Create Monitor and Kill Processes

Hello — this lesson covers how to diagnose and manage processes on Linux systems. You’ll learn how processes are created, how to inspect running processes and the files they have open, and the common ways to terminate processes safely.

What is a process?

Whenever you run a program, the operating system creates a process for it. Processes fall into two broad categories:

Short-lived commands: utilities like ls, cp, or small scripts that run and exit quickly.
Long-lived services (daemons): system services like sshd that typically run continuously in the background.

Example: running ls spawns a short-lived process that lists directory contents and then exits:

[aaron@LFCS-CentOS ~]$ ls
3                      file3.xz
absolute_picture_shortcut  fstab_shortcut
all_output.txt          Music
archive.tar             nomachine_7.7.4_1_x86_64.rpm
archive.zip             Pictures
Desktop                 Public
Documents               relative_picture_shortcut
Downloads               script.sh
file1                   shortcut_to_directory
file1.gz                Templates
file2                   testfile
file2.bz2               Videos
file3
[aaron@LFCS-CentOS ~]$

Inspect running processes with ps

The primary tool for listing processes is ps. Important to note: ps supports two option styles that are not identical:

Unix/POSIX-style options use a leading dash (e.g., -A, -e).
BSD-style options do not use a leading dash (e.g., a, x, u).

Check the manual if behavior seems unexpected:

man ps
# inside man: type /EXAMPLES to search the EXAMPLES section, press n for next, and q to quit

Running ps with no options shows processes associated with the current terminal/session:

[aaron@LFCS-CentOS ~]$ ps
  PID TTY          TIME CMD
 7726 pts/0    00:00:00 bash
 7796 pts/0    00:00:00 ps
[aaron@LFCS-CentOS ~]$

A common, user-oriented way to view all processes is the BSD-style ps aux, which lists every process with human-friendly columns:

[aaron@LFCS-CentOS ~]$ ps aux
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
aaron     6955  0.0  0.0  41604  340 ?        S    Mar23   0:00 /usr/bin/VBox
aaron     6958  0.0  0.0 174356 2840 ?        Sl   Mar23   0:00 /usr/bin/VBox
root      7315  0.0  0.0      0    0 ?        R    Mar23   0:00 [kworker/u8:0]
...
aaron     7726  0.0  0.1  25584 5532 pts/0  Ss   00:19   0:00 bash
aaron     7848  0.0  0.1  58752 3968 pts/0  R+   00:24   0:00 ps aux
[aaron@LFCS-CentOS ~]$

Key columns explained:

Column	Meaning
USER	Owner of the process
PID	Process ID (unique identifier)
%CPU	CPU usage percentage
%MEM	Memory usage percentage
VSZ	Virtual memory size (KB)
RSS	Resident Set Size — actual RAM used (KB)
TTY	Controlling terminal (if any)
STAT	Process state and flags
START	Start time or date
TIME	CPU time consumed
COMMAND	Command line that started the process

Common ps option examples:

Purpose	Command
Show all processes (BSD style)	`ps aux`
Show all processes (Unix style)	`ps -ef`
Show processes for a specific user	`ps -u username`
Show a tree view of processes	`ps axjf` or use `pstree`

Inspect files a process has open with lsof

To see which files, sockets, or directories a process has open, use lsof (list open files). Use -p to specify a PID:

# List open files for the bash process with PID 8401
[aaron@LFCS-CentOS ~]$ lsof -p 8401
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
bash    8401 aaron  mem    REG 253,0   286   34275178 /usr/lib/locale/en_US.utf8/LC_MONETARY
bash    8401 aaron  mem    REG 253,0    57   34201565 /usr/lib/locale/en_US.utf8/LC_MESSAGES/SYS_LC_MESSAGES
bash    8401 aaron  mem    REG 253,0    34     364695 /usr/lib/locale/en_US.utf8/LC_PAPER
bash    8401 aaron  0u   CHR 136,0    0t0 3 /dev/pts/0
bash    8401 aaron  1u   CHR 136,0    0t0 3 /dev/pts/0
bash    8401 aaron  2u   CHR 136,0    0t0 3 /dev/pts/0
bash    8401 aaron  3r   REG 253,0 9253600 51404100 /var/lib/sss/mc/passwd
[aaron@LFCS-CentOS ~]$

