pid becoming 1

[Shivkumar]

Hi,

One day i read a post on this forum that a process can't be killed if its pid becomes 1.

I couldn't understand in what situation a process can acquire pid number of 1.

I know only init deamon has pid of 1.

Can anyone explain how can a process achieve pid of 1 ?

Why some processes can't be killed with $kill -9 ?

Thanks,
Shiv

[Rajeev Shukla]

Yes you are right only init daemon has PID=1 and no other proccess can. I think your are mistaken with PID and Parent PID.
A proccess can aquire PPID=1 if it is started by init proccess or in some cases when their the parent proccess of the proccess gets killed then this running proccess PPID becomes 1. But never will a proccess other than init has PID=1

Second question..
Some proccess can not be killed with -9 option if they are waiting for some resource. Say some proccess is doing some IO, maybe writing for to disk and until it is completed the proccess wont get detached and killed.

[James R. Ferguson · Accepted solution]

Hi Shiv:

All processes must be associated with a parent. When a child process terminates (normally or abnormally) the parent process that spawned ("forked") it can check its status in the process table. A side-effect of the status check is that the pid of the child is removed from the system process table --- a very desirable thing, since the process table has a finite size. You will remember that the kernel parameter 'nfile' sets the overall number of slots in the process table.

If the parent process dies before its child, the responsibility of "reaping" (checking a child's status and removing its pid from the process table) is given to 'init' (whose pid=1). That is, the parent-less child process is adopted by 'init'.

Processes that are in kernel code or most notablly are waiting on an I/O, cannot be killed (even with the untrappable signal 9). For a proceess to be killed, it must first be able to run again.

Regards!

...JRF...

[Arunvijai_4]

Hi Shiv,

When a child process becomes orphan, its PPID will become 1. You can find more information at http://en.wikipedia.org/wiki/Orphan_process

-Arun

[Shivkumar]

James,

What are the commands to find out:-
1) a process is in kernel mode

2) a process is waiting for i/o

Thanks,
Shiv

[Ninad_1]

Shiv,

If you have glance installated , you can run glance and then press s and give pid of a process, this will show you the % time spent by that process in various states like system(kernel mode), user mode, interrupt etc etc.
Its really hard to know the instantaneous state of a process as there are lots of processes running on your system getting their bit of CPU time every few milliseconds. But the glance I mentione above will show you for what that process is waiting - IO , Nice , System, shared memory etc.

Regards,
Ninad

[Steven E. Protter]

Shalom Shiv,

Once a process has a parent of 1, you can't do a kill -9 because its parent is the entire system. The results of allowing this would be catastrophic. Sometimes however, a regular kill can get the process.

You can lean a lot about a process as follows:

UNIX95=1
then use ps

The man page is full of dozens of wonderful options.

glance gpm is a quicker less fun (fun defined as cool geek tricks) way to answer your second questions.

SEP

SEP

[James R. Ferguson]

Hi Shiv:

The problem with all determinations of the state of an active process is that a probe is only a snapshot in time and may not reflect what the process was doing at any instant. A process will oscillate between user and kernel mode. In user mode, variables are store, subroutines in the user's code are executed. In kernel moce, system calls are executed.

You can use 'ps' and look at the value of the 'flags' and 'state' to determine some of a process's state. For example, for all processes or a process by name, you could do:

# UNIX95= -e -o comm,pid,ppid,flags,state

# UNIX95= -C syslogd -o comm,pid,ppid,flags,state

Perhaps this helps.

Regards!

...JRF...