process-management-and-system-monitoring - linux-and-shell-scripting Interview Questions | Preplance

1. What does the ps aux command display?

Difficulty: EasyType: MCQTopic: Process Monitoring

The ps aux command displays a comprehensive list of all running processes from all users with detailed information. The 'a' option shows processes for all users, 'u' provides user-oriented format with additional details, and 'x' includes processes not attached to a terminal (daemon processes and background jobs). The output includes USER (process owner), PID, %CPU (CPU usage), %MEM (memory usage), VSZ (virtual memory size), RSS (resident set size - physical memory), TTY (controlling terminal), STAT (process state), START (start time), TIME (cumulative CPU time), and COMMAND (command that started the process). Common usage patterns include ps aux | grep processname to find specific processes, ps aux --sort=-%mem to sort by memory usage, or ps aux --sort=-%cpu to sort by CPU usage. Understanding ps aux is essential for monitoring system performance, identifying resource-hungry processes, and troubleshooting issues in production environments.

2. What does the & symbol do when appended to a command?

Difficulty: MediumType: MCQTopic: Job Control

The & symbol at the end of a command runs it in the background, immediately returning control to the terminal so you can continue working. The shell displays a job number and PID when the background job starts. Example: long_running_command & starts the command in the background. Use jobs command to list background jobs, fg %jobnumber to bring a background job to foreground, and bg %jobnumber to resume a stopped background job. Press Ctrl+Z to suspend a foreground process, then use bg to continue it in the background. This workflow allows managing multiple tasks in a single terminal. Note that background jobs still send output to the terminal, which can be disruptive. Redirect output to files: command > output.log 2>&1 & sends both stdout and stderr to a file. For persistent background jobs that survive terminal closure, use nohup: nohup command & prevents the job from receiving SIGHUP when the terminal closes. Understanding background jobs is crucial for running long tasks like backups, data processing, or monitoring scripts without blocking your terminal. Combined with nohup, screen, or tmux, you can manage long-running processes effectively on remote servers.

3. What is the purpose of the nohup command?

Difficulty: MediumType: MCQTopic: Job Control

Nohup (no hangup) runs a command immune to the HUP (hangup) signal, allowing it to continue running even after the terminal session ends or SSH connection drops. When you close a terminal, it normally sends SIGHUP to all child processes, terminating them. Nohup prevents this, making processes persist. Syntax: nohup command & runs the command in the background, immune to hangups. By default, nohup redirects output to nohup.out in the current directory. Specify custom output: nohup command > custom.log 2>&1 & redirects both stdout and stderr to a custom log file. This is essential for long-running tasks on remote servers. Nohup is commonly used for processes that must continue running after you log out, like data migrations, backups, batch processing, or monitoring scripts. For more advanced session management with the ability to reattach and view running processes, consider using screen or tmux instead of nohup. Understanding nohup is crucial for DevOps and system administration, particularly when running maintenance tasks, deployments, or batch jobs on remote servers where network disconnections are possible. It ensures critical processes complete even if your SSH session is interrupted.

4. What do the three numbers in load average represent?

Difficulty: MediumType: MCQTopic: System Monitoring

Load average shows the average number of processes in the run queue (ready to run or waiting for resources) over 1, 5, and 15 minute intervals. The uptime command displays these three numbers. For example, 'load average: 2.50, 1.80, 1.20' means 2.50 processes in queue over 1 minute, 1.80 over 5 minutes, and 1.20 over 15 minutes. Interpret load average relative to CPU cores: on a system with 4 cores, load average of 4.0 means full utilization, below 4.0 means idle capacity, and above 4.0 means processes are waiting. A load of 8.0 on a 4-core system indicates significant queuing. Trending is important: increasing load suggests growing demand, decreasing load suggests stabilizing. High load average indicates system stress from CPU-intensive processes, I/O wait (disk or network bottlenecks), or too many processes competing for resources. Use top, ps, or iostat to identify the cause. Understanding load average helps assess system health, capacity planning, and troubleshooting performance issues in production environments.

