When you manage a Linux system, the ability to see running processes is essential for troubleshooting, performance tuning, and security audits. Understanding which applications and daemons are active helps you respond quickly to resource issues or unexpected behavior.
This guide introduces practical commands and workflows for viewing processes, with a focus on real use cases, output interpretation, and actionable next steps.
| Command | Scope | Key Options | Best For |
|---|---|---|---|
| ps | Snapshot of current processes | -ef, aux, --forest | Quick inspection and scripting |
| top | Live, dynamic view | -b, -n, -o %CPU | Interactive performance monitoring |
| htop | Enhanced interactive view | F2 setup, F6 sorting, F9 kill | User-friendly process management |
| pidof | Find PIDs by process name | -s, -x | Scripting and service checks |
| pgrep/pkill | Match processes by name or attribute | -f, -u, -a | Targeted signals and actions |
Reading ps Output Effectively
The ps command is the foundation for seeing running processes on any Unix-like system. Learning to read its columns helps you quickly identify resource owners and potential issues.
Common ps Options and Fields
Using ps -ef or ps aux reveals USER, PID, %CPU, %MEM, VSZ, RSS, TTY, STAT, START, TIME, and COMMAND. These fields let you filter by user, sort by CPU or memory, and spot zombie or stopped processes indicated by STAT codes like Z or T.
Process Hierarchy with --forest
The ps --forest view indents child processes under their parent, making it easy to understand how services, workers, and sub-processes relate. This layout is particularly useful for diagnosing complex application stacks or runaway daemons.
Interactive Monitoring with top and htop
While ps gives a static snapshot, top and htop provide a live updating view of system load and process activity. These tools allow you to sort by different metrics and watch behavior over time.
Sorting and Filtering in top
Inside top, pressing P sorts by %CPU and M sorts by memory usage. You can also filter by user with u and restrict the displayed processes, which helps when you focus on a specific service owner.
Enhanced UX with htop
htop builds on top with a colorful interface, mouse support, and function keys. F6 lets you choose sort columns, F9 sends signals to processes, and F2 opens an options menu to tweak display settings, making it easier to manage processes efficiently.
Searching for Processes by Name and Attribute
When you know part of a process name or the user that owns it, dedicated search tools let you locate matching entries without manual scanning. These utilities are ideal for automation and targeted troubleshooting.
Using pgrep and pidof
The pgrep command prints PIDs based on name and optional attributes like user or terminal. pidof returns the PIDs for a given program name, which is useful in scripts that need to check whether a service is already running before starting it again.
Flexible Matching with pkill
pkill and killall send signals to processes whose names match a pattern. With -f, they consider the full command line, enabling you to manage complex workloads where the executable path does not fully describe the intended target.
Troubleshooting Performance and Zombie Processes
High CPU or memory usage, unresponsive services, and zombie processes are classic reasons to investigate the process table. Knowing which metrics to watch and how to interpret process states helps you resolve incidents faster.
Identifying Resource Hogs
Sort processes by CPU or memory in top or htop to locate offenders. Use ps --sort=-%cpu` or `ps --sort=-%mem` for an instant ranking. Long-running processes in D state may indicate I/O wait issues that require deeper storage analysis.
Handling Zombie and Stopped Processes
Zombie processes, shown with Z in the STAT column, have exited but still hold a table entry until the parent waits on them. Stopped processes, marked with T, can often be continued with kill -CONT or inspected to understand why they were paused by job control or debugging tools.
Key Takeaways and Recommended Workflows
- Use
ps auxorps -effor a quick snapshot of all processes. - Leverage
toporhtopfor continuous monitoring and interactive sorting by CPU or memory. - Search efficiently with
pgrep,pidof, andpkillwhen you need to match processes by name or user. - Interpret STAT codes to identify zombies, stopped tasks, or processes stuck in uninterruptible sleep.
- Start with polite signals like SIGTERM and reserve SIGKILL for cases where graceful shutdown fails.
FAQ
Reader questions
How can I see processes for a specific user only?
Use ps -u username to list processes owned by a particular user, or combine pgrep -u username -l to get PIDs and names in a concise form.
What does the STAT column indicate in process listings?
STAT codes describe process state, such as R for running, S for sleeping, Z for zombie, and T for stopped. These indicators help you quickly assess whether a process is active, waiting, or stuck.
How do I terminate a process safely using the CLI?
Start with pgrep or pidof to confirm the PID, then send SIGTERM using kill PID . If the process does not exit, escalate to SIGKILL with kill -9 PID only when necessary.
Can I monitor system load and uptime while checking processes?
Yes, tools like top and htop display load averages and uptime alongside process details, allowing you to correlate system performance with specific workloads.