Your server is slow. Something is eating 98% of your CPU. Do you know how to find the culprit and stop it — right now?
Introduction
Every program running on your Linux machine is a process. Your web server is a process. Your text editor is a process. Even the terminal you’re typing in is a process. Understanding how to view, monitor, and control processes is one of the most practical skills you can have as a Linux user.
- How to see every process running on your system
- How to read and understand process states (R, S, T, Z)
- How to kill and pause processes using signals
- How to manage system services with
systemctl - How to spot and fix a runaway process
Think of your Linux system as a busy office building:
- Processes are the employees — each doing a specific job.
- The CPU is the single conference room — only one employee uses it at a time.
- The OS scheduler is the meeting organizer — it decides who gets the room next.
- killing a process is firing an employee — they leave immediately.
What is a Process?
When you run a command like nginx or python3 app.py, Linux creates a process — a running instance of that program. Each process gets:
- A unique PID (Process ID — a number like
1042) - A parent PID (PPID — the process that launched it)
- Its own chunk of memory and CPU time
- A current state (Running? Sleeping? Dead?)
The 4 Process States You Must Know
| State | Code | Meaning |
|---|---|---|
| Running | R | Actively using the CPU right now |
| Sleeping | S | Waiting for something (disk, network, timer) |
| Stopped | T | Paused with Ctrl+Z or SIGSTOP |
| Zombie | Z | Finished but parent hasn’t cleaned it up yet |
Viewing Processes
ps — The Process Snapshot
ps gives you a snapshot of processes at this moment.
Show all processes from all users with details
ps aux— Show everything from all usersps aux | grep nginx— Find a specific process by name
top — The Live Process Monitor
ps is a snapshot. top is a live feed — it updates every few seconds.
Live process monitor — press Q to quit
Key controls inside top:
| Key | Action |
|---|---|
q | Quit |
k | Kill a process (type PID when prompted) |
M | Sort by memory usage |
P | Sort by CPU usage |
1 | Show individual CPU cores |
Install htop for a color-coded, mouse-friendly version of top.
sudo apt install htop then just type htop.
Finding a Specific Process
Get PID of nginx without grep
Get PID of sshd
Find python3 processes
Controlling Processes
The kill Command (Sending Signals)
“kill” is a misleading name. kill actually sends a signal to a process. Most signals are not “kill” commands.
Send SIGTERM (polite stop) to PID 1042
Send SIGKILL (force stop) to PID 1042
Kill all processes named nginx
Kill all python3 processes by name
The 3 Signals You’ll Use Most:
| Signal | Number | Name | Effect |
|---|---|---|---|
| Default | 15 | SIGTERM | ”Please clean up and exit.” — Polite |
| Force | 9 | SIGKILL | ”Exit NOW.” — Cannot be ignored |
| Pause | 19 | SIGSTOP | ”Pause.” — Resume with SIGCONT |
Always try kill PID (SIGTERM) first. It lets the process save data and close files cleanly. kill -9 forces immediate termination — data may be lost.
Background and Foreground Jobs
When you’re in a terminal, you can run processes in the background:
Run ping in background (&)
List background jobs in current terminal
Bring job 1 back to foreground
Resume a stopped job in background
Ctrl+Z stops the current foreground process (moves it to Stopped/T state). Ctrl+C sends SIGINT to terminate it.
Managing System Services with systemctl
Services (or daemons) are background processes that start at boot and keep running — like your web server, SSH server, or database.
systemctl is the command to control them.
Check if nginx is running and its last logs
Start nginx right now
Stop nginx right now
Restart nginx (stop + start)
Reload config without restarting
Make nginx start automatically on boot
Stop nginx from starting on boot
start= turn on right nowenable= turn on at next boot
To run a service permanently: you need both — enable AND start.
Troubleshooting: Finding the Process Eating Your CPU
This is the real-world scenario you’ll face. Here’s the exact workflow:
Step 1 — Find the offender:
Show top 10 CPU-hungry processes
Step 2 — Confirm it’s the culprit:
Watch a specific PID in real time
Step 3 — Try to stop it politely:
Send SIGTERM (polite)
Step 4 — If it doesn’t stop, force it:
Send SIGKILL (force)
Step 5 — Find out what it was:
Check service logs
Hands-On Challenge
Try these steps on your own Linux machine (or a VM):
- Open a terminal and run
sleep 300 &— this starts a harmless 5-minute background process. - Run
ps aux | grep sleep— find its PID. - Run
kill <PID>— stop it politely. - Verify it’s gone: run
ps aux | grep sleepagain. - Bonus: Run
sudo systemctl status sshand read its output.
Key Takeaways
- Every running program is a process with a unique PID and a current state (R/S/T/Z).
ps auxgives a snapshot;topandhtopgive a live view.kill PIDsends SIGTERM (polite).kill -9 PIDforces termination.- Use
systemctlfor services — remember:start= now,enable= on boot. - Sort
psby--sort=-%cputo instantly find runaway processes.
Test Your Knowledge
Take a quick 4-question quiz to check your understanding.