Linux Process Management Commands: From ps to kill – Full Toolset Explained

1. ps command: snapshot of processes

The ps command displays a snapshot of current processes. It supports two option styles: Unix style (e.g., -ef) and BSD style (e.g., aux).

1.1 ps -ef: full view

Typical usage shows all processes ( -e) in full format ( -f), listing fields such as UID, PID, PPID, C, STIME, TTY, and CMD.

ps -ef

The PID 1 process is systemd; other processes are its descendants, traceable via the PPID column.

1.2 ps aux: sort by resource usage

The BSD style aux displays CPU and memory usage. Adding --sort can rank processes by the highest consumers.

ps aux --sort=-%mem | head -10   # top 10 memory consumers
ps aux --sort=-%cpu | head -10   # top 10 CPU consumers

If the STAT column shows Z, the process is a zombie; you should address its parent process rather than killing the zombie directly.

1.3 Custom output with ps

Use -eo to select specific columns, for example:

ps -eo pid,user,%cpu,%mem,stat,comm --sort=-%cpu

Combine with grep to locate a particular process:

ps -ef | grep nginx

2. top: real‑time monitoring

top

refreshes every few seconds, showing live resource usage. Important fields include load average, task states, CPU breakdown ( %Cpu(s)), and memory cache ( buff/cache).

top -c                # show full command line
 top -u mysql          # filter by user
 top -p 342,1234       # monitor specific PIDs
 top -d 2              # refresh every 2 seconds

Interactive shortcuts inside top include P (CPU sort), M (memory sort), k (kill PID), r (renice), c (toggle command view), and q (quit). Installing htop provides a richer UI.

3. kill: terminating processes

The kill command sends signals; the signal determines how the process ends. SIGTERM (15): graceful termination, allows cleanup – try this first. SIGKILL (9): forced kill, no cleanup, may cause data loss. SIGHUP (1): hang‑up, often makes services reload configuration (e.g., kill -1 $(cat /var/run/nginx.pid)).

kill 1234          # send SIGTERM
kill -9 1234       # force kill
kill -15 1234      # explicit SIGTERM
kill -1 890        # ask nginx to reload config
kill -l            # list all signals

After sending a signal, verify the process still exists with ps -p 1234.

4. nice and renice: priority control

Nice values range from -20 (highest priority, root only) to 19 (lowest). Smaller numbers mean higher priority.

nice -n 10 ./backup.sh    # low priority backup
sudo nice -n -5 nginx    # raise nginx priority
renice -5 -p 1234        # set PID 1234 to higher priority
renice 19 -p 5678        # lower priority of PID 5678

Use this for batch jobs or backups to avoid impacting critical services.

5. jobs, fg, bg: background task control

Typical workflow:

Press Ctrl+Z to suspend the running command.

Run jobs to list suspended/background jobs. bg %1 resumes job 1 in the background. fg %1 brings job 1 back to the foreground.

find / -name '*.log' &   # run in background
jobs -l                # list jobs with PIDs
fg %1                  # foreground job 1
bg %2                  # background job 2

6. pgrep and pkill: name‑based management

pgrep

finds PIDs by name or other criteria; pkill sends signals to matching processes.

pgrep nginx              # list nginx PIDs
pgrep -a nginx           # show PID + full command line
pgrep -u root            # processes owned by root
pkill nginx              # terminate all nginx processes
pkill -9 nginx           # force kill nginx
pkill -u testuser        # kill all processes of a user
killall nginx            # exact‑name kill (no fuzzy match)

pkill

supports fuzzy matching, while killall matches the exact executable name.

7. Advanced troubleshooting commands

7.1 pstree: process family tree

pstree                # full process tree
pstree -p             # include PIDs
pstree -u             # group by user
pstree 1234           # view subtree of PID 1234

7.2 strace: trace system calls

When a process hangs, strace reveals its system calls.

strace -p 1234                 # attach to process
strace -p 1234 -e trace=file # only file‑related calls
strace -c -p 1234            # summary of call counts and time

Seeing a block in read() or connect() points to I/O or network issues.

7.3 lsof: open files and ports

lsof -i :8080                # which process uses port 8080
lsof /var/log/nginx/error.log # who is writing the log
lsof -u mysql                # files opened by mysql user

7.4 vmstat: overall system health

vmstat 2 5   # sample every 2 seconds, 5 times (watch r and b columns)

Summary

The core workflow for Linux process management can be remembered as four verbs: see (ps, top, pstree), manage (jobs/fg/bg, pgrep/pkill), kill (SIGTERM → SIGKILL), and adjust (nice/renice). The next article will cover network‑related commands such as ss, netstat, tcpdump, ip, curl, and wget.