5. Compare different system monitoring tools: top, htop, vmstat, iostat, and sar. When should you use each tool?

Difficulty: MediumType: SubjectiveTopic: Process Monitoring

Top provides real-time process monitoring and system resource overview, showing CPU usage, memory usage, and processes sorted by resource consumption. It's the most common tool for quick system checks and identifying resource hogs. Use top for interactive process monitoring, finding high CPU/memory processes, and getting overall system health snapshot. Htop is an enhanced top with color coding, mouse support, horizontal/vertical scrolling, tree view of processes, and easier process management. It's more user-friendly but not always installed by default. Use htop when available for better visualization and easier process navigation, especially in complex process hierarchies. Vmstat (virtual memory statistics) reports process, memory, paging, block I/O, traps, and CPU activity. Run vmstat 5 for updates every 5 seconds. Focus on columns: r (processes waiting for CPU), b (blocked processes), swpd (swap usage), si/so (swap in/out), bi/bo (blocks in/out), us/sy/id/wa (CPU time breakdown). Use vmstat for identifying memory pressure, swap activity, and CPU bottlenecks over time. Iostat (I/O statistics) reports CPU and I/O statistics for devices and partitions. Run iostat -x 5 for extended statistics every 5 seconds. Key metrics: %util (device utilization), await (average wait time), svctm (service time). Use iostat for diagnosing disk I/O bottlenecks, identifying slow disks, and understanding I/O patterns. Sar (System Activity Reporter) collects and reports system activity over time, storing historical data. Use sar for analyzing performance trends, post-mortem analysis, and capacity planning. Each tool provides different perspective on system performance.

6. Explain process priority, nice values, and the renice command. How do you manage process priorities in Linux?

Difficulty: HardType: SubjectiveTopic: Process Priority

Process priority in Linux is controlled by nice values ranging from -20 (highest priority) to 19 (lowest priority). Default nice value is 0. Lower nice values mean higher priority - the process gets more CPU time. The name 'nice' reflects that higher values are 'nicer' to other processes by taking less CPU. Start processes with specific nice value using nice command: nice -n 10 command starts with nice value 10 (lower priority). Only root can set negative nice values (higher priority): nice -n -5 command. This prevents regular users from prioritizing their processes over system processes. Change running process priority with renice: renice -n 5 -p PID sets PID's nice value to 5, or renice -n 5 -u username changes all processes for username. In top, press 'r' then enter PID and new nice value. Regular users can only increase nice values (reduce priority) of their processes, while root can set any value. Use cases: background batch jobs get nice value 10-19 to avoid impacting interactive processes, critical services get nice value -10 to -5 for higher priority, and CPU-intensive tasks like rendering or compilation get higher nice values. Understanding nice values helps optimize resource allocation and prevent low-priority tasks from starving high-priority processes on busy systems.

7. How do you troubleshoot high CPU usage or memory issues? Describe the steps and commands you would use to identify and resolve the problem.

Difficulty: HardType: SubjectiveTopic: Process Monitoring

Start with top or htop to identify processes consuming high CPU or memory. Press M in top to sort by memory, P for CPU. Note the PID and %CPU/%MEM values. For CPU issues, look for processes with consistently high CPU usage. For memory, check both RSS (resident memory) and VIRT (virtual memory) in ps aux output. Investigate specific process: ps aux | grep PID shows details, cat /proc/PID/status shows comprehensive status including memory breakdown, cat /proc/PID/cmdline shows full command. Check open files with lsof -p PID to see if process has too many open files. Use pmap PID to view detailed memory mapping and identify memory hogs. For CPU issues: strace -p PID shows system calls, identifying what the process is doing. If looping, look for repeated calls. pstack PID (or gstack) shows call stack for debugging where process is stuck. Check if CPU spike is legitimate (processing) or a bug (infinite loop). Review application logs for errors or warnings. For memory issues: check if it's a memory leak by monitoring memory growth over time: watch -n 10 'ps aux | grep PID'. Review application logs for OutOfMemoryError or similar. Check swap usage with free -h and vmstat - high swap indicates insufficient RAM. If memory leak suspected, restart the application and monitor, potentially after enabling memory profiling. Resolution steps: restart misbehaving process if safe, investigate application logs for root cause, apply limits with ulimit or systemd if process consumes excessive resources, optimize application if performance issue is legitimate, or add resources (CPU/RAM) if system is underpowered. Document findings and solutions for future reference.

