Module 5: Process Management

What are three ways to view running processes in Windows?

• Task Manager (GUI)

• tasklist in Command Prompt

• Get-Process in PowerShell

Lab Activity:

• Open Task Manager, run tasklist in CMD, and use Get-Process in PowerShell to view running processes.

• Practice sorting by CPU or memory usage with Get-Process | Sort CPU -Descending | Select -First 3 -Property ID,ProcessName,CPU

How do you kill a process by its PID in Windows?

Use taskkill /pid [PID] in Command Prompt.

Lab Activity:

• Start Notepad, find its PID with tasklist, and terminate it with taskkill /pid [PID].

• Observe the process termination in Task Manager

What does ps -ef show on a Linux system?

Lists all running processes for all users with full details, including UID, PID, PPID, CPU usage, start time, TTY, and command.

Lab Activity:

• Run ps -ef on your Linux VM and interpret the output, identifying columns like PID, PPID, and CMD
  

How can you check if a process (e.g., Chrome) is running on Linux?

Use ps -ef | grep Chrome to search for the process in the list of running processes.

Lab Activity:

• Start a known process (like Firefox or Chrome), then search for it using ps -ef | grep [process name]

What does the top command show, and what is uptime used for?

• top displays real-time resource usage for processes (CPU%, MEM%, etc.).

• uptime shows current time, system uptime, number of users, and load averages.

Lab Activity:

• Run top and uptime on your Linux VM and interpret the results

What is the purpose of the /proc directory in Linux?

/proc contains a virtual filesystem providing process and kernel information; each running process has a directory named by its PID.

Lab Activity:

• List /proc and explore a process directory (e.g., /proc/[PID]) to see files like cmdline, status, and fd

What does the lsof command do?

Lists open files and the processes using them, useful for troubleshooting file locks and resource usage.

Lab Activity:

• Run lsof on your Linux VM and identify which processes are using a specific file or port

What is a signal in process management, and how do you send one in Linux?

• A signal is a message sent to a process to notify it of an event (e.g., SIGINT for interrupt, SIGTERM for termination).

• Use kill -SIGTERM [PID] to terminate, kill -SIGKILL [PID] for forced kill, kill -TSTP [PID] to suspend, and kill -CONT [PID] to continue a process.

Lab Activity:

• Start a process, use kill with different signals, and observe the effects. Try suspending and resuming a process with kill -TSTP and kill -CONT

What is the role of smss.exe and csrss.exe in Windows?

• smss.exe (Session Manager Subsystem) starts on boot and launches critical system processes.

• csrss.exe (Client Server Runtime) manages user-mode side of Win32 subsystem, including GUI and console.

• Note: csrss.exe is not equivalent to Linux init.

Lab Activity:

• Use Task Manager or tasklist to locate these processes and confirm their presence
  

What tool can IT support use to monitor process resource usage in Windows, and what is an alternative for more detail?

• Resource Monitor provides a graphical overview of process CPU, memory, disk, and network usage.

• Process Explorer (Sysinternals) gives deeper insight and advanced features.

Lab Activity:

• Open Resource Monitor and Process Explorer, compare the information provided, and identify top resource-consuming processes