 Process States: R, S, D, T & Uninterruptible Sleep 05:24 Understanding Zombies & Why You Cannot Kill Them 06:10 top, pstree & ps -ef --forest 07:54 Signals: SIGTERM (15) vs SIGKILL (9) 09:36 SIGHUP (1), SIGINT (2) & kill -l 10:47 Process Termination: kill, killall & pkill 12:24 The pgrep -af Before pkill Discipline 12:55 Demo: Trapping SIGTERM vs Untrappable SIGKILL 13:38 kill -0: Silent Liveness Probing 14:38 Process Priority: Nice Values (-20 to 19) 16:03 Demo: nice, renice & Root Privilege Boundary 17:20 Job Control: Background (&), Suspend (Ctrl-Z), bg & fg 19:31 Surviving Logout: nohup vs disown 21:12 /proc Filesystem: Kernel State Exposed as Files 22:43 Inspecting /proc/PID: cmdline, environ, status & cwd 25:00 lsof: Listing Open Files & Sockets (lsof -p) 25:32 Finding What is Listening on a Port (lsof -i) 26:35 5 Troubleshooting Rules When Something Breaks at 2AM 29:22 Lab Part 1: ps & top Drills 31:25 Lab Part 2: Signal Trapping Drills (trapdemo.sh) 33:09 Lab Part 3: Priority & Job Control Drills 35:02 Lab Part 4: /proc & lsof Forensics 36:50 Groundwork for Day 12 systemd Service 37:45 Definition of Done, 6 Recall Questions & Day 9 Preview Definition of Done: 1. Can read and explain both ps aux and ps -ef columns and STAT letters. 2. Demonstrated SIGTERM being caught and SIGKILL being untrappable via trapdemo.sh. 3. Used nice and renice correctly and verified non-root denial on negative nice values. 4. Demonstrated job control (background, suspend, fg, bg, nohup, and disown). 5. Inspected /proc/PID/ internals and used lsof -i for port forensics. 📚 FREE COURSE MATERIAL — every lesson, lab and answer key: https://github.com/mahadikabhijeet/ze... All 185 written lessons, the labs, the answer keys, and self-paced study guides are on GitHub, free and open. You do not need the videos to follow the course. ◀ Previous — Day 7: Week 1 Review & Cumulative Quiz (Boot, Permissions, awk & Bash) ▶ Next — Day 9: Package Management (dnf, rpm, repos, groups & history rollback) 🔔 Subscribe for the full path from zero to LLMOps. #DevOps #Linux #LinuxTutorial #ZeroToLLMOps #LearnLinux #BashScripting #SystemAdmin #DevOpsCourse