diff --git a/C13-Linux系统编程/C13-Linux系统编程学习笔记.md b/C13-Linux系统编程/C13-Linux系统编程学习笔记.md
index 35fb37e..9e5f9a1 100644
--- a/C13-Linux系统编程/C13-Linux系统编程学习笔记.md
+++ b/C13-Linux系统编程/C13-Linux系统编程学习笔记.md
@@ -1115,28 +1115,110 @@ int setregid(gid_t rgid, gid_t egid);
 
 ## 观摩课：解释器文件
 
+> unix讲究机制而非策略
+
+脚本，后缀名是什么都可以，一般用`sh`, `exec`
+```bash
+#!/bin/cat
+
+# some shell
+```
+`#!`是一种约定俗成的标记，告诉系统这个脚本应该用什么解释器来执行。
+
 
 ## `system()`函数
-
+```c
+/*
+ *  运行一个shell命令
+ *  调用/bin/sh
+ */
+int system(const char *command);
+```
+相当于`fork+exec+wait`的封装
 
 ## 进程会计
-
+```c
+//! freeBSD系统的方言
+int acct(const char *filename);
+```
 
 ## 进程时间
+```c
+clock_t times(struct tms *buf);
 
+// clock_t 滴答数
+
+struct tms{
+    clock_t tms_utime;  /* user time */
+    clock_t tms_stime;  /* system time */
+    clock_t tms_cutime; /* user time of children */
+    clock_t tms_cstime; /* system time of children */
+}
+
+```
 
 ## 守护进程
 
+1. 守护进程`PPID`为1
+2. 守护进程没有控制终端，`TTY`为?
+3. `PID, PGID, SID`相同
+
+```c
+pid_t setpgid(pid_t pid, pid_t pgid);
+pid_t getpgid(pid_t pid);
+
+pid_t getpgrp(void); //! 方言
+pid_t getpgrp(psid_t pid); //! 方言
+```
+
+- 会话（session）：一个或多个进程组的集合，以`sid`为标识
+  `pid_t setsid(void);`
+  `setsid`必须由非`leader`进程调用，从而创建一个新的会话。
+    - 前台进程组：正在与终端交互的进程组
+    - 后台进程组：正在运行，但不与终端交互的进程组
+
+- 终端：
+  我们接触的都是虚拟终端
+
+
+**单实例守护进程**：锁文件`/var/run/name.pid`
+
+启动脚本文件：`/etc/rc*...`
+
 
 ## 系统日志
-
-
-
-
-
-
-
-
+`syslogd`服务
+```c
+#include <syslog.h>
+
+/**
+ *  打开系统日志
+ *
+ * @prarm: ident  标识符
+ * @prarm: option 选项   LOG_CONS, LOG_NDELAY, LOG_NOWAIT, LOG_PERROR ...
+ * @prarm: facility  来源  LOG_USER, LOG_DAEMON, LOG_KERN, LOG_LOCAL0~7 ...
+ */
+void openlog(const char *ident, int option, int facility);
+
+/**
+ *  记录系统日志
+ *
+ * @prarm: priority  优先级 以 ERR 与 WARNING 为分界点
+ * @prarm: format 格式化字符串
+ * @prarm: ... 格式化参数
+ */
+void syslog(int priority, const char *format, ...);
+
+/**
+ *  关闭系统日志
+ */ 
+void closelog(void);
+```
+
+```bash
+sudo tail /var/log/messages  # 老师
+journalctl -r  # 我的debian
+```
 
 
 
diff --git a/C13-Linux系统编程/process_basic/daemon/mydaemon.c b/C13-Linux系统编程/process_basic/daemon/mydaemon.c
new file mode 100644
index 0000000..607a37c
--- /dev/null
+++ b/C13-Linux系统编程/process_basic/daemon/mydaemon.c
@@ -0,0 +1,83 @@
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <sys/syslog.h>
+#include <syslog.h>
+#include <time.h>
+#include <unistd.h>
+
+#define FNAME "/tmp/out"
+
+static int deamonize(void)
+{
+    pid_t pid;
+    int   fd;
+
+    pid = fork();
+    if (pid < 0)
+        return -1;
+
+    if (pid > 0)   // parent process
+        exit(0);
+
+    fd = open("/dev/null", O_RDWR);
+    if (fd < 0)
+        return -1;
+
+    dup2(fd, 0);
+    dup2(fd, 1);
+    dup2(fd, 2);
+    if (fd > 2)
+        close(fd);
+
+    setsid();
+
+    chdir("/");   // 防止一直占用某设备
+    // umask(0);
+
+    return 0;
+}
+
+int main(int argc, char **argv)
+{
+    FILE *fp;
+    int   i;
+
+    openlog("mydaemon", LOG_PID, LOG_DAEMON);
+
+    if (deamonize())
+    {
+        syslog(LOG_ERR, "daemonize() failed!");
+        exit(1);
+    }
+    else
+    {
+        syslog(LOG_INFO, "daemonize() success!");
+    }
+
+    fp = fopen(FNAME, "w");
+    if (fp == NULL)
+    {
+        syslog(LOG_ERR, "fopen() failed!: %s", strerror(errno));
+        exit(1);
+    }
+
+    syslog(LOG_INFO, "%s was opened successfully!", FNAME);
+
+    for (i = 0;; i++)
+    {
+        fprintf(fp, "%d\n", i);
+        fflush(fp);   //! 刷新缓冲区
+        syslog(LOG_DEBUG, "%d is printed", i);
+        sleep(1);
+    }
+
+    // 目前守护进程只能异常终止，下面其实无法执行到
+    fclose(fp);
+    closelog();
+
+    exit(0);
+}
\ No newline at end of file
diff --git a/C13-Linux系统编程/process_basic/system.c b/C13-Linux系统编程/process_basic/system.c
new file mode 100644
index 0000000..e4ea71f
--- /dev/null
+++ b/C13-Linux系统编程/process_basic/system.c
@@ -0,0 +1,9 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main(int argc, char **argv)
+{
+    system("date +%s > /tmp/out");
+
+    exit(0);
+}
\ No newline at end of file
diff --git a/C13-Linux系统编程/process_basic/system1.c b/C13-Linux系统编程/process_basic/system1.c
new file mode 100644
index 0000000..d9697e5
--- /dev/null
+++ b/C13-Linux系统编程/process_basic/system1.c
@@ -0,0 +1,38 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+/**
+ * @brief    few: folk, execl, wait
+ * @details
+ *
+ * @param    argc
+ * @param    argv
+ * @return  int
+ */
+int main(int argc, char **argv)
+{
+    pid_t pid;
+
+    fflush(NULL);
+
+    pid = fork();
+    if (pid < 0)
+    {
+        perror("fork()");
+        exit(1);
+    }
+
+    if (0 == pid)   // child
+    {
+        execl("/bin/sh", "sh", "-c", "date +%s", NULL);
+        perror("execl()");
+        exit(1);
+    }
+
+    wait(NULL);
+
+    exit(0);
+}
\ No newline at end of file