Katkat
Back

Use find, ps, top, and kill Safely on Linux

SquarepointSoftware Engineer · HR Screen
MediumSoftware EngineerHR ScreenSoftware Engineering Fundamentals

Last updated

Tests practical Linux troubleshooting skills using standard command-line tools (`top`, `ps`, `find`, `kill`) to diagnose resource contention, safely manage processes, and handle tricky file artifacts.

Scenario

A production host is reporting degraded performance due to a runaway background service. High CPU alerts have fired, and a disk partition containing application runtimes and temporary logs is nearly full. You have an SSH session on the host and need to investigate, isolate, and safely remediate the issue without disrupting healthy sibling processes running on the machine.

Tasks

Provide the exact commands, pipelines, and rationales for each of the following operational steps:

1. Real-time and Snapshot Process Inspection

  • Use top (or batch mode top) to quickly locate the highest CPU-consuming process and identify its Process ID (PID), user, and state.
  • Use ps with custom format options to capture a non-interactive snapshot of the offending process, its exact command-line arguments, its parent process ID (PPID), thread count, and start time.

2. Investigating File Artifacts with Tricky Names

  • The process writes scratch logs under /var/log/app_scratch/. Some filenames contain spaces, dashes, or non-printable characters.
  • Write a find command to locate all regular files in /var/log/app_scratch/ larger than 500 MB that were modified in the last 60 minutes.
  • Demonstrate how to safely pipe or execute an action on these results (such as inspecting disk usage or archiving them) without breaking on spaces or special characters in filenames.

3. Graceful vs. Forced Process Termination

  • Explain the step-by-step sequence to stop the identified process safely using kill.
  • Contrast SIGTERM (15) and SIGKILL (9), detailing why sending an immediate kill -9 is dangerous for stateful or I/O-heavy services.
  • Demonstrate how to verify that the process has actually exited before taking further action, and explain how to mitigate the risk of PID recycling.

Expected Output

Your solution should provide concrete bash commands for each phase (including flags and explanations) alongside a concise explanation of process signal semantics and safe file handling.

Hints

Hint 1

Use `top -b -n 1` or `ps -eo pid,ppid,user,%cpu,%mem,nlwp,lstart,cmd --sort=-%cpu` to inspect process metrics cleanly in scripted or terminal environments.

Hint 2

When processing arbitrary filenames with `find`, pair `-print0` with `xargs -0` or use `find -exec ... {} +` to prevent word-splitting on whitespace and newlines.

Hint 3

Always issue `kill -15 ` first, poll the PID's existence via `kill -0 ` or `/proc/`, and only resort to `kill -9` if a timeout expires without process termination.

Follow-up questions

  • What occurs if the runaway process is in an uninterruptible sleep state (`D` state in `ps`/`top`), and can `kill -9` terminate it?
  • How would you locate all open file descriptors and active network sockets associated with the PID before killing it?
  • How does PID recycling create race conditions in automated watchdog scripts, and how can `/proc//stat` or process start times be used to guard against it?