If the target process is owned by another user (for example, root), you will often need elevated privileges to get the full output. Prefix with sudo when necessary:

# Viewing open files for PID 1 (systemd) requires root privileges
[aaron@LFCS-CentOS ~]$ sudo lsof -p 1
[sudo] password for aaron:
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
systemd     1 root  cwd    unknown    /proc/1/cwd (readlink: Permission denied)
systemd     1 root  rtd    unknown    /proc/1/root (readlink: Permission denied)
systemd     1 root  txt    unknown    /proc/1/exe (readlink: Permission denied)
systemd     1 root  NOFD   /proc/1/fd (opendir: Permission denied)
...

lsof may warn about incomplete output for certain filesystems (for example, FUSE filesystems used by virtual file systems). Example:

[aaron@LFCS-CentOS ~]$ sudo lsof /var/log/messages
lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs
        Output information may be incomplete.
COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
rsyslogd 1455 root    7w   REG  253,0 168083 50504595 /var/log/messages
[aaron@LFCS-CentOS ~]$

Terminate (kill) processes

When you need to stop a process, prefer graceful methods first, then escalate if necessary.

Action	Command	Notes
Send SIGTERM (ask process to terminate)	`kill <PID>`	Default safe termination signal.
Send SIGKILL (force kill)	`kill -9 <PID>`	Forces immediate termination; not graceful.
Kill by process name	`pkill <name>` or `pkill -f '<pattern>'`	Match on full command line with `-f`.
Kill all processes by name	`killall <name>`	Kills all processes matching the program name.

Examples:

# Gracefully ask PID 1234 to terminate
kill 1234

# Forcefully kill PID 1234
kill -9 1234

# Kill all processes whose command line matches "my_script"
pkill -f my_script

# Terminate every process named "firefox"
killall firefox

Best practices:

Try kill <PID> (SIGTERM) first so the process can clean up.
Use kill -9 <PID> (SIGKILL) only when the process is unresponsive.
Be careful when using pkill or killall on production systems — they can affect multiple processes.

Callout: ps option styles

Remember that ps accepts both BSD-style (no leading dash) and Unix/POSIX-style (leading dash) options. They are not interchangeable — check man ps if behavior seems unexpected.

Troubleshooting tips

If ps output is missing columns or looks different, you may be mixing BSD and Unix ps options. Consistently use ps aux or ps -ef depending on your needs.
When lsof reports permission errors or incomplete output, re-run with sudo to inspect system processes and protected files.
Use top or htop for real-time, interactive process monitoring and sorting by CPU or memory.

Summary

Processes are created when programs run; short-lived commands exit quickly while daemons run long-term.
ps is the standard tool to list processes. ps aux is a common BSD-style view; ps -ef is the Unix-style equivalent.
Use lsof -p \<PID>`to list files a process has open; run withsudo` to see processes owned by other users.
Terminate processes with kill for a graceful stop, and kill -9 only if necessary. Use pkill or killall when matching by name or pattern.

Links and references

ps(1) manual — man7.org
lsof(8) manual — linux.die.net
sudo(8) manual — linux.die.net
Kubernetes Documentation (for process concepts in containerized environments)

Introduction

System Architecture

Linux Installation and Package Management

GNU and Unix Commands

Devices, Linux Filesystems, Filesystem Hierarchy Standard

Conclusion and Mock Exam

Create Monitor and Kill Processes

What is a process?

Inspect running processes with ps

Inspect files a process has open with lsof

Terminate (kill) processes

Troubleshooting tips

Summary

Links and references

Watch Video

​What is a process?

​Inspect running processes with ps

​Inspect files a process has open with lsof

​Terminate (kill) processes

​Troubleshooting tips

​Summary

​Links and references

Watch Video

What is a process?

Inspect running processes with ps

Inspect files a process has open with lsof

Terminate (kill) processes

Troubleshooting tips

Summary

Links and references