Processes, services, packages and logs

When something on your laptop is slow, frozen or silently not working, the answers are usually in three places: the list of running programs, the list of background services and the logs, which are the computer's written diary. Learning to look at these without breaking anything is the first step towards fixing problems yourself instead of guessing. This lesson shows you each one, using only safe, read-only commands apart from one tiny practice process that you start yourself.

Program, process and service

A program is a file on your Storage holding instructions, such as the text editor or the web Browser. It does nothing while it sits there. When you start it, the operating system loads it into memory, gives it a share of the CPU and begins following the instructions. That running copy is a Process. If you open the browser twice, you have one program but two or more processes.

Think of a recipe book and a kitchen. The recipe is the program. Each time somebody cooks from it, that is a process. Two people cooking the same recipe at the same moment are two processes of one program.

Linux gives every process a number called the process ID, or PID. Numbers are handed out in order, so a newly started process has a higher number than older ones. The PID is how you point at one particular process when you need to talk about it.

A Service is a process that starts by itself, usually when the computer boots, and keeps running in the background without a window. It waits to do a job for you or for other programs. Examples are the service that manages Wi-Fi and the one that runs scheduled jobs. Linux uses a manager called systemd to start, stop and watch services.

Looking at processes, and stopping one safely

The command ps (process status) lists processes. On its own it shows only the ones started from your current terminal window. It prints four columns: PID, the terminal it belongs to (TTY), the total CPU time it has used (TIME) and the command name (CMD). The option ps aux shows every process on the computer, which is a very long list. Another command, top, shows the busiest processes and refreshes every few seconds. Press q to leave it.

To practise stopping a process without any risk, you will start one of your own. The command sleep 300 does nothing for 300 seconds. Adding & at the end tells the shell to run it in the background so that you get your prompt back at once. The shell prints a job number and the PID. Then kill followed by the PID asks that process to finish politely.

Services and systemd

To see the state of one service, use systemctl status followed by its name. The word systemctl means 'system control'. The status option only reports; it changes nothing and needs no password. We will look at cron, the service that runs jobs at set times, because Ubuntu installs it by default. The report begins with a coloured dot, then shows whether the service is loaded (its definition was found), enabled (starts at boot), and active (running) or not.

systemctl status cron

Other commands change services: sudo systemctl stop, start and restart. They need administrator rights and can interrupt networking, printing or even your login. Do not run them while learning unless a lesson or a person you trust explains exactly why. If you ask for a service that is not installed, such as systemctl status ssh on a fresh laptop, you will see Unit ssh.service could not be found. That is not a fault; the service simply is not there.

Packages and repositories

On Linux you rarely download an installer from a random website. Software comes as a Package: a single file holding a program, its settings and a list of what else it needs. Packages are kept in a Repository, an online library run by Ubuntu or another trusted source. The Package manager for Ubuntu is apt. It asks the repository what is available, downloads the package, checks that it has not been tampered with, and installs it along with anything it depends on.

You can look without installing anything. apt show nano prints details of the text editor package: version, size, what it needs and a description. apt search followed by a word lists packages whose names or descriptions contain that word. Neither needs sudo. Installing and removing do: for example sudo apt install package-name. Only install packages you understand, from Ubuntu's own repositories. If you add an extra repository from a website, you are trusting that website with your computer.

Logs: the computer's diary

A log is a record of events with a time on each line: a service starting, a Wi-Fi network connecting, a program crashing. When something fails, the log often says why. On modern Ubuntu, most messages are collected by systemd's journal, and you read them with journalctl. The plain-text files in the folder /var/log hold other logs, for example about package installs and the system.

Useful safe examples: journalctl -n 20 prints the last 20 messages. journalctl -p err -b shows only error-level messages (-p err) since the computer last started (-b means this boot). journalctl -u cron -n 5 shows the last 5 messages for the cron service (-u means unit). Long output opens in a viewer: use the arrow keys or space to move and q to leave. Add --no-pager to print straight to the window instead. To see which log files exist, type ls /var/log.