Master Linux Process Management: ps, top, htop, and iotop Explained

Linux Process Management

Concept

In Linux, a process is an instance of a running program. Understanding process management, viewing, and control is essential for system administrators and developers.

Process (Process) is an instance of a program during execution, containing code, data, stack, environment variables, etc.

Each process has a unique Process ID (PID) for identification.

Processes can be in different states such as running, ready, waiting, zombie, etc.

Process Monitoring Command: ps

The ps command reports the current system process status and can be combined with kill to terminate unnecessary programs. It provides detailed information about which processes are running, their states, resource usage, and more.

Syntax

|     |     |
| --- | --- |
|     | ps [options] |

Common options:

-a: Show processes of all users (excluding session leaders and processes without a controlling terminal).

-u: Display user information of processes.

-x: Show processes without a controlling terminal.

-e: Show all processes.

-f: Show full-format information, including PPID, controlling terminal, etc.

-l: Show long format information, similar to -f but more detailed.

-o: Custom output format, specifying fields to display.

-p: Specify the PID to display.

-t: Specify the terminal to display.

-U: Specify the user to display.

-G: Specify the user group to display.

ps -aux parsing

|     |     |
| --- | --- |
|     | root@master-01:~# ps -aux | head -10 |
| USER          PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND |
| root            1 0.4 0.0 170856 11472 ?        Ss   Feb17   350:48 /sbin/init nopti |
| ... (additional rows omitted) |
| USER: represents the user |
| PID: represents the process ID |
| %CPU: CPU usage percentage |
| %MEM: memory usage percentage |
| VSZ: virtual memory size (KB) |
| RSS: resident set size (KB) |
| TTY: terminal ("?" means no controlling terminal) |
| STAT: process state |
| START: start time |
| TIME: cumulative CPU time |
| COMMAND: command line |

Process States

Common Basic States

Running ( R): Process is executing on the CPU or waiting in the run queue.

Sleeping ( S): Process is waiting for an event (I/O, signal, etc.) and does not consume CPU.

Disk Sleep ( D): Process is waiting for uninterruptible I/O; cannot be killed.

Stopped ( T): Process stopped by a signal (e.g., SIGSTOP, SIGTSTP).

Zombie ( Z): Process has finished but its parent has not read its exit status.

Dead ( X): Process is dead but not yet reclaimed; usually not shown by ps.

Common Combined States

R+, S+, D+: "+" indicates the process is running in the foreground.

Ss, xxxs: "s" indicates the process is a session leader (parent process).

R<, S<: "<" indicates a high‑priority process.

RN, SN: "N" indicates a low‑priority process.

Sl: "l" indicates a multithreaded process.

Zombie Processes

Zombie processes have completed execution but remain in the process table because the parent has not yet read their exit status. They occupy system resources until the parent reaps them.

Zombie detection and termination

Use ps to locate zombie processes:

ps -ef | grep 'Z'
ps -A -ostat,ppid,pid,cmd | grep -e '^\[Zz\]'

Identify the parent PID of the zombie:

ps -o ppid= -p <ZOMBIE_PID>

Terminate the parent process (the init process will adopt and clean up the zombie):

kill -9 <PARENT_PID>

Orphan Processes

An orphan process occurs when its parent terminates unexpectedly; the orphan is adopted by the init process (PID 1). Orphans have minimal impact on the system.

Process Monitoring Commands: top, htop, iotop

top

The top command provides dynamic, real‑time monitoring of process activity with an interactive interface for customizing output.

Syntax

|     | top [options] |

Common options:

-d: Set the delay between updates (default 3 seconds).

-b: Batch mode, often used with -n to redirect output to a file.

-p: Monitor only the specified PID(s).

-u: Show processes of a specific user.

Example output:

root@master-01:~# top
Tasks: 473 total, 1 running, 472 sleeping, 0 stopped, 0 zombie
%Cpu(s): 0.2 us, 0.4 sy, 0.0 ni, 99.4 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st
MiB Mem : 64050.7 total, 29284.5 free, 6963.5 used, 27802.7 buff/cache
...

htop

htop

is an interactive process viewer with color display, tree view, sorting, and the ability to kill processes directly from the interface.

Installation

sudo apt-get install htop   # Ubuntu/Debian
sudo yum install htop       # CentOS/RHEL
sudo dnf install htop       # Fedora

Run with htop to see the interface.

Common shortcuts

F1: Help

F2: Settings

F3: Search processes

F4: Filter processes

F5: Tree view

F6: Sort fields

F9: Kill process

F10: Quit

iotop

iotop

monitors disk I/O activity per process, showing real‑time read/write speeds and the processes responsible.

Installation

sudo apt-get install iotop   # Ubuntu/Debian
sudo yum install iotop       # CentOS/RHEL
sudo dnf install iotop       # Fedora

Run with iotop to view the I/O usage interface.