Home Switchboard Unix Administration Red Hat TCP/IP Networks Neoliberalism Toxic Managers
May the source be with you, but remember the KISS principle ;-)
Skepticism and critical thinking is not panacea, but can help to understand the world better

Controlling System Processes in Solaris

News Unix/Linux Internals Solaris Administration Recommended Links Unix Signals
Process Scheduling Virtual memory management Virtual Memory Swap Space
ps pgrep kill command Humor Etc

We will discuss the following topics: 


Solaris is a multitasking environment in which a number of programs run at the same time. This means that many users can be active on the system at the same time, running many jobs (processes) simultaneously. Each Solaris program can start and stop multiple processes while it is running, but only one job is active per processor at any given time while the other jobs wait in a job queue. Because each process takes its turn running in very short time slices (much less than a second each), multitasking operating systems give the appearance that multiple processes are running at the same time. A parent process forks a child process, which, in turn, can fork other processes.

A process is an instance of a running program. It can be any task that has an address space, executes its own piece of code, and has a unique process ID (PID). A process can create another process called a child process Any process that creates the child process is called the parent process. This creation of new processes from existing parent processes is called forking (after the C function called fork()). Most processes in the system are created by fork system calls. A system call causes the current process to be split into two processes: a parent process and a child process. The child process continues to execute on the CPU until it completes. On completion, the child process returns to the system any resources that it used during its execution. While the child process is running, the parent process either waits for the child process to complete or continues to execute. If the parent process continues to execute, it periodically checks for the completion of the child process.

A process is an instance of a running program.

Process has several attributes:

Running multiple processes has an impact on system performance because the processes consume system resources, such as memory and processor time, and some processes may even cause the system to hang. Managing processes becomes important in a multi-user environment such as Solaris. Managing processes involves monitoring the processes, finding the resource usage, finding the parent processes that have created child processes, assigning priority for processes, and terminating processes.

Monitoring Processes

A process can change its state during its lifetime, often multiople times. For example, if a parent process waits for the child process to complete execution, the parent process puts itself in sleep state. Such a change from run state to sleep state is known as a context switch.

During its lifetime a process can exist in four states:

Init is the first genuine user process the system creates. All other processes on the system are created by forking the Init process. If the process is in the Run state, it means that the process is running on the CPU. In the Sleep state, the process waits for a child process to complete, or waits for a resource. Zombie is the phase in which the child process terminates and is not removed from the system until the parent process acknowledges the death of the child process. In this case, the child process is said to be in a Zombie state.

There are several Solaris command that help to monitor processes

The ps Command

To view the state of a process, use the ps  and pgrep  commands. The ps  command, without any options, lists the process ID (PID), associated terminal (TTY), the cumulative execution time (TIME), and the command that generated the process (CMD)

$ ps
  6213 pts/5    0:00 sh
  6233 pts/5    0:00 ps
The ps -a  command lists the most frequently requested processes. It displays only the processes that are associated with the terminal from which the ps  command is issued. To list all the processes currently running on a system, use the -A  option with the ps  command.

The ps el  command displays a full listing of all the processes running on the system

$ps -el
19 T     0     0     0  0   0 SY        ?      0          ?        0:15 sched
 8 S     0     1     0  0  40 20        ?    151        ? ?        0:00 init
19 S     0     2     0  0   0 SY        ?      0        ? ?        0:00 pageout
19 S     0     3     0  0   0 SY        ?      0        ? ?       10:43 fsflush
 8 S     0   314     1  0  40 20        ?    222        ? ?        0:00 sac
 8 S     0   229     1  0  40 20        ?    130        ? ?        0:00 utmpd
 8 S     0   180     1  0  40 20        ?    596        ? ?        0:01 automoun
 8 S     0    52     1  0  40 20        ?    283        ? ?        0:00 sysevent
 8 S     0    59     1  0  40 20        ?    338        ? ?        0:01 picld
 8 S     0   111     1  0  40 20        ?    208        ? ?        0:02 in.route
 8 S     0   118     1  0  40 20        ?    242        ? ?        0:00 in.ndpd
 8 S     0   156     1  0  40 20        ?    311        ? ?        0:00 inetd
 8 S     0   188     1  0  40 20        ?    417        ? ?        0:00 syslogd
 8 S     0   133     1  0  40 20        ?    308        ? ?        0:00 rpcbind
 8 S     0   170     1  0  40 20        ?    289        ? ?        0:00 lockd
 8 S    25   420     1  0  40 20        ?    535        ? ?        0:00 sendmail
 8 S     1   169     1  0  40 20        ?    318        ? ?        0:00 statd
 8 S     0   218     1  0  40 20        ?    176        ? ?        0:00 powerd
 8 S     0   195     1  0  40 20        ?    284        ? ?        0:00 cron
 8 S     0   210     1  0  40 20        ?    387        ? ?        0:01 nscd
 8 S     0  4972  4971  0  80 30        ?    520        ? ?        0:00 dtscreen

