Table of Contents
Understanding Processes on Linux
A process is a running instance of a program. Every command you start from the terminal, every background service, and every graphical application is a process.
Linux assigns each process a PID (Process ID), a number that uniquely identifies it while it is running. Processes also have:
- A parent process (PPID) that started them
- An owner (user account)
- A state (running, sleeping, stopped, zombie, etc.)
- A priority and nice value (how the scheduler treats the process)
- Resource usage (CPU time, memory, open files, etc.)
In this chapter you’ll learn how to see, understand, and influence processes from the command line.
Basic Process Concepts
Process vs program vs command
- A program is a file on disk (for example,
/usr/bin/ls). - A command is what you type in the shell (for example,
ls -l /home). - A process is what runs when the program is executed, with its own PID and state.
A single program can create many processes (for example, a web browser spawns helper processes).
Foreground and background
From an interactive shell:
- A foreground process is attached to your terminal; it receives your keystrokes and prints output. Your shell waits until it finishes.
- A background process is detached from your keyboard. Your shell prompt returns immediately and you can keep working while it runs.
Foreground and background control for your own shell session is covered in detail in the dedicated “Foreground and background jobs” chapter; here we focus on processes system-wide.
Viewing Processes
There are many tools to view processes. For beginners, the most important are ps, top, and htop.
Listing processes with `ps`
The ps command shows a snapshot of running processes.
Common usages:
ps # processes in the current shell session
ps x # your processes, including those without a terminal
ps aux # all processes (BSD-style options)
ps -ef # all processes (Unix-style options)Some commonly used columns (you may see a subset depending on options):
USER– user that owns the processPID– process ID%CPU– percentage of CPU time used%MEM– percentage of RAM usedVSZ– virtual memory sizeRSS– resident (actual) memory usedTTY– controlling terminal, if anySTAT– process state and flagsSTART– when the process startedTIME– total CPU time usedCOMMAND– program and arguments
Example:
ps aux | headTypical output line:
root 1 0.0 0.1 167808 8844 ? Ss 10:00 0:02 /sbin/initHere:
root– owner1– PID?– no controlling terminal (system service)Ss– sleeping, session leader/sbin/init– program name
Filtering processes with `ps`
You can combine ps with grep to locate processes:
ps aux | grep ssh
ps -ef | grep firefox
Include grep carefully: it will show up as its own line. You can filter it out, for example:
ps aux | grep ssh | grep -v grep
Another approach is using pgrep:
pgrep ssh # show PIDs of processes whose name matches 'ssh'
pgrep -a ssh # show PIDs and full commands`top`: real-time process viewer
top shows processes and system usage in real time. Run it simply as:
topKey parts of the display:
- System summary (load average, memory usage)
- A list of processes sorted by CPU usage by default
Common keys inside top:
q– quith– helpP– sort by CPU usageM– sort by memory usagek– kill a process (you will be asked for a PID and a signal; details of signals are covered in the “Killing processes” chapter)u– filter by userShift + >/Shift + <– change sort column
You can limit how many lines are shown by combining with head is not possible because top is interactive; instead, use non-interactive tools like ps if you need simple one-shot output.
`htop`: a friendlier `top` (if installed)
htop is not always installed by default, but many distributions provide it.
Key differences from top:
- Colored, more readable interface
- Use arrow keys to navigate
- Function keys (F1–F10) for actions
- Easy process tree view
Typical keys:
F3– searchF4– filterF5– tree view (parent-child relationships)F9– kill selected process
Depending on your system, you may need to install it, for example:
sudo apt install htop # Debian/Ubuntu
sudo dnf install htop # Fedora/RHELUnderstanding Process States and Status
Process state or STAT (from ps) tells you what a process is currently doing.
Common STAT characters:
R– Running (or runnable)S– Sleeping (waiting for an event, most normal processes spend time here)D– Uninterruptible sleep (usually waiting for I/O; cannot be easily killed)T– Stopped (for example, via a signal or job control)Z– Zombie (process finished but its parent has not yet collected its exit status)
Additional flags can be appended, such as:
s– session leader+– in the foreground process groupl– multi-threaded
Example:
ps -o pid,stat,cmd -p 1Output might look like:
PID STAT CMD
1 Ss /sbin/initProcess IDs and Parent/Child Relationships
Every process has:
- A PID – its own unique identifier
- A PPID – parent’s PID (the process that started it)
To see this:
ps -o pid,ppid,cmd | headExample:
PID PPID CMD
1 0 /sbin/init
723 1 /usr/lib/systemd/systemd-udevd
1550 1200 /usr/bin/bash
1601 1550 /usr/bin/python3 script.pyYou can also show a process tree:
ps axjf # tree format (style depends on distro)or, if installed:
pstree
pstree -p # show PIDs
pstree -u # show usernamesParent-child relationships matter because:
- When a parent dies, children are typically adopted by PID 1 (
systemdon most systems). - Some tools manage whole process trees (for example, killing a parent may or may not kill its children, depending on how the program works and how signals are sent).
