1.3 Processes and Memory
Prerequisites: Programs and Files
Estimated time: 10–15 minutes
You are ready to continue when: you can distinguish between programs and processes, read PID, PPID, status, and system memory overview.
An executable file stays on storage when you launch it. The operating system creates state for this run: an address space, open files, threads, and other resources. That running instance is the process we will observe.
From Program to Process
When a program is started, the operating system typically performs the following tasks. The specifics vary between kernels and runtimes, but this list gives their shared outline:
- Parse the startup request;
- Create a process object, virtual address space, and security context;
- Map the executable file, dynamic libraries, stack, and other regions;
- Establish standard streams, working directory, and inherited resources;
- Create the initial thread and hand it over to the scheduler.
Modern systems do not necessarily load the entire program into physical memory at once. Memory mapping and demand paging allow the system to load the pages only when they are first accessed.
A program describes what work needs to be done, while a process represents a single instance of that work. The same program can produce multiple processes; a single process can also use multiple program files, shared libraries, and configuration files.
PID is Not a Permanent Identity
A PID distinguishes processes within a PID namespace at a particular moment. Once a process exits, the system can reuse that number. Containers may also cause the same process to see different PIDs in different namespace contexts. Record both the command and the startup time when troubleshooting.
Starting and Observing a Process
python3 -c 'import time; time.sleep(30)' &
pid=$!
sleep 0.2
ps -p "$pid" -o pid,ppid,stat,%cpu,%mem,etime,command
kill "$pid"
wait "$pid" 2>/dev/null || trueType: runnableEnvironment: Bash, Python 3, common psObservation: $! saves the PID of the background task; PPID is the parent process ID; STAT is the state at the time of sampling; kill defaults to sending SIGTERM. The ps field in macOS has slight differences, and if there are errors, you can run ps -p "$pid" -o pid,ppid,state,etime,command first.
Virtual Memory and Physical Memory
Processes see a virtual address space. The CPU uses page tables to translate accessible virtual addresses into physical addresses. If a page is absent from RAM, the operating system may load it from a file or swap during page-fault handling. The CPU does not read disk as though it were RAM. Default isolation prevents ordinary processes from arbitrarily accessing other processes, but shared memory, debugging permissions, and kernel permissions can establish controlled exceptions.
On Linux, inspect system memory with:
free -hfreeis completely unused physical memory;buff/cachecontains recyclable cache;availableestimates how much memory new applications can use without swapping;swapstores pages that have been paged out, and does not indicate that "the entire process has been moved to disk."
A high percentage of used does not alone prove memory insufficiency. You also need to observe available, persistent paging, latency, and workload. macOS uses vm_stat or Activity Monitor, while Windows uses Task Manager or Performance Counters.
Signals and Terminating Processes
By default, kill PID sends SIGTERM, giving the program an opportunity to clean up resources. kill -KILL PID sends a SIGKILL that cannot be caught, and should be used only when the program is unable to respond and you have confirmed the target. Background services may be restarted by the service manager, so in such cases, you should operate on the service rather than repeatedly killing processes.
You Should Now Be Able to Judge
For a PID, record its command, start time, and current state. For high memory usage, inspect available, sustained paging, and actual latency before diagnosing a shortage.
Run the above experiment and confirm that the test process has exited. Then, with one sentence, distinguish between a program and a process. If you can do both, you're ready to proceed to Threads, Concurrency, and Parallelism.