8. What is the difference between kill, killall, and pkill commands?

Difficulty: MediumType: MCQTopic: Process Signals

Kill sends signals to processes specified by PID. Basic syntax is kill PID or kill -SIGNAL PID. Without specifying a signal, it sends SIGTERM (15) for graceful termination. Use kill -9 PID (SIGKILL) for forceful termination when processes don't respond to SIGTERM. You must know the exact PID to use kill. Killall terminates all processes matching a given process name. Syntax: killall processname kills all processes named processname. It's more convenient than kill when multiple instances are running, like killall firefox kills all Firefox processes. Use -u option to kill processes for specific user: killall -u username processname. Pkill uses pattern matching and additional criteria like user, terminal, or command pattern. Syntax: pkill pattern kills processes matching the pattern. Example: pkill -u username firefox kills Firefox processes for specific user. Pkill is most flexible, allowing combinations like pkill -t pts/0 to kill processes on specific terminal. Understanding these tools helps manage processes efficiently in different scenarios.

9. Explain the different process states in Linux (running, sleeping, stopped, zombie). How do you identify and handle zombie processes?

Difficulty: HardType: SubjectiveTopic: Process Basics

Linux processes exist in several states visible in ps or top output. Running (R) means the process is executing or ready to execute on CPU. Sleeping includes interruptible sleep (S) where process waits for events like I/O and can be interrupted by signals, and uninterruptible sleep (D) where process waits for I/O and cannot be interrupted, often indicating disk or network issues. Stopped (T) means the process is suspended, typically by Ctrl+Z or a STOP signal. Continue with fg, bg, or CONT signal. Zombie (Z) means the process has finished but hasn't been reaped by its parent - the process table entry remains until the parent calls wait() to collect the exit status. Zombies consume minimal resources (just the process table entry) but indicate parent process issues. Identify zombies with ps aux | grep Z or ps -eo pid,ppid,state,cmd | grep '^[^ ]* [^ ]* Z'. Zombies can't be killed directly since they're already dead. The solution is to kill the parent process, forcing the zombie to be inherited by init/systemd which will reap it. Find parent: ps -o ppid= -p ZOMBIE_PID, then kill PPID. Persistent zombies indicate bugs in parent process not properly handling child termination. Well-written programs call wait() or use signal handlers (SIGCHLD) to reap children. In production, monitor for zombie accumulation as it indicates application issues. Understanding process states helps troubleshoot application behavior, hung processes, and resource issues.

10. Explain screen and tmux for terminal multiplexing. What are their key features and use cases?

Difficulty: HardType: SubjectiveTopic: Job Control

Screen and tmux are terminal multiplexers allowing multiple terminal sessions in one window, with the crucial ability to detach sessions that continue running and reattach later. This is invaluable for long-running tasks on remote servers - if SSH disconnects, your processes keep running and you can reattach to see their status. Screen basics: start with screen, detach with Ctrl+A then D, list sessions with screen -ls, reattach with screen -r. Create named sessions: screen -S sessionname. Within screen, Ctrl+A then C creates new window, Ctrl+A then N cycles windows, Ctrl+A then number switches to specific window. Split screen: Ctrl+A then S (horizontal) or Ctrl+A then | (vertical). Tmux is more modern with similar functionality: start with tmux, detach with Ctrl+B then D, list with tmux ls, attach with tmux attach -t sessionname. Create panes: Ctrl+B then % (vertical split) or Ctrl+B then " (horizontal split). Navigate panes: Ctrl+B then arrow keys. Tmux has better pane management, scripting support, and status bars. Use cases: running builds or deployments that take hours on remote servers, maintaining IRC or chat sessions, pair programming with shared sessions (screen -x or tmux attach), monitoring logs while working in another window, and ensuring work isn't lost during network interruptions. Essential tools for anyone working with remote Linux servers.