Finding Processes by Name or Other Attributes
Beyond ps | grep, there are more specialized tools.
`pgrep` and `pkill` (for matching by name)
pgrep lists process IDs by name:
pgrep ssh
pgrep -u youruser bash # all bash processes owned by 'youruser'
pgrep -a firefox # include the command line
pkill sends signals to processes matching a pattern (full details about signals in “Killing processes”):
pkill firefox # send default signal (TERM) to all firefox processes
pkill -u youruser bash # signal all bash processes owned by youruser
Use pkill with care, as it can affect multiple processes at once.
`ps` with filters
ps can filter by user, PID, etc.:
ps -u youruser # processes owned by youruser
ps -p 1234 -o pid,user,cmd # specific PID with selected columnsMonitoring Resource Usage Per Process
Often you want to know which processes are using the most CPU or memory.
Using `ps` to see top consumers
List all processes and sort by memory:
ps aux --sort=-%mem | headSort by CPU:
ps aux --sort=-%cpu | headThe first few lines will be the heaviest users.
Using `top` or `htop` interactively
topdefaults to sorting by CPU; pressMto sort by memory.htoplets you click (or use arrow keys andF6) to choose different sort columns.
This is useful to quickly identify “what is making the fan spin” or “what is using all my RAM”.
Process Priorities and Niceness (Overview)
Linux uses a scheduler to share the CPU between processes. Each process has:
- A priority (used internally by the kernel)
- A nice value (
NIintoporps) that influences how favorably the scheduler treats it
Niceness ranges from $-20$ (highest priority) to $19$ (lowest priority). Counterintuitively:
- Lower
NIvalue → process is treated as more important. - Higher
NIvalue → process is more “polite” and yields CPU to others.
You can see the nice value with:
ps -o pid,ni,cmd | head
The details of changing niceness (nice, renice) and advanced resource control are typically considered a more intermediate topic; for basic usage, it’s enough to know that:
- Background, non-critical tasks sometimes run with higher nice values.
- System services and interactive processes often use default or lower nice values.
Inspecting Details of a Single Process
Sometimes you want to know everything about one particular process.
Using `ps` with `-p`
For one PID:
ps -p 1234 -o pid,user,%cpu,%mem,stat,etime,cmdWhere:
etime– elapsed time since the process startedcmd– full command line
Looking into `/proc`
Linux exposes process information through the /proc pseudo-filesystem. For a process with PID 1234, you’ll see a directory /proc/1234 (while it’s running) containing many files.
Some useful ones:
/proc/1234/cmdline– exact command-line arguments/proc/1234/environ– environment variables (separated by NUL, not newlines)/proc/1234/status– human-readable status (owner, memory usage, etc.)/proc/1234/fd/– directory of file descriptors that process has open
Example:
cat /proc/1234/status
ls -l /proc/1234/fd
This is mainly for deeper debugging or curiosity; day-to-day, you’ll usually rely on ps, top, and tools built on top of /proc.
Practical Examples
Example: Finding which process is using port 80
Network details are covered in the networking chapters; here is a quick process-related use.
On modern systems, you can use ss or lsof:
sudo ss -ltnp 'sport = :80'or:
sudo lsof -i :80
Both commands show which process (PID and name) is bound to port 80, so you can then inspect or manage that process with ps, top, or other tools.
Example: Checking what your terminal is running
To see what process is attached to your current shell’s terminal:
ps -t $(tty)This shows the shell and any foreground/background processes using that terminal as their TTY.
Summary
In this chapter you learned how to:
- View running processes using
ps,top, and optionallyhtop - Understand basic process attributes: PID, PPID, state, owner, and resource usage
- Filter and search for processes using
ps,pgrep, and related tools - Inspect process trees and parent-child relationships
- Get detailed information for a single process via
psand/proc
You will build on this foundation in the dedicated chapters about killing processes, foreground and background jobs, and system services and daemons, where you’ll learn how to control, stop, and manage processes more actively.