4.3b Processes, Memory & Logs
Key Takeaways
- ps lists processes (snapshot); top is an interactive live view; free reports memory and swap usage at Essentials level
- Kernel and boot messages appear via dmesg; many system services write under /var/log/ (often via syslog or journald on modern systems)
- /proc/, /sys/, and /dev/ are virtual views—not ordinary disk folders—exposing process info, kernel/device attributes, and device nodes
- A process is a running program instance with a PID; RAM holds active working sets while swap is overflow storage on disk
- Essentials expects you to recognize these tools and paths—not to tune production servers or parse every /proc file
Processes, Memory & Logs (Objective 4.3b)
After you know where programs and configuration live on disk (objective 4.3a), the next Essentials skill is seeing what is running now, how much memory the system is using, and where logs and kernel messages appear. Linux also exposes several virtual directory trees—/proc/, /sys/, and /dev/—that look like files but are generated by the kernel.
What a process is
A process is a running instance of a program. Starting Firefox twice (or running two shells) creates separate processes, each with its own PID (process ID). Processes consume CPU time and memory; when they finish or are killed, those resources return to the system. At Essentials level you should be able to list processes and recognize busy systems—not design schedulers.
Viewing processes: ps and top
| Command | Role | Typical use |
|---|---|---|
ps | Snapshot of processes | Quick “what is running?” check |
ps aux | Wider user/process listing (common BSD-style options) | See many processes with user, CPU%, MEM%, command |
ps -ef | System V-style full listing | Similar overview with different columns |
top | Interactive, updating view | Watch CPU/memory hogs live; quit with q |
ps prints a point-in-time list and exits. Without options, many systems show only processes in your current terminal session—so for a broader picture, Essentials candidates should know patterns like ps aux or ps -ef.
top refreshes on a timer. The header summarizes load and memory; the table ranks processes (often by CPU). You do not need every interactive key for the exam—know that top is the live monitor and that q leaves it. Some distributions also ship htop; it is useful but not required vocabulary for 010-160.
Memory overview: free
| Command | What it shows |
|---|---|
free | Total, used, free, and available RAM; swap totals |
free -h | Same data in human-readable units (MiB/GiB) |
free -m | Memory figures in mebibytes |
RAM holds the working set of running processes and kernel caches. Swap is disk space used when RAM is under pressure. Seeing swap in use does not always mean “the machine is dying,” but heavy swap with a sluggish UI often means memory pressure. Essentials wants you to read free output, not tune vm.swappiness.
Kernel messages: dmesg
dmesg prints the kernel ring buffer—messages from boot and hardware events (devices detected, driver notes, I/O errors). When a USB stick fails to appear or a disk reports errors, dmesg is a first stop. Output can be long; people often pipe it through less or grep (skills from Topic 3).
Logs under /var/log/
Persistent logs commonly live under /var/log/. Exact filenames vary by distribution and service:
| Path / idea | Typical content |
|---|---|
/var/log/ | Directory holding many log files |
| syslog / messages style logs | General system messages (names differ by distro) |
| Auth / security related logs | Login and privilege events (names differ) |
| Application logs | Service-specific files under /var/log/ or subdirs |
Syslog is the traditional logging facility: programs send messages to a logging daemon that writes files (often under /var/log/). Many modern systems also use systemd-journald (journalctl), but Essentials still expects you to know the /var/log/ idea and that syslog-style logging exists. You should be able to say: “look under /var/log/ for historical messages; use dmesg for kernel ring-buffer messages.”
Virtual trees: /proc/, /sys/, /dev/
These paths appear in ls output, but they are not ordinary folders of permanent files on your root filesystem the way /home is.
| Path | Purpose (Essentials view) |
|---|---|
/proc/ | Process and kernel info as files (e.g. /proc/<PID>/…, /proc/cpuinfo, /proc/meminfo) |
/sys/ | Kernel/device attribute tree used by modern device management |
/dev/ | Device nodes (disks, terminals, null, random, etc.) |
/proc/ lets tools (and curious humans) read process status and some system stats without a special API. ps and free ultimately draw on kernel data that /proc also exposes. /sys/ is especially important for hardware and driver attributes. /dev/ is where you see names like /dev/sda or /dev/nvme0n1 that connect to block devices you met in hardware objectives.
Do not treat deleting “files” under /proc or /sys like cleaning a Downloads folder—these are kernel interfaces. Essentials tests recognition of purpose, not reckless editing.
How the pieces fit together
A typical troubleshooting story at this level:
toporps— Is a process stuck or using all CPU?free -h— Is RAM exhausted and swap thrashing?dmesg— Did the kernel just report a disk or USB fault?/var/log/— Did a service leave a longer history of errors?
That workflow is enough for Linux Essentials. You are proving you know where to look, not that you can operate a data center.
Memory and process concepts (Essentials vocabulary)
Keep these distinctions sharp for fill-in and multiple-choice items:
- A program is the installed code on disk; a process is that code running with a PID.
- RAM is fast working memory; swap is slower overflow on disk used when RAM is tight.
psis a snapshot;topis live;freeis memory totals—not a process killer.dmesgis the kernel ring buffer;/var/log/is where many lasting log files live./procand/sysare virtual kernel views;/devholds device nodes such as disks and terminals.
If a stem says the desktop feels slow and the fan is spinning, start with top and free -h. If a new USB disk never shows up under /dev, check dmesg. If a daemon keeps failing across reboots, browse /var/log/ for that service’s messages. Matching symptom → tool is the core of objective 4.3b.
Exam focus
Expect questions that match a symptom to a tool (slow system → top/free; kernel/hardware message → dmesg; service history → /var/log/), or that ask which of /proc, /sys, /dev is the virtual process/kernel view versus device nodes. Prefer exact command names and paths on fill-in items.
Which command provides an interactive, continuously updating view of processes and resource use?
Which path is best described as a virtual filesystem that exposes process and kernel information as files?
A technician needs human-readable RAM and swap totals right now. Which command is the best Essentials-level choice?