Master Linux Process Management: From Basics to Advanced Monitoring

1. Introduction

What is a process?

A process is the running instance of a program; when you execute code, the operating system creates a process to run it.

Difference between program and process

A program is a static collection of data and instructions (e.g., /bin/ls), while a process is the dynamic execution of that program, existing only while it runs.

Process lifecycle

The lifecycle covers creation, execution, and termination. A parent process can fork child processes, which inherit attributes; if a parent exits before its child, the child becomes a zombie.

2. Monitoring Process Status

Static view with ps

Use ps -aux to list processes with fields such as USER, PID, %CPU, %MEM, VSZ, RSS, TTY, STAT, START, TIME, COMMAND.

USER – process owner

PID – process ID

%CPU – CPU usage percentage

%MEM – memory usage percentage

VSZ – virtual memory size (KB)

RSS – resident set size (KB)

TTY – controlling terminal

STAT – process state (e.g., R, S, D, Z)

START – start time

TIME – total CPU time

COMMAND – command line

STAT field meanings

R – running

S – interruptible sleep

D – uninterruptible sleep (usually I/O)

Z – zombie

T – stopped

+ – foreground process

s – session leader

Dynamic view with top

top

shows real‑time CPU, memory, and task statistics, including total tasks, running, sleeping, stopped, zombie counts, and per‑CPU usage.

Other useful tools

free

– display memory usage vmstat – virtual memory and CPU statistics iostat – disk I/O statistics dstat – combined system resource view iftop – network traffic

3. Managing Processes

Kill signals

Use kill -l to list signals; common ones are:

1 (SIGHUP) – reload configuration

9 (SIGKILL) – force termination

15 (SIGTERM) – graceful termination (default for kill)

Background jobs

Traditional job control uses &, jobs, bg, fg. Modern practice prefers screen for persistent sessions.

# Run a command in background
sleep 3000 &
# Suspend foreground job and move to background
sleep 4000
# List jobs
jobs
# Bring job 2 to background
bg %2
# Bring job 1 to foreground
fg %1
# Kill job 1 by job ID
kill %1

Using screen

# Install screen
yum install screen -y
# Start a named session
screen -S mysession
# Run long‑running command inside screen
wget https://example.com/file.tar.gz
# Detach without stopping the session
Ctrl+a d
# List sessions
screen -list
# Reattach to a session
screen -r mysession
# Exit to terminate session
exit

4. Process Priority

Priority (nice value) determines scheduling preference: lower nice = higher priority. Use nice -n -5 command & to start with higher priority, and renice -n -20 PID to adjust a running process.

# Check current priority
ps axo pid,command,nice | grep 98417
# Change priority of a running process
renice -n -20 98002

5. System Load Average

Load average represents the average number of runnable and uninterruptible processes over 1, 5, and 15 minutes. Compare the values to the number of CPU cores to assess overload (e.g., load > 0.7 × CPU count warrants investigation).

# Show load average
uptime
# Example output: loadaverage: 0.70, 0.04, 0.05

High load can stem from CPU‑bound processes, I/O‑bound processes, or excessive context switching. Tools like mpstat, pidstat, and stress help pinpoint the cause.