High School IntermediateModule I2Lesson 4 of 8

I2.4 Processes and Services

Analyze fictional Linux processes, parent-child relationships, service states, startup behavior, packages, users, ports, files, resource use, logs, dependencies, and change evidence.

Lesson Progress

Processes and Services

High School IntermediateI2: Linux Basics for Security • Lesson 4 of 8

50% complete

Readiness Check

Before You Start

0/5 ready

Professional Hook

A Running Process Is an Observation, Not a Complete Conclusion

A process may be expected, unnecessary, misconfigured, overloaded, stale, failed, or part of an approved change. Defenders connect the process to its parent, user, executable, package, service, files, ports, logs, owner, system role, and recent changes before deciding what it means.

Weak response

“The process name looks strange, so stop it.”

Strong response

“Preserve the evidence, identify the process chain and owner, compare it with the approved role and changes, then choose the narrowest authorized action.”

Objective 1

Explain Linux processes, parent-child relationships, process identifiers, foreground and background activity, and service concepts.

Objective 2

Connect running processes and services with approved system roles, users, packages, ports, files, dependencies, and logs.

Objective 3

Interpret fictional process and service evidence without stopping, starting, or changing real systems.

Objective 4

Identify unexpected, duplicate, failed, stale, orphaned, high-resource, and review-required activity.

Objective 5

Recommend authorized process or service corrections with dependency review, validation, rollback, and monitoring.

Why This Matters

Processes and Services Turn Stored Software Into Active System Behavior

Files and packages show what is installed. Processes and services show what is running, which accounts are involved, which resources are used, which ports are open, which files are active, and whether approved applications are healthy.

State Interpretation

Service State Needs Context

Running or active

The process or service is currently executing or available.

Defender questions

Is it required by the approved role? Which user, package, files, ports, and dependencies support it?

Stopped or inactive

The service is not currently running.

Defender questions

Is this expected, planned, failed, manually stopped, or causing an approved workflow outage?

Failed

The service manager reports that startup or continued operation did not succeed.

Defender questions

What error, dependency, permission, configuration, resource, or change evidence explains the failure?

Restarting

The service repeatedly stops and starts or is being automatically recovered.

Defender questions

Is the restart expected? Is there a crash loop, dependency problem, update, or resource limit?

Enabled but unused

The service is configured to start automatically but no current dependency or recent use is confirmed.

Defender questions

Who owns it? Why is it enabled? Can it be restricted or removed through controlled change?

Running but unowned

The process is active, but no current team or approved purpose is documented.

Defender questions

Which package, user, files, connections, project, and historical changes are associated with it?

Correlation Map

Connect a Process to the Rest of the System

User to process

The account context helps explain who or what launched the process and which permissions it receives.

Parent to child

The process tree can show whether activity came from a shell, service manager, application, scheduler, or another process.

Process to executable

The executable path connects running activity to an installed file, package, owner, and baseline.

Process to service

A service manager may track startup, restarts, failures, dependencies, and logs for the process.

Process to port

A listening or connected port can reveal which network service the process provides or uses.

Process to files

Configuration, logs, data, temporary files, and open files provide operational and evidence context.

Process to resources

CPU, memory, storage, and network use may indicate normal workload, failure, overload, or review needs.

Process to change

Updates, deployments, maintenance, startup changes, and project work may explain why activity changed.

Core Concept

Review the Full Execution Chain

A strong process review connects the parent process, child process, user, executable path, installed package, service definition, startup state, open files, network activity, resource use, logs, and ownership. One isolated process name rarely provides enough context.

Intermediate habit: write one evidence sentence that includes process, user, parent, executable, service, system role, and timestamp.

Key Vocabulary

Linux Process and Service Terms

Process

A running instance of a program with its own identifier, user context, memory, state, and resource use.

PID

Process identifier: a number used by the operating system to distinguish one running process from another.

Parent process

The process that created or launched another process.

Child process

A process started by another process.

Foreground process

A process attached to the current interactive session and receiving direct user input.

Background process

A process running without controlling the current interactive prompt.

Service

A managed background function that supports the operating system, users, applications, or network activity.

