Linux process management: ps, top, and beyond

When a server is slow, the first question is: what’s using the resources? Linux gives you several tools to answer that, from quick snapshots to real-time monitoring.

ps: process snapshot

The most common invocation:

ps aux

a — all users’ processes
u — user-oriented format
x — include processes without a terminal

Columns that matter:

%CPU — processor usage
%MEM — memory usage
STAT — process state
COMMAND — what’s running

Filter by name:

ps aux | grep nginx

Show a process tree:

ps auxf
# or
pstree -p

The tree view shows parent-child relationships, which is useful for understanding which process spawned what.

top: real-time monitoring

top

Shows a live, updating view of processes sorted by CPU usage. Useful shortcuts inside top:

1 — show per-core CPU usage
M — sort by memory
P — sort by CPU
k — kill a process by PID
q — quit

top is good for quick checks. For longer monitoring, htop is better:

sudo apt install htop
htop

htop gives you a color display, mouse support, and easier navigation. It’s worth installing.

Process states

The STAT column in ps output tells you what a process is doing:

R — running or runnable
S — sleeping (waiting for something)
D — disk sleep (uninterruptible, usually I/O wait)
Z — zombie (finished but parent hasn’t collected the exit status)
T — stopped (by a signal or Ctrl+Z)

A few zombies are normal. Many zombies usually mean a parent process is buggy and not reaping its children.

D state processes are stuck waiting for I/O. If you see many of them, your storage might be having problems.

Signals

Processes communicate via signals. The common ones:

kill PID              # SIGTERM (15) — graceful shutdown
kill -9 PID           # SIGKILL (9) — force kill
kill -HUP PID         # SIGHUP (1) — reload config
kill -USR1 PID        # user-defined, often "reopen log"

SIGTERM asks the process to shut down cleanly. SIGKILL forces it to die immediately — no cleanup, no final writes. Always try SIGTERM first.

Find a process by name:

pkill nginx
killall node

Background and foreground

Run a command in the background:

./long-script.sh &

Suspend a running command: Ctrl+Z

List background jobs:

jobs

Bring a job to the foreground:

fg %1

Send it back to background:

bg %1

For processes that need to survive your SSH session disconnecting, use nohup or screen/tmux:

nohup ./long-script.sh &

Or better, use systemd for anything that should keep running.

nice and renice

Process priority ranges from -20 (highest priority) to 19 (lowest). Default is 0.

Start a process with lower priority:

nice -n 10 ./cpu-intensive-task.sh

Change priority of a running process:

renice 10 -p PID

Only root can increase priority (lower nice value). Regular users can only lower it.

lsof: open files

Everything in Linux is a file, including network connections. lsof shows what files a process has open:

lsof -p PID
lsof -i :80              # what's listening on port 80
lsof -u username          # files opened by a user

This is invaluable when you’re trying to figure out why you can’t unmount a filesystem (“device is busy”):

lsof +D /mnt/usb

Common mistakes

Using kill -9 first. It doesn’t let the process clean up. Try kill (SIGTERM) first, wait a few seconds, then escalate to kill -9.

Confusing CPU and memory. A process using 100% CPU isn’t necessarily using a lot of memory, and vice versa. Check both.

Ignoring zombie processes. A few are fine. Hundreds indicate a problem with the parent process.

Remarks

Process management is about knowing what’s running and controlling it. ps aux for a snapshot, top or htop for live monitoring, kill for sending signals. When something’s wrong, these are the first tools you reach for. The process tree (ps auxf) is especially useful for tracing which parent spawned a misbehaving child.