Linux Process and Memory Management

Process and memory questions are GUARANTEED in DevOps/SRE interviews. Let's master the concepts interviewers love to ask about.

Process Lifecycle

Every process in Linux follows this lifecycle:

fork() → exec() → running → exit() → zombie → reaped

Key System Calls

System Call	Purpose	Interview Relevance
fork()	Create child process (copy of parent)	"What happens when you fork?"
exec()	Replace process image with new program	"How does a shell run commands?"
wait()	Parent waits for child to exit	"How to prevent zombies?"
exit()	Terminate process	"What's the difference from kill?"

Process States

# Check process states
ps aux

# States you'll see:
# R - Running
# S - Sleeping (interruptible)
# D - Sleeping (uninterruptible) - Usually I/O wait
# Z - Zombie
# T - Stopped

Interview question: "You see many processes in D state. What's happening?"

Answer: D state means uninterruptible sleep, typically waiting for I/O. Many D-state processes suggest disk or NFS issues. Check iostat, iotop, and disk health.

Zombie Processes

Zombies occur when a child exits but the parent hasn't called wait():

# Find zombies
ps aux | awk '$8=="Z" {print $2, $11}'

# Count zombies
ps aux | awk '$8=="Z"' | wc -l

How to fix zombies:

1. Kill the parent process (zombies will be adopted by init and reaped)
2. Fix the parent code to properly wait() for children

Memory Management

Virtual Memory Concepts

Every process has its own virtual address space:

+------------------+
| Kernel Space     | (not accessible to process)
+------------------+
| Stack            | (grows downward)
+------------------+
|        ↓         |
|                  |
|        ↑         |
+------------------+
| Heap             | (grows upward, malloc)
+------------------+
| BSS              | (uninitialized data)
+------------------+
| Data             | (initialized data)
+------------------+
| Text             | (code)
+------------------+

Memory Commands

# System memory overview
free -h

# Per-process memory
ps aux --sort=-%mem | head -10

# Detailed memory for a process
cat /proc/<pid>/status | grep -E "VmSize|VmRSS|VmSwap"

# Memory maps
pmap <pid>

Key Memory Metrics

Metric	Meaning	Interview Tip
VSZ	Virtual memory size	Includes mapped but unallocated
RSS	Resident Set Size	Actually in RAM
Shared	Shared memory	Libraries shared between processes
Swap	Swapped out memory	Performance indicator

OOM Killer

When memory is exhausted, Linux's OOM (Out of Memory) Killer selects a process to terminate:

# Check OOM score (higher = more likely to be killed)
cat /proc/<pid>/oom_score

# Adjust OOM score (-1000 to 1000, -1000 = never kill)
echo -500 > /proc/<pid>/oom_score_adj

Interview question: "A critical service keeps getting OOM killed. How do you protect it?"

Answer:

1. Set oom_score_adj to -1000 to protect it
2. Investigate why memory is exhausted (memory leak?)
3. Add memory or reduce other workloads
4. Configure memory limits for other services (cgroups)

Interview Practice

Q: "A server is slow. You run top and see load average is 50 but CPU is only 10% utilized. What's happening?"

A: High load with low CPU suggests I/O wait. Processes are blocked waiting for disk or network. Check:

1. iostat -x 1 for disk I/O
2. iotop for which processes
3. vmstat 1 for overall picture
4. Network issues if using NFS

Next, we'll cover file systems and permissions—another interview favorite. :::