11. Explain the /proc filesystem in Linux. What information does it provide and how do you use it for process and system monitoring?

Difficulty: HardType: SubjectiveTopic: Process Basics

The /proc filesystem is a virtual filesystem providing an interface to kernel data structures, appearing as files and directories but existing only in memory. Each running process has a directory /proc/PID containing detailed process information. /proc also contains system-wide information files for hardware, memory, CPU, and kernel parameters. Process-specific files in /proc/PID include: cmdline (command with arguments), environ (environment variables), exe (symlink to executable), cwd (current working directory), fd/ (open file descriptors), status (detailed status including memory usage, UIDs, GIDs), limits (resource limits), and maps (memory mappings). Example: cat /proc/1234/cmdline shows the command for PID 1234. System-wide files include: /proc/cpuinfo (CPU details), /proc/meminfo (memory details more complete than free), /proc/version (kernel version), /proc/uptime (system uptime), /proc/loadavg (load average), /proc/mounts (mounted filesystems), /proc/net/ (network statistics), and /proc/sys/ (tunable kernel parameters). Practical usage: cat /proc/meminfo | grep MemAvailable checks available memory, cat /proc/cpuinfo | grep processor | wc -l counts CPU cores, cat /proc/PID/status | grep VmRSS shows process memory usage. Write to /proc/sys to tune kernel parameters: echo 1 > /proc/sys/net/ipv4/ip_forward enables IP forwarding. Understanding /proc enables low-level system inspection and tuning without external tools.

12. What are best practices for monitoring processes in production environments? Discuss proactive monitoring and alerting strategies.

Difficulty: MediumType: SubjectiveTopic: Process Monitoring

Implement automated monitoring using tools like Prometheus, Nagios, or Datadog that continuously collect metrics (CPU, memory, disk, network) and alert when thresholds are exceeded. Set up alerts for critical metrics: CPU usage > 80%, memory usage > 90%, disk usage > 85%, load average > number of cores, and process count anomalies. Monitor process-specific metrics: check that critical services are running with pidof or systemctl status, monitor process restart counts indicating instability, track resource consumption trends for capacity planning, and set up health checks for application endpoints. Use cron jobs or systemd timers for periodic checks if dedicated monitoring tools aren't available. Log aggregation and analysis: centralize logs with ELK stack, Splunk, or CloudWatch, monitor error rates and patterns, set up alerts for critical log patterns like OutOfMemoryError or connection timeouts, and retain historical data for trend analysis and incident investigation. Proactive strategies: establish baseline metrics for normal operation to detect anomalies, implement resource limits with ulimit or cgroup to prevent runaway processes from affecting the system, use process supervisors like systemd or supervisord to automatically restart failed processes, and regularly review and tune monitoring thresholds based on actual incidents to reduce false positives. Document runbooks for common issues: high CPU resolution steps, memory leak troubleshooting, process stuck in D state handling, and zombie process cleanup. Automate remediation where safe: automatic service restart on failure, clearing temp directories, or releasing file handles. Balance automation with safety to prevent cascading failures from automated actions.

13. What is a PID in Linux?

Difficulty: EasyType: MCQTopic: Process Basics

PID (Process ID) is a unique numerical identifier assigned to every running process in Linux. PIDs are assigned sequentially starting from 1, which is always the init or systemd process (the first process started by the kernel). When a process terminates, its PID can be reused for new processes. Every process has a PID and a PPID (Parent Process ID) indicating which process created it. The ps command shows PIDs, and many system commands accept PIDs as arguments for operations like killing processes, changing priorities, or monitoring specific processes. Understanding PIDs is fundamental for process management. You can find a process's PID using commands like ps aux | grep processname, pgrep processname, or pidof processname. The special file /proc/PID contains detailed information about each process. PIDs are essential for system administration, troubleshooting, and process control in Linux environments.

