← Guide index · Repository home
A process has identity, parentage, open resources, scheduling state, environment, and limits. Reliable diagnosis asks what the process is waiting for before attempting to restart it.
Caution
Inspect targets and understand impact before running privileged or mutating commands. Test changes in a safe environment first.
A worker stops consuming jobs. The investigation checks whether it is running, blocked on I/O, exhausting file descriptors, repeatedly crashing, or waiting on a dependency.
| # | Working principle |
|---|---|
| 1 | Process state distinguishes running, sleeping, stopped, and zombie tasks. |
| 2 | Signals request behavior; SIGTERM allows cleanup while SIGKILL does not. |
| 3 | Resource limits constrain files, processes, memory locking, and other per-process capabilities. |
pgrep -a order-worker
ps -o pid,ppid,user,stat,lstart,etime,%cpu,%mem,cmd -p 1234
cat /proc/1234/status
ls -l /proc/1234/fd | head
cat /proc/1234/limits
kill -TERM 1234Commands are examples for observation and controlled testing. Paths, process identifiers, interfaces, and service names must be adapted to the actual host.
- Define the symptom, affected users, and time window.
- Collect the smallest useful set of host and service evidence.
- Form one falsifiable hypothesis.
- Make the least disruptive test or change.
- Verify recovery and record what was learned.
- Send SIGTERM and allow the documented shutdown window before escalation.
- Use systemd or the owning supervisor instead of manually replacing managed processes.
- Capture logs and process state before restarting when incident evidence matters.
- Using kill -9 as the first response.
- Treating a zombie as a CPU-consuming process.
- Reading process environment without considering secret exposure.
- What creates a zombie process?
- Why is SIGTERM preferred to SIGKILL?
- How would you investigate file-descriptor exhaustion?