What is a process?
A process is a running program. Every process has an ID (the PID), a user,
and a state. You manage processes with ps, top, kill and friends.
ps — list processes
ps shows a snapshot of running processes.
$ ps
PID TTY TIME CMD
1234 pts/0 00:00:00 bash
1456 pts/0 00:00:00 ps
For all processes on the system, the standard flag set is aux:
$ ps aux
| Flag | Meaning |
|---|---|
aux |
all processes, all users, extended detail |
-ef |
alternative way to show every process |
The output shows PID, the user, CPU and memory use, and the command line.
Search for a specific process by piping to grep:
$ ps aux | grep sshd
(The | is a pipe — it sends ps’s output into grep, which keeps
only lines containing sshd. Pipes get a full treatment in Chapter 13;
grep in Chapter 8.)
Sort the list by memory use (biggest first):
$ ps aux --sort=-%mem
top — live process list
top shows processes updating live, sorted by CPU use. Press q to quit.
$ top
| Key | Action |
|---|---|
q |
quit |
k |
kill a process (asks for PID) |
M |
sort by memory |
P |
sort by CPU (default) |
htop — friendlier live monitor
htop is an interactive alternative to top with a more readable layout,
colors, and a scrollable list.
$ htop
F10 quits (as does the q key). htop is not installed by default
on Ubuntu, Fedora or Arch — install it first:
$ sudo apt install htop # Ubuntu
$ sudo dnf install htop # Fedora
$ sudo pacman -S htop # Arch
watch — re-run a command repeatedly
watch re-runs a command every two seconds and shows the output updating
on screen. It is perfect for watching a value change over time:
$ watch free -h
$ watch uptime
Press Ctrl+C to stop. -n <seconds> changes the interval:
$ watch -n 5 df -h
kill — stop a process
kill sends a signal to a process, usually to ask it to stop.
$ kill 1234
If a process ignores the normal request, escalate the signal:
$ kill -9 1234 # SIGKILL: force it, no chance to clean up
Find the PID first with pgrep:
$ pgrep sshd
5678
$ kill 5678
Use -9 only as a last resort — the process cannot save its state.
If you know the process name instead of the PID, pkill and killall send
signals by name:
$ pkill sshd
$ killall firefox
pkill matches a name pattern; killall matches the exact process name.
Both accept the same signals, so pkill -9 sshd works too. Be careful: they
kill every matching process, not just one.
Graphical alternative: System Monitor / KSysGuard can end processes with a right-click, but
killworks even on a headless server.
uptime — how long has it been running
uptime shows how long the system has been running, the load, and logged-in
users.
$ uptime
10:22:31 up 3 days, 4:02, 2 users, load average: 0.04, 0.01, 0.00
The three load-average numbers are a 1/5/15-minute average of runnable processes. Lower is better.
free — memory usage
free shows RAM and swap usage.
$ free -h
total used free shared buff/cache available
Mem: 7.7Gi 2.1Gi 3.1Gi 201Mi 2.4Gi 5.2Gi
Swap: 2.0Gi 0B 2.0Gi
-h gives human-readable sizes. Look at the available column — that is
memory the system can still hand out.
systemctl — manage services
Services (background programs that run continuously) are managed with
systemctl, covered in Chapter 14 — Services & Logs.