Process States

A Linux task moves between execution states as it runs, waits, stops, and exits. The STAT field from ps captures one moment, so repeated observations are more useful than a single letter when diagnosing behavior.

$ ps -o pid,ppid,stat,wchan:24,cmd

The first character in STAT is the primary state. Additional characters are modifiers describing properties such as session leadership or foreground process-group membership. Consult the local ps manual for the complete set.

Running and Interruptible Sleep

• R means running or runnable. The task is executing on a CPU or waiting in a run queue for CPU time.
• S means interruptible sleep. The task is waiting for an event and can be awakened by an appropriate signal or event.

Sleeping is normal. Interactive programs and services spend much of their time waiting for input, timers, network traffic, locks, or other events rather than consuming CPU continuously.

Uninterruptible Sleep

D means uninterruptible sleep, commonly while the task waits in a kernel operation such as some storage or network-filesystem I/O. The task does not act on ordinary signals until it leaves that wait; a signal can remain pending in the meantime.

A brief D state can be normal. Persistent or numerous D tasks can indicate slow, unavailable, or faulty I/O, but the state alone does not identify the cause. Inspect the wait channel, kernel logs, storage and network health, and the relevant subsystem before drawing conclusions.

Stopped and Zombie States

• T normally means stopped by job-control action, such as SIGTSTP, or by SIGSTOP. Some tools use lowercase t for a tracing stop.
• Z means zombie: the process has exited, but its parent has not yet collected the termination record.

Resume a job-control stop with SIGCONT when appropriate. A zombie cannot be resumed or killed because it is no longer executing; its parent or an adopting reaper must collect it.

Reading States in Context

State codes are observations, not diagnoses. Combine them with elapsed time, CPU use, wait channels, parent relationships, logs, and repeated samples. A task can switch states between the instant the kernel reports it and the instant you read the screen.

The Manage and Monitor Linux Processes lab provides a safe environment for observing foreground, sleeping, stopped, and terminated tasks.

Summary

You can now interpret the most common primary process states.

1. Read R as running or runnable and S as interruptible sleep.
2. Investigate persistent D as a wait symptom rather than a diagnosis.
3. Distinguish stopped T from exited, unreaped Z.
4. Use repeated observations and surrounding evidence.