How To Check Process In Linux : Linux Process List And Monitoring

by

Monitoring active processes in Linux helps you identify resource usage and system performance issues. Knowing how to check process in linux is a fundamental skill for any system administrator or developer. This guide will walk you through every major command and tool, from simple terminal commands to graphical monitors, so you can always keep tabs on what your system is doing.

Linux processes are the running instances of your programs. Each process has a unique ID (PID), a user who owns it, and a state like running, sleeping, or stopped. When your system feels slow or a program freezes, checking processes is your first troubleshooting step. Let’s start with the most common commands and build up your toolkit.

How To Check Process In Linux

The most direct way to check processes is using the ps command. It stands for “process status” and gives you a snapshot of current processes. Open your terminal and type ps aux to see all processes running for every user. The output shows columns like USER, PID, %CPU, %MEM, and COMMAND. This is your go-to for a quick list.

For a more dynamic view, use the top command. It refreshes every few seconds, showing processes sorted by CPU usage by default. Press q to quit. You can also press M to sort by memory usage or P to sort by CPU again. This is perfect for real-time monitoring.

If you prefer a more modern and colorful interface, try htop. It’s not installed by default on all systems, so you may need to install it with your package manager (e.g., sudo apt install htop on Ubuntu). Htop shows processes in a tree view, allows mouse interaction, and lets you kill processes with F9. It’s a huge upgrade over top.

Using Ps Command With Common Options

The ps command has many options. Here are the most useful ones:

  • ps aux – Shows all processes with detailed info
  • ps -ef – Another format showing full details, often used in scripts
  • ps -u username – Shows processes for a specific user
  • ps -p PID – Shows info for a specific process ID
  • ps -C command_name – Shows processes matching a command name

For example, to check if the Apache web server is running, type ps aux | grep apache. The pipe (|) sends the output to grep, which filters for lines containing “apache”. This is a common pattern for finding specific processes.

You can also combine options. Try ps -eo pid,user,%cpu,%mem,comm --sort=-%cpu to show processes sorted by CPU usage descending. This gives you a clean, customized list without extra columns.

Real-Time Monitoring With Top And Htop

While ps gives a snapshot, top and htop provide live updates. In top, you can press 1 to see CPU core usage, c to show full command paths, and u to filter by user. Press h for help with all interactive commands.

Htop adds color coding: red for high CPU, green for normal. You can scroll vertically and horizontally with arrow keys. To kill a process in htop, navigate to it with arrows and press F9, then select the signal (usually SIGTERM or SIGKILL). This is much easier than remembering the PID and using kill command.

One tip: if you have many processes, use top -u username to only show processes for a specific user. For example, top -u www-data shows web server processes only.

Finding Specific Processes With Pgrep And Pidof

Sometimes you just need the PID of a process. Use pgrep process_name to get PIDs. For example, pgrep firefox returns all PIDs for Firefox. Add -l to show process names too: pgrep -l firefox.

The pidof command does something similar but returns only the first PID: pidof firefox. This is handy when you need to kill a single instance. You can combine with kill like kill $(pidof firefox).

For more advanced filtering, use pgrep -u username to find processes owned by a user. Or pgrep -x firefox to match the exact name (no partial matches).

Killing And Managing Processes

Once you’ve found a problematic process, you can stop it with the kill command. The basic syntax is kill PID. If that doesn’t work, try kill -9 PID (SIGKILL), which forcefully terminates the process. Be careful with SIGKILL as it doesn’t allow the process to clean up.

You can also use pkill process_name to kill by name. For example, pkill firefox kills all Firefox processes. Add -9 for forceful kill: pkill -9 firefox.

For a more graceful approach, use kill -15 PID (SIGTERM) first. Most programs will save data and exit cleanly. Only use SIGKILL if the process is hung.

Using System Monitor Tools (Gnome And Kde)

If you prefer a graphical interface, most Linux desktops have a system monitor. On GNOME, press the Super key and type “System Monitor”. It shows processes in a table with columns for CPU, memory, and disk usage. You can sort by clicking column headers and kill processes with a right-click.

On KDE, use “KSysGuard”. It offers similar functionality with customizable graphs. These tools are great for beginners who aren’t comfortable with the terminal yet.

For headless servers, you can install htop or use top over SSH. There’s also glances, a cross-platform monitoring tool that shows CPU, memory, disk, network, and processes in one screen. Install it with sudo apt install glances.

Checking Process Tree With Pstree

The pstree command shows processes in a tree format, revealing parent-child relationships. This is useful for understanding which processes spawned others. For example, pstree -p shows PIDs next to process names. You can also specify a user: pstree username.

This is especially helpful when debugging zombie processes or orphaned children. A zombie process shows as defunct in ps output and can be identified in pstree as a process with no parent.

Monitoring Process Resource Usage With /Proc Filesystem

Linux exposes process information through the /proc filesystem. Each process has a directory named by its PID under /proc. For example, /proc/1234/ contains files like status, cmdline, and fd (file descriptors).

To check memory usage of a process, cat /proc/PID/status. Look for lines like VmRSS (resident set size) and VmSize (virtual memory). This gives you raw data without parsing command output.

You can also use lsof to list open files for a process: lsof -p PID. This shows all file descriptors, including network connections and regular files. It’s invaluable for debugging file leaks or locked files.