The following are the fields displayed in the output for the ps el  command :

For more information see Unix ps command

The pgrep Command

The pgrep  command displays a list of the process IDs of active processes on the system that match the pattern specified in the command line. The pgrep  command functionally combines the ps  command with the grep  command. The syntax for the pgrep  command is as follows:

pgrep [-option] pattern 



- l long listings (name of the profess and its PID)
-g pgrplist Matches the processes with the process group ID.

-G gidlist

Matches the active processes with the group ID(s) specified in the command line. For example, if you are searching for processes running with the group ID sysman, specify the command pgrep G sysman.

-d delim

Specifies a delimiter for separating PIDs.


Matches the most recent process.

-P ppidlist

The processes are matched with the parent process ID in the listing.

-s sidlist

The processes are matched with the session ID in the list.

-t termlist

Matches the terminal on which the process is running.

-u euidlist

Matches processes with the effective used ID in the list. The effective uid is the uid of the executable file when the SUID of the file is set.

-U uidlist

Matches processes with the real uid in the list. The real uid is the uid that the user uses when starting a task or a process.


Matches all processes except those that meet the specified criteria in the command line.


Matches pattern against full arguments rather than the name of the executable file.


Matches the processes that exactly match the specified pattern.

The following example displays the process ID for the process sh:

$ pgrep sh

The following command displays the process ID of all those processes matching the in  pattern:

$ pgrep in*
The pgrep  command with the l  option displays the name of the processes, which contains the string in  along with their PIDs.
$ pgrep -l in
    1 init
  111 in.routed
  118 in.ndpd
  156 inetd
  133 rpcbind

The following command displays the processes owned by user James:

$ pgrep -u james

You can combine options. In the following example, both the l  and the u  options are used together with the pgrep  command to display the names of all the processes run by user James, along with his process ID.

$ pgrep -l -u james
 1459 sh
 1464 csh

The -d  option is used to specify a delimiter for separating PIDs when more than one process ID is tested in the output of the pgrep  command. The following example uses delimiters for the listed processes for the user James.

$ pgrep d";" u james
951; 1042; 1051


You can specify more than one user ID by using a comma (,) as a field separator.

Terminating Processes

Use the kill  and the pkill  commands to terminate a process. These commands send the appropriate signal to the intended processes to terminate them. A signal notifies a process that an event has occurred. The event could be raised because of issues with the hardware or software, a change in the system date, a change in the system state, and so forth. An inter-process communication takes place because one process sends a signal to another process to instruct the latter to act in a certain manner.

The kill  Command

The kill  command enables the user to kill the process. Only a superuser can kill a process owned by others. The kill  command sends a signal to a process, which is used to terminate it. The syntax for the kill  command is

# kill <signal> <process ID>

To kill a process, you should know its process ID. To find the process ID, you may use the following command:

ps ef | grep <process name> 

Even though many signals are available, signal 15 and 9 are the ones that are generally used with the kill  command.

Some processes still exist even after a SIGTERM  signal. A process might still be alive for the following reasons:


The kill  command, without any signal, issues the SIGTERM (signal 15), by default.

The following syntax sends signal 15 to the process with a process ID of 1305.

# kill 1305

The following example illustrates using the kill  command to send signal 9 to kill three different processes:

$ kill 9 3012 3019 3510
$ 3510 killed
$ 3019 killed
$ 3012 killed

Any number preceded by a minus (-) sign in the <PID>  field represents a process group ID. In the following example, the 9 signal is sent to the process with PID 1039 and all the processes with the process group 117.

