Linux Process Management: A Complete Guide to ps, top, kill, and htop

Every program running on your Linux system is a process. When your server slows down, a script hangs, or a service won't stop — you need to find the responsible process and deal with it. That means knowing ps, top, htop, and kill.

This guide covers everything you need to manage Linux processes from the command line.

What Is a Process?

A process is a running instance of a program. Each process has:

• A PID (Process ID) — a unique number assigned when it starts
• A PPID (Parent Process ID) — the PID of the process that launched it
• An owner — the user who started it (determines permissions)
• A state — running, sleeping, stopped, or zombie

When you open a terminal, bash is a process. When you run ls, that creates a child process. When that ls finishes, the process ends and its PID is freed.

Listing Processes with ps

ps shows a snapshot of current processes.

Basic usage

ps               # processes in current terminal session
ps aux           # ALL processes on the system
ps -ef           # all processes, full format (alternative style)

The aux flags:

• a — show processes from all users
• u — show user-oriented format (includes CPU, memory %)
• x — include processes not attached to a terminal

ps aux output explained

USER       PID  %CPU  %MEM    VSZ    RSS TTY      STAT START   TIME COMMAND
root         1   0.0   0.2 167712  9132 ?        Ss   Jun19   0:01 /sbin/init
alice     2847   2.1   1.4 823456 57344 pts/0    Sl   10:23   0:12 python3 app.py

Column	Meaning
USER	Who owns this process
PID	Process ID
%CPU	CPU usage percentage
%MEM	Memory usage percentage
VSZ	Virtual memory size (KB)
RSS	Resident memory (actual RAM used, KB)
TTY	Terminal attached (? = no terminal)
STAT	Process state (see below)
START	When it started
TIME	Total CPU time consumed
COMMAND	Command that started it

Process states

State	Meaning
R	Running or runnable
S	Sleeping (waiting for I/O or an event)
D	Uninterruptible sleep (usually disk I/O)
T	Stopped (paused by a signal)
Z	Zombie (finished but parent hasn't collected it)
s	Session leader
l	Multi-threaded
+	In the foreground process group

Filtering ps output

ps aux | grep nginx          # find nginx processes
ps aux | grep -v grep        # exclude the grep itself
ps -u alice                  # processes owned by alice
ps --ppid 1234               # child processes of PID 1234

ps with a process tree

ps axjf     # forest view — shows parent-child relationships
pstree      # cleaner tree display (install with: apt install psmisc)
pstree -p   # include PIDs

Real-Time Monitoring with top

top shows a live, updating view of processes — like Task Manager for Linux.

top

top display explained

top - 14:32:05 up 2 days, 3:12,  2 users,  load average: 0.45, 0.38, 0.31
Tasks: 183 total,   1 running, 182 sleeping,   0 stopped,   0 zombie
%Cpu(s):  3.2 us,  1.1 sy,  0.0 ni, 95.0 id,  0.5 wa,  0.0 hi,  0.2 si
MiB Mem :   7844.0 total,   2103.4 free,   3891.2 used,   1849.4 buff/cache
MiB Swap:   2048.0 total,   2048.0 free,      0.0 used.   3652.1 avail Mem

The header shows:

• load average — system load over 1, 5, and 15 minutes. Values below your CPU count are healthy; above it means the system is saturated
• Tasks — total processes and their states
• %Cpu — us = user, sy = system, id = idle, wa = waiting on I/O
• MiB Mem — total, free, used, and cached RAM
• buff/cache — memory used for disk buffers (this can be reclaimed if needed)

Interactive top commands

While top is running:

Key	Action
q	Quit
k	Kill a process (prompts for PID)
M	Sort by memory usage
P	Sort by CPU usage (default)
T	Sort by running time
u	Filter by user
1	Toggle per-CPU display
h	Help

Useful top flags

top -u alice       # show only alice's processes
top -p 1234,5678   # watch specific PIDs
top -b -n 1        # batch mode, one snapshot (good for scripts)

htop: The Better top

htop is an improved, color-coded version of top. Install it if it's not already present:

sudo apt install htop     # Debian/Ubuntu
sudo dnf install htop     # Fedora/RHEL

htop

What makes htop better

• Color-coded CPU and memory bars instead of raw percentages
• Mouse support — click to select and kill processes
• Easier killing — press F9 to send a signal, no need to type a PID
• Filtering — press / to search processes by name
• Tree view — press F5 to toggle parent-child tree
• Scrollable — horizontal scrolling shows full command lines

htop is faster to read at a glance and easier to use interactively. Most admins use top when htop isn't installed, and htop whenever it is.

