Master Linux Process Management: States, Commands, and Monitoring Tools

1. Process Concept

A running program instance loaded into memory is a process, identified by a Process ID (PID). UID, GID, and SELinux context determine file system access permissions, and the process inherits these from the user that started it. A process has a lifecycle.

2. Process States

running

ready

interruptible sleep

uninterruptible sleep

stopped

zombie

3. Process Management Commands

Common Linux tools for viewing and managing processes include pstree, ps, pidof, pgrep, top, htop, glance, pmap, vmstat, dstat, kill, pkill, job, bg, fg, and nohup. Process information is stored under /proc/<PID>.

pstree : display a tree of processes

ps : report a snapshot of the current processes ps [OPTION]... Options:

-e: show all processes (same as -a)

-a: show all processes (same as -e)

-f: display parent processes

-u: display owner information

-x: include processes without a controlling terminal

-o: specify output attributes (pid,comm,%cpu,%mem,state,tty,euser,ruser)

VSZ : Virtual Memory Size

RSS : Resident Set Size (physical memory)

4. Process Status Codes

R: running

S: interruptible sleeping

D: uninterruptible sleeping

T: stopped

Z: zombie

5. Common ps Option Combinations

-ef: show all processes in full format

-eFH: -F shows extended full format, -H displays hierarchy

Custom format example: -eo pid,tid,class,rtprio,ni,pri,psr,pcpu,stat,comm Additional fields: ni (nice value), rtprio (real-time priority)

6. pgrep Command

pgrep [options] pattern

Options:

-u uid: effective user ID

-U: real user ID

-t terminal: processes associated with a terminal

-l: display process name

-a: display full command line

-P pid: show child processes of the specified PID

Exact name example:

/sbin/pidof pidof bash

7. Process Management Tools

top (illustrated below) provides real‑time process monitoring.

htop (illustrated below) offers an enhanced interface.

Key fields displayed by top:

us: user space

sy: kernel space

ni: nice value

wa: I/O wait

id: idle

hi: hardware interrupt

si: software interrupt

st: stolen time (virtualized environments)

Process‑related parameters:

PID: process ID

PPID: parent process ID

RUSER: real user

EUSER: effective user

TTY: terminal

PR: priority

%CPU: CPU usage

%MEM: memory usage

S: process state

TIME+: cumulative CPU time

8. top Interactive Commands

P: sort by %CPU

M: sort by %MEM

T: sort by cumulative CPU time

u: display user space info

t: display tasks and CPU info

m: display memory info

q: quit

s: change refresh interval

k: kill a process

W: write configuration to file

9. kill Command

Send signals to processes for management.

SIGHUP: reload configuration without terminating

SIGINT: interrupt a running process

SIGKILL: forcefully kill a process

SIGTERM: terminate gracefully, allowing cleanup

SIGCONT: continue a stopped process

SIGSTOP: stop (pause) a process

Signal specification methods:

Numeric identifier (e.g., 1, 2, 9)

Full name (e.g., SIGHUP)

Short name (e.g., HUP)

Killing processes:

By PID: kill [-SIGNAL] pid... By name: killall [-SIGNAL] COMM By pattern: pkill [options] pattern Additional kill options:

-u uid: effective user

-t terminal: processes attached to a terminal

-l: list signal names

-a: display full format

-P pid: show child processes of the given PID