Linux Labs
Where to start First steps track · 15 stages
Linux Labs
EN

Processes

5 min Linux

Viewing processes, signals and priorities; finding the processes that hog CPU or memory.

Cheat sheet

9 commands Printable version
  • ps aux --sort=-%cpu | head top CPU users
  • ps aux --sort=-%mem | head top memory users
  • ps -eo pid,stat,%cpu,%mem,etime,comm --sort=-%cpu | head
  • pgrep -a name find by name
  • pkill -f pattern kill by command-line pattern
  • kill 1234 gracefully (SIGTERM)
  • kill -9 1234 forcefully (SIGKILL)
  • kill -HUP 1234 tell the daemon to reload its config
  • renice -n 5 -p 1234 a running process's priority

Overview

A process is a running program with its own PID. It has an owner, a priority, a state, and CPU/memory usage. You manage it by viewing (ps/top), sending signals (kill), and setting priority (nice).

Recipes

3

Viewing

bash 
ps aux                            # every process (BSD style: %CPU %MEM STAT)
ps aux --sort=-%cpu | head        # top by CPU
ps aux --sort=-%mem | head        # top by memory
ps -ef                            # every process (UNIX style, with PPID)
ps -eo pid,ppid,user,stat,%cpu,%mem,etime,comm --sort=-%cpu | head  # custom columns
ps -p 1234 -o pid,etime,rss,cmd   # a specific process
pgrep -a nginx                    # PIDs by name (+ command line)
pstree -p                         # the process tree, with PIDs
top                               # interactively (P=by CPU, M=by memory, k=kill, 1=per-core)
htop                              # nicer, if installed

Signals

bash 
kill 1234                         # SIGTERM (15) — politely ask it to exit
kill -9 1234                      # SIGKILL (9) — kill it hard (a last resort)
kill -HUP 1234                    # SIGHUP (1) — often means "reload the config"
kill -l                           # list every signal
pkill -f 'python app.py'          # by a pattern matching the full command line
pkill -u alice                    # every process owned by a user
killall nginx                     # by exact name
Signal # Meaning
TERM 15 graceful shutdown (the default), the process can clean up
KILL 9 kill immediately, can't be caught (data may be lost)
HUP 1 "hangup"; for daemons this often means reload the config
INT 2 like Ctrl+C
STOP/CONT 19/18 pause / resume

Priority and states

bash 
nice -n 10 cmd                    # run it with a lower priority (19 is the lowest)
renice -n 5 -p 1234               # change a running process's priority (root to raise it)
ionice -c3 -p 1234                # disk I/O priority class (idle)
chrt -f -p 50 1234                # a realtime policy (be careful)

The STAT column in ps: R running/runnable, S sleeping (waiting for an event), D uninterruptible sleep (waiting on I/O — kill won't touch it!), Z zombie, T stopped, I idle kernel thread; suffixes + (foreground), < (high nice), s (session leader).

Troubleshooting

5

A process is hogging CPU

top (or ps aux --sort=-%cpu | head) → find the PID → wait it out / renice / kill. Try TERM first, only then KILL.

A memory leak / OOM

ps aux --sort=-%mem | head; in the journal — journalctl -k | grep -i oom (the kernel killed something under memory pressure, see oom-killer).

A zombie process (Z/defunct)

Harmless by itself — it's waiting for its parent to reap it (wait). Many zombies point to a bug in the parent; restart the parent process.

kill doesn't kill it (even -9)

The process is in state D (uninterruptible sleep, waiting on I/O) — kill can't help; wait for the I/O to finish or investigate the disk/NFS. To see who's holding the files — lsof.

Which process opened a port/file

For a port — ss -tlnp; for a file/directory — lsof.

Danger zone

Danger. kill -9 (SIGKILL) gives the process no chance to close files, hand off connections, or flush data to disk — use it only after a plain TERM failed to end the process. pkill -f and killall find processes by a command-line pattern or by name: too broad a pattern kills more than the target process, including someone else's session on a shared machine. Check the list with pgrep -a before feeding the same pattern to pkill.

Terms

7
daemon
A process that handles requests or events without ongoing interactive control. Also appears in: systemd, Docker, systemd timers, at and 15 more
PID
A numeric process identifier within a PID namespace. It may be reused after termination. Also appears in: /proc: processes and the kernel as files, ulimit and process limits: open files, processes, core, kill, wait and 35 more
PPID
The parent process ID as observed in the current PID namespace. Also appears in: ps, /proc: processes and the kernel as files, kill
signal
A notification of an event or request to a process; its effect depends on the signal and program. Also appears in: kill, Exit codes: $?, && and ||, Load average: how many tasks wait for the CPU and the disk, OOM killer: when memory runs out and 12 more
zombie process
An exited process whose status has not yet been collected by its parent; it no longer runs application code.
process
A running instance of a program with its own PID, address space, open files, and credentials. New processes are created by existing ones via fork() or clone(). Also appears in: /proc: processes and the kernel as files, Docker, OOM killer: when memory runs out, ps and 63 more
nice value
A number from -20 to 19 the scheduler uses to share the CPU: the higher it is, the smaller the process's share. Start with nice -n 10 command, change a running process with renice; the owner can lower the priority, only root can raise it. Also appears in: cgroups and namespaces, Load average: how many tasks wait for the CPU and the disk, stress-ng

See also

  • ps — the process list, columns and states.
  • top — processes and load in real time.
  • kill — send a signal to a process.
  • ss — Who's listening on what ports and which connections are open — the modern netstat.
  • disk-usage — Where the space and inodes went — df, du, finding large files, gotchas.

Found an inaccuracy? Report an error in the article

Practice on this topic

Lessons on this topic

Topics
Loading…