#kill 9 1039 117

The pkill Command

The pkill  command terminates the displayed processes that match the pattern specified. The pattern is a regular expression that is used to specify processes based on the program name. By default the pkill  command sends the SIGTERM  (signal 15) to the matching processes. The command syntax for the pkill  command is as follows:

pkill  [-option]  pattern.

The pkill  command takes any signal other than signal 15 (SIGKILL). The following command sends a SIGKILL  signal to the processes owned by user joeuser:

# pkill 9 u joeuser

Job control: foreground and background processes 

The Bourne shell does not provide job control. Only The Korn shell (ksh) and the C shell (csh) both allow for job control.

Commands such as vi are foreground processes—they read input from the keyboard and display output to the terminal. Foreground processes maintain control of the terminal, and the user cannot do anything else in that terminal window until the execution of that command is complete.

Some processes are not interactive and don't need to run in the foreground. These are referred to as background processes or jobs. A background process gets detached from the terminal, freeing up the terminal while it is running. When a user decides to run a process in the background, you must arrange for the process to get its input from another source. In addition, you need to arrange for the process to output to a device other than the terminal, such as a file.

To run a process in the background, enter an & (ampersand) after the command:

# find . -name core -print &After typing in this command, you're returned to a command prompt. The find command executes in the background. One problem, however, is the standard output is still on your terminal. In other words, as the find command executes, the results still are displayed on your screen, which can become quite annoying. It's best to redirect the output to a file, as follows:

# find . -name core -print > /tmp/results & After you put the find command in the background, the system displays two numbers associated with that process—the job number and the process ID number (PID) as follows:

[1] 14919You use this job number to control background processes.


The shell maintains a table containing information about processes that are currently in the background. This is referred to as the jobs table. The jobs table is unique to the user, and each user has his own jobs table. Furthermore, the jobs table contains only entries for jobs that are running in your current shell. If you start a new shell, the jobs table for the new shell is empty. Each job in the table is assigned a number that is unique to that user only. In other words, two users can each have a job numbered 1. Don't confuse this job number with a process ID number; remember, process IDs are unique, and no two share the same number. Any jobs that the user has placed in the background are displayed here by typing in the jobs command, as follows:

# jobsThe system responds with this:

[3] + Running find / -name bill -print > /tmp/results3 &
[2] - Running find / -name junk -print > /tmp/results2 &
[1] Running find / -name core -print > /tmp/results1 &The jobs table contains the following information:

A numeric value for each job
A + (plus) symbol to designate the current job that user commands will operate on
A - (minus) symbol to designate the next job that the user commands will operate on
The status of the job
The name of the job
Each job in the job table has one of the following states:

Running—An active job
Stopped—A job that has been suspended
Terminated—A job that has been killed
Done—A completed job
When the job finishes, the following is displayed on your terminal:

[1] + Done find / -name core -print > /tmp/results &Note the job number of 1 and the status of Done.

If you want to terminate a job, use the kill command followed by a % (percent sign) and then the job number, as follows:

# kill %1CAUTION
Pay special attention to the use of the % (percent) symbol—it's absolutely required. Without it, you could kill the wrong process and potentially crash the system. Get familiar with the kill command in the next section of this chapter before you use it.

If you do not enter a number following the % sign, the command acts upon the current job entry listed in the jobs table. For this example, you are going to kill job number 1, as follows:

# kill %1The following message is displayed indicating successful termination:

[1] + Terminated find / -name core -print > /tmp/results &You can also bring a job back into the foreground with the fg command. Typing fg with no arguments brings the current job (the job with the + sign next to it in the jobs table) into the foreground. You can also specify the job by typing fg %<job number>, as follows:

# fg %2This brings job 2 back into the foreground on your terminal.

signals to a process

Signals are software interrupts. For example, the kill command is used to send a signal to a process. System administrators most often use the signals SIGHUP, SIGKILL, SIGSTOP, and SIGTERM. The SIGHUP signal is used by some utilities as a way to notify the process to do something, such as re-read its configuration file. The SIGHUP signal is also sent to a process if the remote connection is lost or hangs up. The SIGKILL signal is used to abort a process, and the SIGSTOP signal is used to pause a process. The SIGTERM signal is the default signal sent to processes by commands such as kill and pkill when no signal is specified. Exam Alert

Don't worry about remembering all of the signals listed; just be familiar with the more common signals, such as SIGHUP, SIGKILL, SIGSTOP, and SIGTERM.

