$ Linux One Liners
Back to cert prep

Unofficial practice

Process Tree and Kill Signal

A machine feels slow. Identify the process, parent, resource column, and service owner before killing or restarting a workload.

Linux One Liners is an independent study and practice resource. It is not affiliated with, endorsed by, or approved by LPI, The Linux Foundation, CompTIA, or any certification provider. This site does not provide exam dumps or real exam questions.

Try first

ps -eo pid,ppid,stat,comm,args --forest | head -80

Troubleshooting ladder

  1. Name the symptom.
  2. Inspect read-only state.
  3. Find the owner, service, file, device, mount, or route.
  4. Read the decisive output field.
  5. Choose the next narrow command.
  6. Avoid broad or destructive changes.
  7. Make the smallest justified change if required.
  8. Verify and record what changed.

drill evidence

Sample output and answer key

Command anatomy

ps -eo pid,ppid,stat,comm,args --forest | head -80
ps
the command family
flags
change output shape or scope
target
the file, service, user, mount, or host being inspected
output
evidence you must explain before changing state

Annotated output

PID  PPID STAT %CPU %MEM COMMAND   COMMAND
421  1    S    87.4 12.1 python3   python3 worker.py
2310 1    S     3.2  1.4 nginx     nginx: worker process
944  1    Ss    0.5  0.8 sshd      /usr/sbin/sshd -D

What to notice

PID/PPID
which process and parent are involved
STAT
whether the process is sleeping, running, stopped, or a session leader
CPU/MEM
which resource is under pressure
command/args
what workload is actually running

Safe vs unsafe move

Common wrong move

Killing the top process before identifying its service owner.

Next safe command

systemctl status worker.service --no-pager

Goal

Prove the condition with command output before changing the system.

Safe first command

ps -eo pid,ppid,stat,comm,args --forest | head -80

Correct interpretation

The decisive fields are `PID/PPID`, `STAT`, `CPU/MEM`. The affected object is the process and workload shown in the resource columns. The next safe command is `systemctl status worker.service --no-pager` because it narrows the evidence without jumping to a broad fix. Watch out for this wrong move: Killing the top process before identifying its service owner.

Next safe command

systemctl status worker.service --no-pager

Common wrong move

Killing the top process before identifying its service owner.

Self-check

Which process is consuming the resource, who owns it, and what service check comes before killing it?

source and objective

Related cert objective

Source status: LPI LPIC-1 overview verified July 3, 2026. Current version 5.0; exams 101-500 and 102-500.

Open related practice area

Related command pages

Why this matters

The point is not to memorize a flag. It is to read the evidence, name the next safe check, and avoid the tempting broad fix.