14. What does the free -h command show?

Difficulty: EasyType: MCQTopic: System Monitoring

The free command displays memory usage information including total, used, free, shared, buff/cache, and available memory. The -h flag shows values in human-readable format using KB, MB, GB units instead of raw bytes, making it easier to understand at a glance. Free shows both physical RAM and swap space. The 'available' column indicates memory available for starting new applications without swapping, considering that cached memory can be reclaimed. The buff/cache column shows memory used by kernel buffers and page cache, which can be freed if applications need it. Common options include free -m (megabytes), free -g (gigabytes), free -s N (continuous updates every N seconds), and free -t (show totals). Example: free -h -s 5 displays human-readable memory stats updating every 5 seconds, useful for monitoring memory during operations. Understanding free is essential for troubleshooting memory issues, capacity planning, and performance optimization. High swap usage indicates insufficient RAM, while high buff/cache is normal and beneficial. Monitoring memory helps prevent OOM (Out Of Memory) killer from terminating processes unexpectedly.

15. Explain common Linux signals (SIGTERM, SIGKILL, SIGHUP, SIGINT, SIGSTOP). When should you use each signal?

Difficulty: HardType: SubjectiveTopic: Process Signals

SIGTERM (15) is the default termination signal sent by kill command without arguments. It requests graceful shutdown, allowing the process to clean up resources, close files, save state, and exit cleanly. Well-behaved applications catch SIGTERM, perform cleanup, and exit. Use SIGTERM first when stopping processes to avoid data corruption or resource leaks. SIGKILL (9) forcefully terminates processes immediately without allowing cleanup. The process cannot catch or ignore SIGKILL - the kernel terminates it immediately. Use SIGKILL only as last resort when SIGTERM fails or for unresponsive processes. Warning: SIGKILL can cause data loss, incomplete transactions, or resource leaks since processes can't clean up. SIGHUP (1) originally meant hangup (terminal disconnection) but is commonly used to tell daemons to reload configuration without restarting. Many services like nginx, apache, and sshd reload config on SIGHUP: kill -HUP PID or killall -HUP nginx. This allows updating configuration without downtime. SIGINT (2) is sent by Ctrl+C, requesting interrupt. Like SIGTERM, it allows cleanup but is typically sent interactively. SIGSTOP (19) suspends process execution (can't be caught), while SIGCONT (18) resumes. Use kill -STOP PID to pause process, kill -CONT PID to resume. Understanding signals is essential for proper process management, service restarts, and troubleshooting stuck processes.

16. Explain job control in Linux shells. How do you manage foreground and background jobs, suspend and resume processes?

Difficulty: MediumType: SubjectiveTopic: Job Control

Job control allows managing multiple processes from a single shell, switching between foreground and background execution. Start commands in background with &: command & returns control immediately. The shell assigns job number [1], [2], etc., and shows PID. Use jobs command to list jobs with status (Running, Stopped, Done) and job numbers. Suspend foreground process with Ctrl+Z, which sends SIGTSTP (terminal stop). The process stops and control returns to shell, showing '[1]+ Stopped command'. Resume in foreground with fg %jobnumber or just fg for most recent job. Resume in background with bg %jobnumber, making the stopped job continue in background. Job specifiers: %1 (job number 1), %% or %+ (current job), %- (previous job), %?str (job whose command contains str), %command (job whose command starts with command). Examples: fg %2 brings job 2 to foreground, kill %1 kills job 1. Without %, shell interprets numbers as PIDs not job numbers. Practical workflow: start long compilation in foreground, press Ctrl+Z to suspend, run bg to continue in background, start another command in foreground. Use jobs to check status, fg %1 to bring back first job when ready to check it. This enables parallel work without multiple terminals. Understanding job control improves productivity on remote servers with limited terminal access.