The most common signals an administrator is likely to encounter are signals with numric codes below 16

  1. SIGHUP  Hangup. Usually means that the controlling terminal has been disconnected.
  2. SIGINT Interrupt. The user can generate this signal by pressing Ctrl+C or Delete.
  3. SIGQUIT Auits the process and produces a core dump.
  4. SIGILL Illegal instruction.
  5. SIGTRAP Trace or breakpoint trap.
  6. SIGABRT Abort.
  7. SIGEMT Emulation trap.
  8. SIGFPE Arithmetic exception. Informs a process of a floating-point error.
  9. SIGKILL Killed. Forces the process to terminate. This is a sure kill.
  10. SIGBUS Bus error.
  11. SIGSEGV Segmentation fault.
  12. SIGSYS Bad system call.
  13. SIGPIPE Broken pipe.
  14. SIGALRM Alarm clock.
  15. SIGTERM Terminated. A gentle kill that gives processes a chance to clean up.
  16. SIGUSR1 User signal 1.
  17. SIGUSR2 User signal 2.
  18. SIGCHLD Child status changed.
  19. SIGPWR Power fail or restart.
  20. SIGWINCH Window size change.
  21. SIGURG Urgent socket condition.
  22. SIGPOLL Pollable event.
  23. SIGSTOP Stopped (signal). Pauses a process.
  24. SIGTSTP Stopped (user).
  25. SIGCONT Continued.
  26. SIGTTIN  Stopped (tty input).
  27. SIGTTOU Stopped (tty output).
  28. SIGVTALRM Virtual timer expired.
  29. SIGPROF Profiling timer expired.
  30. SIGXCPU CPU time limit exceeded.

Obtain a list of the signals type kill -l

The kill command sends a terminate signal (signal 15) to the process, and the process is terminated. Signal 15, which is the default when no options are used with the kill command, is a gentle kill that allows a process to perform cleanup work before terminating. Signal 9, on the other hand, is called a sure, unconditional kill because it cannot be caught or ignored by a process. If the process is still around after a kill -9, either it is hung up in the Unix kernel, waiting for an event such as disk I/O to complete, or you are not the owner of the process.

The kill command is routinely used to send signals to a process. You can kill any process you own, and the superuser can kill all processes in the system except those that have process IDs 0, 1, 2, 3, and 4. The kill command is poorly named because not every signal sent by it is used to kill a process. This command gets its name from its most common use—terminating a process with the kill -15 signal.



Recommended Links

Google matched content

Softpanorama Recommended

Top articles


InformIT Solaris 10 System Administration Exam Prep Managing System Processes Scheduling Processes

C H A P T E R 14 - Working With Signals

A Primer on Signals in the Solaris OS

Solaris Troubleshooting - Using Truss to Identify the Signals ...

Solaris Processes

Comparison of Solaris OS and Linux for Application Developers


The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D

Copyright © 1996-2018 by Dr. Nikolai Bezroukov. was initially created as a service to the (now defunct) UN Sustainable Development Networking Programme (SDNP) in the author free time and without any remuneration. This document is an industrial compilation designed and created exclusively for educational use and is distributed under the Softpanorama Content License. Original materials copyright belong to respective owners. Quotes are made for educational purposes only in compliance with the fair use doctrine.

FAIR USE NOTICE This site contains copyrighted material the use of which has not always been specifically authorized by the copyright owner. We are making such material available to advance understanding of computer science, IT technology, economic, scientific, and social issues. We believe this constitutes a 'fair use' of any such copyrighted material as provided by section 107 of the US Copyright Law according to which such material can be distributed without profit exclusively for research and educational purposes.

This is a Spartan WHYFF (We Help You For Free) site written by people for whom English is not a native language. Grammar and spelling errors should be expected. The site contain some broken links as it develops like a living tree...

You can use PayPal to make a contribution, supporting development of this site and speed up access. In case is down you can use the at


The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the author present and former employers, SDNP or any other organization the author may be associated with. We do not warrant the correctness of the information provided or its fitness for any purpose.

The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Last modified: September 12, 2017