Master Linux Process Management: ps, top, htop & iotop Explained

Linux Process Management

Concept

In Linux, a process is an instance of a running program. Understanding how to view, control, and manage processes is essential for system administrators and developers.

Process (Process) is a program instance that includes code, data, stack, environment variables, etc.

Each process has a unique Process ID (PID) for identification.

Processes can be in different states such as running, ready, waiting, zombie, etc.

Process Monitoring Command – ps

Syntax

|   |   |
|---|---|
|   | ps [options] |

The ps command reports the current process status and can be combined with kill to terminate unwanted programs. It provides detailed information about which processes are running, their state, resource usage, and more.

Common Options

-a: show processes of all users (excluding session leaders and processes without a controlling terminal).

-u: display user information.

-x: show processes without a controlling terminal.

-e: show all processes.

-f: full format including parent PID, controlling terminal, etc.

-l: long format, more detailed than -f.

-o: custom output format, specify fields to display.

-p: specify the PID to display.

-t: specify the terminal to display.

-U: specify the user to display.

-G: specify the user group to display.

Common Combinations

|   |   |
|---|---|
|   | ps -ef |
|   | ps -aux |
|   | ps -le |

ps -aux Parsing

|   |   |
USER          PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root            1 0.4 0.0 170856 11472 ?        Ss   Feb17   350:48 /sbin/init nopti
root            2 0.0 0.0      0      0 ?        S    Feb17   0:13  [kthreadd]
... (output truncated for brevity)

Column meanings: USER, PID, %CPU, %MEM, VSZ (virtual memory in KB), RSS (resident memory in KB), TTY (terminal), STAT (process state), START (start time), TIME (cumulative CPU time), COMMAND (executed command).

Process States

Basic States

Running (R): process is executing on the CPU or waiting in the run queue.

Sleeping (S): process is waiting for an event (I/O, signal, etc.) and does not consume CPU time.

Disk Sleep (D): uninterruptible I/O wait; cannot be killed or woken by signals.

Stopped (T): process stopped by a signal such as SIGSTOP or SIGTSTP.

Zombie (Z): process has terminated but its parent has not yet read its exit status; it occupies minimal resources until reaped.

Dead (X): process is dead but not yet reclaimed; usually not shown by ps.

Combined States

R+, S+, D+: foreground processes (indicated by a plus sign).

Ss, xxxs: parent processes (indicated by a small "s").

R<, S<: high‑priority processes (indicated by "<").

RN, SN: low‑priority processes (indicated by "N").

Sl: multithreaded process (indicated by "l").

Zombie Processes

Zombie processes have completed execution but remain because the parent process has not read their exit status. They consume system resources until the parent reaps them.

Detection and Cleanup

Find zombie processes:

ps -ef | grep 'Z'
# or a more detailed command
ps -A -ostat,ppid,pid,cmd | grep -e '^[Zz]'

Identify the parent PID of a zombie:

ps -o ppid= -p <zombie_pid>

Terminate the parent process (the init process will adopt and clean up the zombie):

kill -9 <parent_pid>

Orphan Processes

An orphan process is a child whose parent has terminated; it is adopted by the init process (PID 1) and generally has little impact on the system.

Process Monitoring Commands – top, htop, iotop

top

top

provides a dynamic, real‑time view of process activity with an interactive interface.

Syntax

|   |   |
|---|---|
|   | top [options] |

Common Options

-d: set the refresh delay in seconds (default 3 s).

-b: batch mode, often used with -n for redirection to a file.

-p: monitor only the specified PID.

-u: monitor processes of a specific user.

Example Output

Tasks: 473 total, 1 running, 472 sleeping, 0 stopped, 0 zombie
%Cpu(s): 0.2 us, 0.4 sy, 0.0 ni, 99.4 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st
MiB Mem : 64050.7 total, 29284.5 free, 6963.5 used, 27802.7 buff/cache
PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND
1280024 root    20   0   9440   4136   3056 R   6.2  0.0   0:00.01 top
...

htop

htop

is an interactive, colorful alternative to top that offers tree view, sorting, and direct process actions (e.g., kill).

Installation

# Ubuntu/Debian
sudo apt-get install htop
# CentOS/RHEL
sudo yum install htop
# Fedora
sudo dnf install htop

Run with htop to see an interface like the following:

iotop

iotop

monitors disk I/O activity per process, showing real‑time read/write rates and process information.

Installation

# Ubuntu/Debian
sudo apt-get install iotop
# CentOS/RHEL
sudo yum install iotop
# Fedora
sudo dnf install iotop

Run with iotop to see an interface like the following:

Common Shortcuts (htop)

F1: Help

F2: Settings

F3: Search process

F4: Filter processes

F5: Tree view

F6: Sort fields

F9: Kill process

F10: Exit