Lesson 4 of 6 · About 6 minutes
Processes and background services
Learn the concept.
A program stored on disk and a running instance of that program are different things. A process is a running instance with an identity, resources, and a process ID.
Read a process snapshot
Fictional workstation. These are observations, not verdicts.
| PID | Owner | Command |
|---|---|---|
| 102 | learner | shell |
| 240 | backup | backup-agent |
| 318 | learner | browser |
Read the visualA process named backup-agent is running. What does that establish?
A running process is not proof of a successful job or trustworthy behavior. Review the relevant job result and context.
Read a snapshot
A process list shows what was running when it was collected. Our simplified ps output includes PID, owner, and command. A PID is a local identifier, not a permanent identity for software.
Notice the owner and purpose
A background service may run under a dedicated account. Its name alone does not establish whether it is legitimate; compare its role, location, parent, and activity with expectations.
Observe before intervening
Stopping a process can interrupt important work. In this lab you only inspect. In a real investigation, follow the response process and your authority before changing system state.
Put it in context
Harbor Books expects backup-agent to run under the backup account. The process list supports that observation. It does not establish that the latest backup succeeded; the job result is separate evidence.
Make a decision.
Explore the practice space, then answer the check-in below. A correct answer lets you save this lesson to your progress.
YOUR PRACTICE SPACE
Try the idea for yourself.
Enable JavaScript to explore this fictional exercise. The explanation and visual above remain available.
Take this with you.
A process list is a starting point. Check identity, purpose, and related evidence before acting.
Next lesson: Your first terminal commands