Daemon

A background process that provides a persistent system or network service.

Service state

The current condition of a managed service, such as running, stopped, failed, inactive, or restarting.

Startup state

Whether a service is configured to start automatically during system startup or another approved trigger.

Dependency

A process, service, file, account, library, network path, or system resource another component requires.

Resource use

The CPU, memory, storage, network, and process capacity consumed by running activity.

Evidence Analysis

What Process and Service Evidence Can and Cannot Prove

Evidence source

Process inventory

Can support

PID, parent PID, user, executable, state, start time, command context, and resource use.

Limitation

Does not prove approved business purpose, package trust, or complete activity by itself.

Evidence source

Service status

Can support

Service name, state, startup behavior, recent result, dependency, and management context.

Limitation

Does not prove configuration quality, necessity, reachability, or all child processes.

Evidence source

Package and executable record

Can support

Which installed package or file provides the executable and its version or owner.

Limitation

Does not prove the process is currently required or correctly configured.

Evidence source

Network evidence

Can support

Listening services, outbound connections, addresses, ports, zones, and firewall decisions.

Limitation

Does not prove complete application purpose or user intent.

Evidence source

Log evidence

Can support

Startup, stop, failure, restart, authentication, application, and service events over time.

Limitation

Logs may be incomplete, filtered, delayed, or affected by time synchronization.

Evidence source

Ownership and change records

Can support

Approved role, owner, deployment, exception, maintenance, test, retirement, and rollback context.

Limitation

Does not prove the final technical state matches the approved plan.

Defensive Workflow

Review a Process or Service in Six Steps

1

Identify the process or service

Record the fictional name, PID, parent, user, executable path, package, state, start time, and startup behavior.

2

Connect it to system role

Ask whether the activity belongs on this web, database, file, monitoring, workstation, gateway, or backup system.

3

Map dependencies

Review required files, users, groups, ports, services, storage, network paths, and startup ordering.

4

Review behavior and resources

Compare logs, restarts, failures, CPU, memory, connections, open files, and recent changes.

5

Separate fact from conclusion

State what is confirmed, likely, uncertain, missing, and unsupported.

6

Recommend controlled action

Document the owner, exact change, dependency review, test, rollback, validation, and monitoring.

Fake Dashboard

Fake Linux Process and Service Dashboard

Training dashboard for the fictional Harborview Learning Portal.

Expected services

9

Web, database client, monitoring, time, backup, logging, and update services match the baseline.

Failed services

1

The approved media-processing service repeatedly restarts after a configuration change.

Unowned legacy service

1

A synchronization service remains enabled and listening with no current dependency.

Fake SOC Alert

Approved Media Service Enters a Restart Loop After Configuration Change

Source: Fake Linux Service Health Monitor • Time: 03:17 PM

High Severity
The fictional service media-render.service restarts every 45 seconds after an approved configuration update. Logs show a permission-denied error reading /srv/media-render/config/app.conf. The file owner changed during deployment, and the service account no longer has the expected read access.
Defensive recommendation: Preserve service, process, file, permission, deployment, and log evidence; compare the approved ownership baseline; then request an authorized ownership or permission correction with validation and rollback.

Fake Log Panel

Fake Process and Service Evidence Timeline

training-log-viewer.log
14:52:00 CHANGE title='media-render configuration update' approved='true'
14:54:16 FILE path='/srv/media-render/config/app.conf' owner='deploy-user' group='deploy-team' permissions='rw-r-----'
14:55:02 SERVICE name='media-render.service' user='media-render' state='starting'
14:55:03 PROCESS pid='4812' parent='service-manager' executable='/opt/media-render/bin/renderer'
14:55:03 ERROR service='media-render.service' message='permission denied reading app.conf'
14:55:04 SERVICE name='media-render.service' state='failed' restart='scheduled'
15:01:44 BASELINE config_owner='root' config_group='media-render' permissions='rw-r-----'
15:08:31 DEPLOYMENT ownership_change='not_documented'
15:17:09 CORRELATION finding='service_restart_loop_due_to_config_group_mismatch' confidence='high'

Training note: this is fake data for defensive analysis practice only.

