Processes

Programs sit on disk. Maybe not run for years.
Process - An instance of the program running.

ps in Linux

Some scenarios:

1 user. 1 program. n processes.
- Example: Go on a lab PC with Linux GUI. Launch a bash shell. Launch a second bash shell.
- You get 1 program, 2 processes.
```
 ps -u $USER -f | grep bash 
```
- Both processes in memory space of the lab PC. But each process is protected from the other.
- Q. If you multiple launch gedit, do you get one process or two?
n users. Shared memory. 1 program. n processes.
- Example: Login to student server. Lots of users running nano.
```
 ps -Af | grep nano 
```
- 1 program. n processes. All running in memory space of student server. All protected from each other.
n users. Common file system but not shared memory. 1 program. n processes.
- Example: n users on lab PCs. Lots of users running a program from /users
- 1 program.
- All running the same copy from somewhere in /users
- n processes. Each in different memory space on its own PC.

Windows processes (Task Manager)

Task Manager on Windows.
Show information about running processes.
When system running slow, look for culprit.
Q. What are common culprits?
Sysinternals page at Microsoft has many tools to download, including:
- Process Explorer

List processes in Task Manager on Windows 10.
Can sort columns.
Shown here is sort by memory usage.

Right click - Resource values - Can show Percents instead of values

In the "Details" tab of Task Manager you can look at a range of features of each process.
Right click the top bar and "Select columns" to select the columns to show.
You can sort on any column.
Here sorted on Page faults.

Process State

Process state
Loaded from disk (permanent, power-off storage) into memory (RAM).
Recall Memory hierarchy

Starts running.
May pause when doing disk I/O, waiting on user event, etc. Does not always have work for CPU to do.
May pause for long time.

READY to RUNNING - Short-term (CPU) scheduler decides if you can run now.
RUNNING to WAITING - I/O or event wait.
WAITING to READY - I/O or event completion.

CPU scheduling (Time-slicing)

RUNNING to READY - Why stop a process that is happily running?
To allow the OS do something else with the CPU.
e.g. To allow the OS give CPU time to other process for a while.
This time-slicing by the Short-term (CPU) scheduler is how we run many processes at the same time.
Most processes look like:
```
Short period of calculation (short "CPU burst")
Long period of I/O
Short period of calculation 
Long period of I/O
..
```
i.e. Most processes regularly "vote themselves" off the Running list anyway. - We don't have to force them to go.

Swapping

It is often the case that processes are idle for a long time. e.g. A GUI process waiting on user input, that the user has not looked at in hours.
If running short on RAM, and process has not run for a long time, it may be removed from RAM to disk. (Or parts of it may.)
This is called Swapping to disk.
It is the running copy on disk. Not the same thing as the original program file.
If you click on the program again, there may be a delay as the OS gets it back from disk.
Swapping is integrated with Paging

Threads

Threads
2 (or more) flows of control in the same process. 2 (or more) instruction counters. Same memory (same data and code space).

e.g. Web server - Each request is a separate thread, all running in parallel until request completed.
e.g. Web browser - multiple windows downloading at same time. Each is a separate thread in same process.

On Linux, ps can list threads.

see all processes and threads:
 ps -ALf

LWP = thread id
note multiple threads within same process id PID
NLWP = no. of threads in this process

sort by processes with the most threads:
 ps -ALf | sort -k6 -n

show threads for one process:
 ps -Lf -p (PID)

Scheduling of threads: OS may do the CPU scheduling between threads (kernel-level threads).
Or program designer may implement their own (user-level threads).
Up to program designer to make sure threads don't interfere with each other (or at least, only interfere in the ways he intends). Maybe nice to have OS protect us against incompetent thread design, but how can it? Note OS does not (can not) protect against lots of types of incompetence, e.g. infinite loop.
Protection:
Threads - 1 user - 1 process - 1 author - friendly (though might be incompetent).
Processes - n users - n authors - hostile.

Multiple cores

Modern computers have multiple cores (multiple processing units, executing instructions in parallel).

Modern OS will schedule threads and processes across multiple cores.

Processor affinity - The idea that once a process or thread starts running on one core, it is often more efficient to leave it there (and its data in the core's cache memory) rather than change cores.

Cores on Linux

On Linux we can look at multiple core use from command-line using ps and top and other commands.


Display number of cores available:
=====================================
$ nproc
4


Show info about the multiple cores: 
=====================================
$ cat /proc/cpuinfo


Run process using core n (where n is 0 to 3 here):
===================================================
$ taskset -c n prog


See what processes are currently using what cores:
====================================================
$ ps -Ao user,pid,ppid,comm,psr 

USER       PID  PPID COMMAND         PSR
root         1     0 init              0
root         2     0 kthreadd          2
root         3     2 ksoftirqd/0       0
root        25     2 watchdog/3        3
root       328     1 udevd             3
humphrys 29858 29855 sshd              0
humphrys 29859 29858 csh               0
humphrys 32373 29859 ps                1
humphrys 32374 29859 grep              1

# PSR will be 0 to 3 here 


Query if process is bound to a core:
=======================================

$ taskset -p 3
pid 3's current affinity mask: 1

$ taskset -p 25
pid 25's current affinity mask: 8

# 0001 (1) - bound to core 0 (see process 3 command /0)
# 0010 (2) - bound to core 1
# 0100 (4) - bound to core 2
# 1000 (8) - bound to core 3 (see process 25 command /3)


$ taskset -p 1
pid 1's current affinity mask: f

# 1111 (f) - can run on all 4 cores, not tied to any core 


See load on different cores:
==============================
$ top
(and then press 1)

Event logging

Event logging: The OS logs (in a file) events connected to processes.

Event logging
Windows Event Viewer.
Windows Reliability Monitor - timeline of crashes.

Windows focus stealing (Example of using Event Viewer)

I had issue on Windows with hidden application stealing focus and returning it.
Installed Window Focus Logger
This told me the focus stealer was Werfault - Windows Error Reporting system.
This meant some application was constantly generating errors.
Event Viewer - Windows Logs - Application. This showed the application generating the errors.
Delete the application.

Unix/Linux logs

Unix syslog.
On Unix/Linux, various text and binary format logfiles are in:
```
 /var/log 
```
Text logfile example:
- fail2ban logfile is text format.
- On student server we used to be able to look at it, but not any more:
```
   tail -20 fail2ban.log 
```
Binary logfile examples: We can read the following files (all binary files, need to run certain programs to read them).
- faillog
- wtmp
- lastlog (see following)

lastlog - user logins on Unix/Linux

Record of user logins, stored in binary file:
```
/var/log/lastlog
```
Can see them with lastlog command. (Same name as file!)
All users who logged in in last 2 days:
```
lastlog -t 2 
lastlog -t 2 | sort -k4
```