Understanding and controlling processes is a key skill for every Linux user—especially for DevOps, system administrators, or anyone building backend systems. This guide breaks down everything you need to know about processes, their types, real-time monitoring, and how to kill them—with commands, outputs, flags, and scenarios.

🔍 What is a Process in Linux?
A process is an instance of a program that's being executed. Every command you run, service started, or script executed becomes a process.

🧬 Process Properties

  • PID: Process ID

  • PPID: Parent Process ID

  • UID/GID: User/Group ID of the owner

  • TTY: Terminal associated with the process

  • CMD: Command used to start the process

  • STATE: (e.g., R - Running, S - Sleeping, Z - Zombie)

⚙️ Process Types

Type Description
Foreground Runs in the terminal
Background Runs behind the scenes (appended with &)
Daemon System-level background service
Zombie Terminated, but waiting for parent to read its exit status
Orphan Parent exited before the process; adopted by init

🧵 Task vs Process

  • A task refers to a kernel-level thread or unit of scheduling.

  • A process may contain multiple tasks (threads).

🔍 Is It a Shell Built-in or Executable? 

type cd     # => cd is a shell built-in
type rm     # => rm is /usr/bin/rm

This helps in understanding performance and behavior. Built-ins run faster and don’t spawn a new process.

👁️ Process Viewing Commands

ps – Snapshot of Processes

ps                 # Processes in current shell
ps -ef             # All processes (full format)
ps aux             # BSD style output
ps aux | less      # Paged view
ps aux --sort=%mem | less  # Sorted by memory
ps -ef --forest    # Tree view
ps -f -u username  # User-specific processes

pgrep – Search for Processes by Name

pgrep -l sshd     # Shows PID and name

pstree – ASCII Tree of Running Processes

pstree            # Tree structure
pstree -c         # Don’t merge branches with same name

🆚 ps vs pgrep vs pstree

Command Use Case
ps When you want full detail, CPU/mem usage
pgrep When you need just PIDs (scripting, killing)
pstree When visualizing parent-child process hierarchy

📈 Real-Time Process Monitoring: top and htop

top – Classic Real-Time Monitor

top

🔤 Key Shortcuts:

  • h: Help

  • 1: CPU per core

  • m: Memory view

  • u: Filter by user

  • x/y: Highlight sort/running processes

  • < / >: Change sorting column

  • q: Quit

📥 Batch Mode Logging:

top -d 1 -n 3 -b > top_log.txt
Flag Meaning
-d Delay between refreshes
-n Number of iterations
-b Batch mode (non-interactive)

htop – Improved, Colorful, Interactive

sudo apt install htop
htop

🧭 Navigation:

  • Use arrow keys

  • F2 to configure columns

  • F5 for tree view

  • F9 to kill processes

  • F6 to sort

🆚 top vs htop

Feature top htop
Interface Text-based Colorful UI
Navigation Keyboard Interactive
Tree view Manual Built-in
Ease of use Moderate High

Use htop for interactive analysis, and top -b for logs in scripts or automation.

💀 Killing Processes

kill – Send Signal by PID

kill -l              # Lists all signals
kill 1234            # Default SIGTERM (15)
kill -9 1234         # SIGKILL (force kill)
kill -HUP 1234       # Reload (used in daemons)
kill -1 1234         # Same as above

💡 Common Signals

Signal Number Purpose
SIGHUP 1 Reload configuration
SIGINT 2 Interrupt (Ctrl+C)
SIGTERM 15 Graceful termination
SIGKILL 9 Force kill (cannot be ignored)

pkill – Kill by Process Name

pkill firefox
pkill -HUP nginx

killall – Kill All by Name

killall sleep

pidof + kill

kill -9 $(pidof nginx)

🆚 kill vs pkill vs killall

Command Works On Pros When to Use
kill PID Precise, script-friendly When you know the PID
pkill Name Pattern-based killing Dynamic process names
killall Full name Kills all with exact match Multiple instances of command

🎭 Background Job Management 

sleep 100 &     # Background process
jobs            # List jobs
Ctrl + Z        # Pause foreground job
fg %1           # Resume in foreground
bg %1           # Resume in background

👻 nohup – Immune to Hangup (SIGHUP)

nohup long_command &

Even if the terminal closes, the command keeps running. Output is saved to nohup.out.

🧪 Real World Use Cases

Scenario Command
Reload SSH server config kill -HUP $(pidof sshd)
Gracefully stop a Python app pkill python
Log processes every second top -b -d 1 -n 10 > usage.log
Kill all background jobs killall sleep or jobs -p
Prevent process kill on logout nohup python server.py &

✅ Summary

Command Purpose
ps One-time process snapshot
pgrep Find PID by name
pstree View process hierarchy
top/htop Real-time monitoring
kill Terminate process by PID
pkill Terminate process by name
killall Kill all by command name
nohup Run processes immune to SIGHUP