Analyze the Evidence

Which Process and Service Conclusion Is Best Supported?

The fictional media-render service is approved for the server role.
The service account is media-render.
The service fails while reading its approved configuration file.
The file group changed from media-render to deploy-team during deployment.
The current permissions allow the owner and group to read, but the service account is not in deploy-team.
The approved baseline requires group ownership by media-render.
The service restarts repeatedly after the change.

What is the strongest conclusion and next action?

Common Mistakes

Mistakes That Weaken Process and Service Review

Assuming an unfamiliar process name proves malicious activity.
Stopping a process before preserving its PID, user, executable, parent, connections, files, and logs.
Treating high CPU or memory use as proof of compromise.
Ignoring parent-child relationships and reviewing only one process.
Removing a service without checking users, applications, backups, monitoring, and recovery dependencies.
Assuming a running service is required because it starts automatically.
Ignoring failed or restarting services because the main application still appears available.
Focusing on a port without connecting it to the owning process and approved role.
Making multiple service changes at once and losing the ability to validate the cause.
Publishing real process lists, hostnames, ports, paths, or service configurations in a portfolio.

Safe Practice Lab

Review a Fictional Linux Process and Service Inventory

Fictional Environment

Meadowbrook Learning Application Server

Review a supplied fictional process tree, service-status table, executable inventory, package list, ports, open files, resource data, ownership records, logs, and approved changes.

Required Analysis

  1. Classify each process and service as expected, failed, stale, duplicate, or review-required.
  2. Map process, parent, user, executable, package, service, port, and files.
  3. Compare startup behavior and service state with the approved role.
  4. Review resource use, restarts, errors, dependencies, and changes.
  5. Identify one service failure and one unnecessary exposure.
  6. State facts, likely explanation, missing evidence, and confidence.
  7. Write an authorized correction, validation, rollback, and monitoring plan.
This is a read-only fictional evidence lab. Do not terminate, restart, reconfigure, inspect, or test processes or services on a real computer, server, virtual machine, website, cloud system, or school device.

Scenario Decision Lab

A Process Uses High CPU During an Approved Media Export

A fictional media-render process uses 92% CPU while an approved large video export is active. The parent service, user, file paths, job record, and change window all match the documented workflow.

Scenario Decision Lab

A Legacy Service Is Enabled but Has No Recent Connections

A fictional synchronization service starts automatically and listens on the staff zone. The related project ended eight months ago, no recent connections exist, and no current owner or dependency is documented.

Defender Habits

Linux Process and Service Review Checklist

Check Your Understanding

I2.4 Mini Quiz: Processes and Services

Choose your answers first. Explanations appear only after submission.

1. What is a Linux process?

2. What does a PID identify?

3. Why is the parent process useful evidence?

4. What does a running service prove?

5. Which evidence best connects a listening port to a Linux service?

6. A service repeatedly restarts after a configuration change. What is the strongest response?

7. A legacy service is enabled, listening, and unused for months with no owner. What is the strongest next step?

Portfolio Prompt

Portfolio Prompt

Create a fictional Linux Process and Service Review for a learning-application server. Include at least twelve processes and services with PID, parent, user, executable, package, state, startup behavior, required files, ports, dependencies, resource use, owner, baseline status, logs, risk, and recommended action.

Use only fictional processes, services, users, packages, ports, paths, logs, systems, and organizations.
Include one failed service, one stale listening service, one expected high-resource process, and one duplicate process.
Explain what each evidence source confirms and what it cannot prove alone.
Do not include real process lists, hostnames, ports, file paths, credentials, or production details.

Key Takeaways

What You Should Remember

1.A process is a running program instance with a PID, parent, user, executable, state, and resources.
2.Services are managed background functions with startup, dependency, failure, restart, and logging context.
3.Running, failed, stopped, or high-resource states require system-role and workload evidence.
4.Strong analysis connects process, parent, user, executable, package, service, files, ports, logs, and changes.
5.Unfamiliar names and resource spikes do not prove malicious activity.
6.Safe process and service changes require preservation, authorization, dependency review, testing, rollback, validation, and monitoring.

Navigation

Continue Module I2