Master Linux Process Management: From Basics to Powerful Commands

Program

A program is a set of instructions that a computer can recognize and execute, serving as an information tool to meet specific user needs.

What is a Process?

A process is a running instance (copy) of a program. Each process has a unique Process ID (PID) and is associated with a user ID (UID) and group ID (GID) that determine file system access permissions. Processes inherit these IDs from the user that starts them, have a lifecycle, and are created by a parent process, eventually terminating (including possible zombie states).

Process Creation

The first process is init (or systemd on CentOS 7 and later). New processes are created by their parent using fork(), establishing a parent‑child relationship. Copy‑On‑Write (CoW) ensures that memory pages are duplicated only when modified.

Threads share resources within a process, while the process itself handles task distribution.

Process Management Commands

ps – static process information

ps aux          # basic format without leading '-'</code>
<code>a   # show processes attached to terminals, including other users</code>
<code>u   # display the user owning each process</code>
<code>x   # show processes without a controlling terminal</code>
<code>ps aux | wc -l # count processes</code>
<code># combine with pipes for advanced queries

USER

Process owner

PID

Process ID

%CPU

CPU usage percentage

%MEM

Memory usage percentage

VSZ

Virtual memory size

RSS

Resident set size (physical memory)

TTY

Terminal associated with the process ("?" if none)

STAT

Process state (D, R, S, T, Z, etc.)

START

Start time

TIME

CPU time used

COMMAND

Command that started the process

top – dynamic process monitoring

-d <seconds>   # update interval (default 3 s)</code>
<code>-b            # batch mode, often used with "-n"</code>
<code>-n <count>    # number of iterations</code>
<code>-p <PID>      # monitor a specific PID</code>
<code>-s            # safe mode</code>
<code>-u <user>     # show processes of a specific user

pgrep – find processes by criteria

-U <user>   # specify user</code>
<code>-l        # display process name</code>
<code>-a        # display full command line</code>
<code>-P <PID>   # show child processes of a PID

pstree – tree view of processes

-p   # show PIDs</code>
<code>-a   # show full command line</code>
<code>-u   # show user changes</code>
<code>-H   # highlight a specific PID and its ancestors

lsof – list open files

-c <string>   # list files opened by processes whose command starts with <string></code>
<code>+d <dir>    # list files opened under a directory</code>
<code>-u <user>   # list files opened by a user</code>
<code>-p <PID>    # list files opened by a specific PID

vmstat – performance monitoring

free – memory usage

echo 3 > /proc/sys/vm/drop_caches

# clear cache

iostat – disk I/O performance

iftop – network traffic monitoring

dstat – network and system monitoring

Five Key Performance Metrics

Memory: free, top CPU: top, ps aux Disk: lsblk, df Read/Write: dd, iostat, vmstat Network: dstat, iftop,

lsof

Foreground and Background Process Control

Use & to run a command in the background, jobs to list background jobs, fg to bring a job to the foreground, Ctrl+Z to suspend a job, and bg to resume a suspended job.

Scheduled Tasks

at – one‑time tasks

Syntax: at [HH:MM] [yyyy‑mm‑dd] (e.g., at 18:55 2023‑12‑01)

crontab – recurring tasks

-e          # edit crontab</code>
<code>* * * * *  # minute hour day month weekday (0‑6, 0 or 7 = Sunday)</code>
<code>-u <user>   # specify user</code>
<code>-l          # list current jobs</code>
<code>-r          # remove a job

Format: minute hour day month weekday + command (use absolute paths). Example: run a copy of /etc/passwd to /opt every day at 18:55.