Using Systemd Commands For Service Processes

If you’re on a systemd-based Linux (most modern distributions), use systemctl to check service processes. For example, systemctl status nginx shows whether the Nginx service is running, its PID, and recent logs. This is cleaner than grepping ps output.

To list all running services, use systemctl list-units --type=service --state=running. You can also check service resource usage with systemd-cgtop, which shows control group statistics for services.

For user-level processes, use systemctl --user status to check your own services. This is common for desktop environments and user daemons.

Automating Process Checks With Scripts

You can write simple shell scripts to monitor processes. For example, to check if a process is running and restart it if not:

  1. Use pgrep -x process_name to check existence
  2. If no PID returned, start the process with systemctl start service_name
  3. Log the action to a file for auditing

Here’s a basic script snippet:

#!/bin/bash
if ! pgrep -x "myapp" > /dev/null; then
    systemctl start myapp
    echo "myapp restarted at $(date)" >> /var/log/restart.log
fi

You can run this with cron every few minutes. This ensures critical processes stay alive.

Common Process States And What They Mean

When you check processes, you’ll see state codes in ps output. Here’s a quick reference:

  • R – Running or runnable (on CPU queue)
  • S – Sleeping (waiting for an event)
  • D – Uninterruptible sleep (usually waiting for I/O)
  • Z – Zombie (process finished but not reaped by parent)
  • T – Stopped (by signal or debugger)
  • X – Dead (should not be seen)

Zombie processes are harmless but indicate a bug in the parent process. They consume no resources except a PID slot. If you see many zombies, check the parent process with pstree and consider restarting it.

Using Strace To Debug Process Behavior

For advanced troubleshooting, strace traces system calls made by a process. Run strace -p PID to see real-time calls. This is heavy and should only be used when you suspect a specific issue, like a file not found or a network timeout.

You can also trace a new process: strace -o output.txt command. The output file contains every system call, which is huge but invaluable for debugging.

Be careful: strace slows down the traced process significantly. Use it sparingly on production systems.

Checking Process Network Connections

To see which processes are using network ports, use netstat -tulpn or ss -tulpn. The -p flag shows the PID and program name. For example, sudo ss -tulpn | grep :80 shows which process is listening on port 80.

The newer ss command is faster than netstat. Both require root to see PIDs of other users’ processes. This is essential for checking if a web server or database is running on the expected port.

Using Lsof To Check Open Files Per Process

The lsof command lists open files, including regular files, directories, sockets, and pipes. Use lsof -p PID to see all open files for a process. This is useful when a process cannot open a file or when you need to know which process is using a file.

For example, lsof /var/log/syslog shows all processes currently writing to the syslog file. This helps identify log rotation issues or file locks.

Process Priority And Niceness

Linux processes have a priority value called “nice” level. It ranges from -20 (highest priority) to 19 (lowest). You can check nice values with ps -eo pid,ni,comm. To change priority, use renice -n 5 -p PID to lower priority (make it nicer to other processes).

Only root can increase priority (set negative nice values). Normal users can only decrease priority. This is useful for background tasks that shouldn’t hog CPU.

Using Watch To Repeat Commands

The watch command runs a command repeatedly and shows its output. For example, watch -n 2 'ps aux --sort=-%cpu | head -10' updates every 2 seconds showing the top 10 CPU consumers. This is a simple way to monitor changes without using top.

You can combine watch with any command. For instance, watch -d 'pgrep -c firefox' shows the count of Firefox processes, with changes highlighted.

Common Mistakes When Checking Processes

Beginners often forget to use sudo when needed. Many commands like lsof -p or strace require root to see other users’ processes. Always check if you’re getting incomplete output.

Another mistake is relying only on ps without filtering. On a busy system, ps aux can show hundreds of lines. Always pipe to grep or use ps -C to narrow down.

Finally, don’t kill processes without understanding what they do. Use ps -f PID to see the full command line before killing. Some system processes are essential for stability.

Conclusion

Now you have a complete toolkit for how to check process in linux. From the basic ps command to advanced tools like strace and lsof, you can monitor, debug, and manage any process on your system. Practice these commands regularly to become proficient. Remember to start with ps aux for a quick overview, then use top or htop for real-time monitoring. For specific processes, combine pgrep with kill to manage them efficiently.

Frequently Asked Questions

What Is The Easiest Way To Check Processes In Linux?

The easiest way is using the ps aux command in the terminal. It shows all running processes with their PID, CPU, and memory usage. For a live view, use top or htop if installed.

How Do I Find A Process By Name In Linux?

Use pgrep -l process_name to find PIDs and names. Alternatively, ps aux | grep process_name works for any partial match. For exact match, use pgrep -x process_name.

Can I Check Processes Without Using The Terminal?

Yes, most Linux desktops have a System Monitor app (GNOME) or KSysGuard (KDE). These graphical tools show processes, resource usage, and allow you to kill processes with a click.

How Do I Kill A Process That Is Not Responding?

First try kill PID (SIGTERM). If it doesn’t respond, use kill -9 PID (SIGKILL). You can also use pkill -9 process_name to kill by name. Be careful with SIGKILL as it doesn’t allow cleanup.

What Does A Zombie Process Mean In Linux?

A zombie process has finished execution but its parent hasn’t read its exit status. It shows as Z in ps output. Zombies are harmless but indicate a bug in the parent