Skip to main content

Lab 2.1 - Kernel and System Process Inspection

Objectives​

By the end of this lab, you will be able to:

  • Inspect the Linux kernel
  • Check system processes
  • Examine systemd and services
  • Understand process structure

Prerequisites​

  • Functional Linux system (Ubuntu/Debian recommended)
  • Root or sudo access
  • Open terminal

Exercise 1: Kernel Information​

Step 1: Kernel Version​

# View kernel version
uname -a

# Version only
uname -r

# Detailed information
cat /proc/version

Question: What kernel version are you using?

Step 2: Kernel Modules​

# View loaded modules
lsmod

# View module details
modinfo module-name

# View modules related to a keyword
lsmod | grep network

Step 3: Kernel Parameters​

# View sysctl parameters
sysctl -a

# View a specific parameter
sysctl kernel.version

# View network parameters
sysctl net.ipv4

Exercise 2: System Processes​

Step 1: Init Process (PID 1)​

# View init process
ps -p 1

# Process details
ps -p 1 -o pid,ppid,cmd,etime

# View init type
systemctl --version

Question: What init system are you using? (systemd, SysVinit, etc.)

Step 2: System Processes​

# View all processes
ps aux

# View process tree
pstree

# With PID
pstree -p

# View system processes only
ps aux | grep -E '\[.*\]'

Step 3: Processes by User​

# Root processes
ps -u root

# Your user processes
ps -u $USER

# Count processes
ps aux | wc -l

Exercise 3: systemd and Services​

Step 1: systemd Status​

# View systemd version
systemctl --version

# View systemd status
systemctl status

# View active units
systemctl list-units --type=service --state=running

Step 2: System Services​

# View all services
systemctl list-units --type=service

# Active services
systemctl list-units --type=service --state=active

# Failed services
systemctl list-units --type=service --state=failed

Step 3: Service Details​

# Service status (e.g., sshd)
systemctl status sshd

# View logs
journalctl -u sshd

# Last lines
journalctl -u sshd -n 50

Exercise 4: Exploring /proc​

Step 1: System Information​

# CPU information
cat /proc/cpuinfo

# Memory information
cat /proc/meminfo

# System information
cat /proc/loadavg

Step 2: Processes in /proc​

# View processes
ls /proc/ | grep -E '^[0-9]+$'

# Information about a process (replace PID)
cat /proc/1/status

# Files opened by a process
ls -l /proc/1/fd/

Step 3: Network Information​

# Network connections
cat /proc/net/sockstat

# Network statistics
cat /proc/net/dev

Exercise 5: Advanced Analysis​

Step 1: Resource Usage​

# Top processes
top -bn1 | head -20

# With htop (if installed)
htop

# CPU usage by process
ps aux --sort=-%cpu | head -10

# Memory usage by process
ps aux --sort=-%mem | head -10

Step 2: Process Tree​

# Full tree
pstree -a

# With users
pstree -u

# Limit depth
pstree -L 2

Step 3: Zombie Processes​

# View zombie processes
ps aux | grep -w Z

# Count zombies
ps aux | grep -w Z | wc -l

Exercise 6: Real-Time Monitoring​

Step 1: top​

# Launch top
top

# Commands in top:
# - 'q': Quit
# - 'k': Kill a process
# - 'r': Renice a process
# - 'f': Change displayed columns

Step 2: htop (if available)​

# Install htop
sudo apt install htop

# Launch
htop

# More interactive than top

Step 3: Monitoring Script​

# Create a simple script
cat > monitor.sh << 'EOF'
#!/bin/bash
echo "=== Kernel ==="
uname -a
echo
echo "=== Load Average ==="
uptime
echo
echo "=== Top 5 CPU ==="
ps aux --sort=-%cpu | head -6
echo
echo "=== Top 5 Memory ==="
ps aux --sort=-%mem | head -6
EOF

chmod +x monitor.sh
./monitor.sh

Verification​

Checklist​

Verify that you can:

  • View kernel version
  • List loaded modules
  • Identify init process (PID 1)
  • View system processes
  • Use systemctl to view services
  • Explore /proc for system information
  • Use top/htop for monitoring

Reflection Questions​

  1. What is the role of the PID 1 process?

    • It is the parent of all processes
    • It manages orphan processes
    • It initializes the system

  2. What is the difference between ps and top?

    • ps shows a snapshot
    • top shows in real-time

  3. Why is /proc important?

    • Interface to the kernel
    • Real-time information
    • No real files, all virtual

Next Steps​

  • Lab 2.2: Memory Management Analysis
  • Lab 2.3: Advanced System Monitoring
  • Chapter 2.3: Memory Management and Swap

Lab created on: December 2024