17. What does the top command do?

Difficulty: MediumType: MCQTopic: Process Monitoring

Top provides a dynamic, real-time view of running processes and system resource usage. It updates every few seconds showing CPU usage, memory usage, swap usage, running processes sorted by resource consumption. The top section shows system summary including uptime, load average, total/running/sleeping/stopped processes, and CPU/memory statistics. Interactive commands within top include: k to kill processes, r to renice (change priority), M to sort by memory usage, P to sort by CPU usage, u to filter by user, c to show full command paths, and q to quit. Use top -u username to show processes for specific user, or top -p PID1,PID2 to monitor specific processes. Top is invaluable for performance monitoring, identifying resource bottlenecks, finding runaway processes, and troubleshooting performance issues. Alternatives include htop (more user-friendly with colors and mouse support) and atop (advanced metrics). Understanding top is essential for system administrators and DevOps engineers managing Linux servers.

Master Interviews
Anywhere, Anytime

Process Management & System Monitoring – Linux & Shell Scripting interview questions

Set overview

Linux & Shell Scripting – Process Management & System Monitoring questions (17)

1. What does the ps aux command display?

Continue your preparation

2. What does the & symbol do when appended to a command?

3. What is the purpose of the nohup command?

4. What do the three numbers in load average represent?

5. Compare different system monitoring tools: top, htop, vmstat, iostat, and sar. When should you use each tool?

6. Explain process priority, nice values, and the renice command. How do you manage process priorities in Linux?

7. How do you troubleshoot high CPU usage or memory issues? Describe the steps and commands you would use to identify and resolve the problem.

8. What is the difference between kill, killall, and pkill commands?

9. Explain the different process states in Linux (running, sleeping, stopped, zombie). How do you identify and handle zombie processes?

10. Explain screen and tmux for terminal multiplexing. What are their key features and use cases?

11. Explain the /proc filesystem in Linux. What information does it provide and how do you use it for process and system monitoring?

12. What are best practices for monitoring processes in production environments? Discuss proactive monitoring and alerting strategies.

13. What is a PID in Linux?

14. What does the free -h command show?

15. Explain common Linux signals (SIGTERM, SIGKILL, SIGHUP, SIGINT, SIGSTOP). When should you use each signal?

16. Explain job control in Linux shells. How do you manage foreground and background jobs, suspend and resume processes?

17. What does the top command do?

More sets in Linux & Shell Scripting

Explore related subjects

Master Interviews Anywhere, Anytime

Process Management & System Monitoring – Linux & Shell Scripting interview questions

Set overview

1. What does the ps aux command display?

Continue your preparation

2. What does the & symbol do when appended to a command?

3. What is the purpose of the nohup command?

4. What do the three numbers in load average represent?

5. Compare different system monitoring tools: top, htop, vmstat, iostat, and sar. When should you use each tool?

6. Explain process priority, nice values, and the renice command. How do you manage process priorities in Linux?

7. How do you troubleshoot high CPU usage or memory issues? Describe the steps and commands you would use to identify and resolve the problem.

8. What is the difference between kill, killall, and pkill commands?

9. Explain the different process states in Linux (running, sleeping, stopped, zombie). How do you identify and handle zombie processes?

10. Explain screen and tmux for terminal multiplexing. What are their key features and use cases?

11. Explain the /proc filesystem in Linux. What information does it provide and how do you use it for process and system monitoring?

12. What are best practices for monitoring processes in production environments? Discuss proactive monitoring and alerting strategies.

13. What is a PID in Linux?

14. What does the free -h command show?

15. Explain common Linux signals (SIGTERM, SIGKILL, SIGHUP, SIGINT, SIGSTOP). When should you use each signal?

16. Explain job control in Linux shells. How do you manage foreground and background jobs, suspend and resume processes?

17. What does the top command do?

More sets in Linux & Shell Scripting

Explore related subjects

Master Interviews
Anywhere, Anytime