Killing Processes

kill sends a signal to a process. Despite the name, most signals don't immediately terminate a process — they send instructions.

Common signals

Signal	Number	Default action	When to use
SIGTERM	15	Graceful shutdown	Normal termination — program can clean up
SIGKILL	9	Immediate termination	Process ignores SIGTERM or is frozen
SIGHUP	1	Reload configuration	Tell a daemon to re-read its config file
SIGSTOP	19	Pause process	Suspend without killing
SIGCONT	18	Continue process	Resume a paused process

Kill by PID

kill 1234            # send SIGTERM (15) to PID 1234
kill -9 1234         # send SIGKILL — force terminate
kill -SIGTERM 1234   # same as kill 1234, explicit name
kill -15 1234        # same as kill 1234, explicit number

Always try SIGTERM first. It gives the process a chance to save state and clean up. Only use SIGKILL (kill -9) if the process doesn't respond.

Kill by name with pkill and killall

pkill nginx          # kill all processes named nginx (SIGTERM)
pkill -9 nginx       # force kill all processes named nginx
pkill -u alice       # kill all of alice's processes

killall nginx        # same effect as pkill nginx
killall -9 nginx     # force kill by name

Be careful with killall on non-Linux systems (macOS, Solaris) — it kills everything on the system, not by name. On Linux it's safe.

Finding a PID before killing

pidof nginx          # list PIDs for processes named nginx
pgrep nginx          # same as pidof, with more options
pgrep -a nginx       # show PID and full command
ps aux | grep nginx  # manual search

Background and Foreground Jobs

Linux shell job control lets you run processes in the background and bring them forward.

Starting a background job

long-running-command &    # & puts it in background immediately

Managing running jobs

jobs                  # list background jobs
fg                    # bring most recent background job to foreground
fg %2                 # bring job number 2 to foreground
bg                    # resume a stopped job in the background
bg %2                 # resume job 2 in background

Stopping and backgrounding

# while a command is running:
Ctrl+Z         # pause (stop) the current foreground job
bg             # then resume it in the background

nohup — keep jobs running after logout

If you start a background job in an SSH session and then disconnect, the job normally stops. Use nohup to prevent this:

nohup long-running-script.sh &          # continues after logout
nohup python3 server.py > output.log &  # redirect output

nohup disconnects the process from your terminal so it's not killed when the session ends.

Checking What a Process Is Using

lsof -p 1234          # list files open by PID 1234
lsof -i :8080         # what process is using port 8080?
strace -p 1234        # trace system calls (powerful for debugging)
/proc/1234/           # kernel's own info about PID 1234
cat /proc/1234/status # process status from kernel

Practical Scenarios

Find and kill a process eating CPU

top -b -n 1 | head -15   # snapshot to find the culprit
# or just open top/htop and sort by CPU (key: P)
kill -SIGTERM <PID>       # try graceful shutdown first
kill -9 <PID>             # force kill if needed

Find what's using a port

ss -tulnp | grep :8080    # show process on port 8080
lsof -i :8080             # alternative

Restart a service without killing it

# Many daemons reload on SIGHUP without downtime:
kill -HUP $(pidof nginx)

# Or use systemd:
sudo systemctl reload nginx
sudo systemctl restart nginx

Monitor a specific process

watch -n 2 "ps -p 1234 -o pid,pcpu,pmem,rss,args"

Full Reference

For background jobs, systemd service management, cron scheduling, and process priority (nice values), see the Linux Process Management Guide.

Get The Practical Linux Handbook
Read a free sample
All Linux topics