Skip to main content
Welcome to this comprehensive guide on diagnosing and managing Linux processes. In this article, you will learn how processes are created, monitored, and terminated on Linux systems. We will explain key commands such as ls, ps, top, nice, renice, kill, and lsof, while also demonstrating how to control processes using backgrounding, foregrounding, and job control.

​
Process Basics

Every time you launch a program, it runs as a process until it completes its task or is terminated. For instance, when you run the command ls, a temporary process is created to display the directory’s contents and then it ends.
Once the ls command finishes listing the directory, its corresponding process terminates.

​
The ps Command

The ps command is an essential tool for inspecting processes on a Linux system. However, it can be a bit confusing because it supports two syntax styles: Unix-style (options prefixed with a dash) and BSD-style (without a dash). For example, ps -a differs from ps a as each produces distinct outputs. For further details, refer to the manual page using:
By default, running ps without options displays processes associated with the current terminal session:
To view all processes running on the system, combine options a, x, and u:
The output includes several useful columns:
  • USER: The user who initiated the process.
  • PID: The Process ID.
  • %CPU: The percentage of one CPU core’s capacity consumed.
  • %MEM: The percentage of total system memory used.
  • START: The time the process started.
  • TIME: CPU time consumed by the process.
  • COMMAND: The command, along with its arguments, that started the process.
Kernel processes are enclosed in square brackets (e.g., [kthreadd]), while user-space processes are not.

​
Monitoring Processes with top

Unlike ps, which offers a snapshot view, the top command provides continuous, real-time monitoring of processes. It dynamically orders processes based on CPU usage, offering an interactive overview:
Use the arrow keys or the page up/down keys to scroll through the list. To exit the top utility, simply press the Q key.

​
Filtering and Searching Processes

​
Viewing a Specific Process with ps

If you need details about a specific process, such as the one with PID 1, use the following:
For a user-oriented display or to list processes belonging to a particular user (for example, “aaron”), run:

​
Searching by Process Name with pgrep

The pgrep command allows you to search for processes by name. For example, to list processes that include “syslog” in their name, along with their full command details:

​
Process Niceness and Priority

Linux employs a “niceness” value ranging from -20 to +19 to determine process scheduling priority—a lower niceness value equates to a higher priority. For instance, a process with a niceness of -20 can preempt one with a value of 19 when both require CPU time.

​
Setting Nice at Launch

Launch a process with a specified niceness using the nice command. For example, to start a new Bash shell with a niceness of 11:
You can verify the niceness value using the BSD long format with ps -l:
Processes inherit the niceness value of their parent by default.
A regular user can only increase the niceness value (i.e., lower the priority) to values between 0 and 19. To assign a negative niceness (i.e., higher priority), root privileges are necessary. For example, attempting to start Bash with a higher priority as a non-root user produces:
Using sudo allows for a negative nice value:
When you check with ps, the Bash process will show a negative niceness value.

​
Changing Niceness with renice

To adjust the niceness of a running process, use the renice command. For instance, if a Bash shell running as user “aaron” with PID 8209 has a niceness of 12, you can change it to 7 as follows:
As a regular user, you can only decrease the priority once per session. Further priority reductions require root privileges.

​
Sending Signals to Processes

Linux processes can receive signals to prompt various actions, such as termination or pause. Two critical signals, SIGSTOP and SIGKILL, cannot be ignored or handled by the process:
  • SIGSTOP: Temporarily pauses the process until a SIGCONT signal is received.
  • SIGKILL: Immediately terminates the process without cleanup.
To view a list of signals, use:
You can specify a signal by its name (with or without the SIG prefix) when sending it to a process with the kill command. For example, to send a SIGHUP (hang-up) signal:
If no signal is explicitly stated, SIGTERM (termination) is sent by default.

​
Example: Restarting the SSH Service

Start by checking the status of the SSH daemon:
Attempting to send a SIGHUP to process 1147 without root privileges will fail:
Using sudo resolves the permission issue:
When the SSH daemon receives the hang-up signal, it is programmed to restart automatically.

​
Using pkill

The pkill command allows you to send signals to all processes that match a specified name. For example, to send SIGKILL to all processes with “bash” in their name, first view the matching processes with:
Then, if appropriate, execute:
Be cautious when terminating processes. Ending your shell (bash) could cause you to lose your terminal session.

​
Job Control: Backgrounding, Foregrounding, and Pausing

Linux provides robust job control mechanisms to allow you to pause, resume, or run processes in the background.

​
Suspending and Resuming Processes

For long-running commands like sleep 180, you might want to interrupt without completely terminating the process. Pressing Ctrl + C aborts a running process. However, for interactive applications like vim, you can suspend it with Ctrl + Z:
To bring the process back to the foreground, execute:

​
Running Processes in the Background

Appending an ampersand (&) to a command runs it in the background, allowing you to continue using the terminal:
Use the jobs command to list active jobs:
To move a background job to the foreground, specify its job number:
If you accidentally bring a long-running process to the foreground, you can pause and then resume it in the background by pressing Ctrl + Z followed by:

​
Listing Open Files with lsof

The lsof command (short for “list open files”) provides a list of files and directories in use by a process. For example, to list files open by your Bash shell (suppose its PID is 8401):
If you attempt to view open files for a process owned by root, using sudo might be required:
Similarly, to identify which process is writing to /var/log/messages:

​
Exploring Process Relationships

To visualize the parent–child relationships between processes, use the forest option with ps:
This command displays processes in a tree-like format and can be combined with options such as ps aux for extra detail.

​
Process Management Summary

In this article, we covered various techniques for process management in Linux, including:
  • Viewing process snapshots with ps
  • Continuous monitoring using top
  • Adjusting process priority with nice and renice
  • Sending signals with kill and pkill
  • Managing processes with job control commands (fg, bg, and jobs)
  • Investigating open files using lsof
  • Visualizing process relationships
The image shows a terminal window displaying the manual page for the ps command, which reports a snapshot of current processes. It includes sections like NAME, SYNOPSIS, and DESCRIPTION.
This concludes our deep dive into diagnosing and managing processes in Linux. With these techniques, you’ll be well-prepared to troubleshoot and manage processes effectively in any Linux environment. Happy troubleshooting!

Watch Video