Skip to main content
In this guide, you will learn how Linux handles processes and discover various techniques to diagnose and manage them effectively. Every command you execute creates a process that runs until it completes its task or is manually terminated. For instance, running a command like “ls” creates a short-lived process that displays the directory contents and then exits, while services like the SSH daemon run continuously in the background. Below is an example that lists all files—including hidden ones—using the ls command:

​
Using the ps Command

The ps command is a fundamental utility for inspecting active processes. It has several option syntaxes, reflecting both Unix and BSD styles. For example, ps -a uses Unix-style options, while ps -A (uppercase A) follows BSD syntax, leading to different outputs. Running ps without any options only displays processes associated with the current terminal session. To see all processes running on the system, combine the options a, x, and u:
In this command:
  • The ax options ensure that processes from all controlling terminals are listed.
  • The u option presents a user-oriented format, adding columns for memory and CPU usage as well as the process owner. This is why ps aux is widely used for obtaining a complete snapshot of system processes.

​
Analyzing the ps aux Output

Review the typical columns shown in the ps aux output: Processes displayed within square brackets (e.g., [kthreadd]) are kernel processes operating in privileged areas and usually do not require user interaction. Only processes outside these brackets represent user-space applications.

​
Monitoring Processes in Real Time with top

While ps gives you a static snapshot, the top command is ideal for real-time process monitoring. It continuously updates its display and reorders the processes by CPU usage, making it easier to identify resource-intensive processes. Use the arrow keys to navigate the list, and press “Q” to exit. Below is an example output of the top command:
You can filter process listings by specific criteria such as PID or user. For example, to view details for process 1:
For detailed user-oriented information about process 1, run:
To list processes started by a specific user (e.g., jeremy), use the uppercase -U option:
Additionally, you can search for processes by name using the pgrep command with the -a option to display the complete command line:

​
Adjusting Process Priority Using Niceness and renice

Linux processes have a “niceness” value that determines their scheduling priority. This value ranges from -20 (highest priority) to 19 (lowest priority). When launching a process, you can assign a niceness value. For example, launching a bash shell with a niceness value of 11:
Note that the default ps aux output does not include niceness values. To view these, use the BSD long format with ps l, which displays the NI column:
Child processes inherit the niceness value from their parent process. To modify the niceness of an already running process, use the renice command. For example, to change the nice value of a process with PID 12238 from 0 to 7:
Only superusers can lower the nice value (i.e., increase priority) of a process. Regular users can only increase the niceness value.

​
Sending Signals to Processes

Linux signals prompt processes to perform actions such as stopping, pausing, or terminating. Although some signals can be handled gracefully by applications, signals like SIGSTOP and SIGKILL are non-catchable. SIGSTOP pauses a process until it receives a SIGCONT, while SIGKILL immediately terminates it. List all available signals using:
For example, to send a SIGHUP signal (which typically instructs a process to reload its configuration) to the SSH daemon with PID 1457, use:
Since SSHD runs as root, a normal user must prepend sudo:
When no signal is specified, the kill command sends SIGTERM by default for a graceful shutdown. To forcefully terminate a process, you can use SIGKILL in any of these ways:
The pkill command lets you send signals based on process names. For example, to send SIGKILL to all processes with “bash” in their name, first verify the target processes:
If the list is correct, use:
Be very careful when terminating processes with signals such as SIGKILL. Stopping critical processes may lead to system instability or disconnect you from your session.

​
Managing Background and Foreground Processes

Long-running tasks can be executed in the background, allowing you to use your terminal for other commands. For example, to run a sleep command for 180 seconds:
If you need to interrupt a process, press CTRL-C. In applications like Vim, you can suspend the process temporarily by pressing CTRL-Z:
To bring a suspended process back to the foreground, execute:
For processes started in the background using an ampersand (&):
To resume work on a backgrounded process, you can bring it to the foreground with fg or continue running it in the background using bg.

​
Checking Open Files with lsof

The lsof command lets you inspect which files or directories are in use by a process. First, obtain the PID of your bash shell:
Then, list all open files for that process:
If you need to check files for processes requiring elevated privileges (or if you suspect missing information), prepend sudo:

​
Conclusion

This guide has demonstrated multiple techniques for diagnosing and managing processes in Linux. You learned to inspect processes with ps and top, adjust process priorities using nice and renice, send signals with kill and pkill, manage background and foreground tasks, and inspect open files with lsof. Mastering these tools is essential for effective system administration and troubleshooting on Linux. For more in-depth knowledge, explore additional resources such as:

Watch Video