How To Check Running Process In Linux Command

Using the `ps` command in Linux lists every active process along with its process ID. If you’re learning how to check running process in linux command, you’ve come to the right place. This guide will show you the most effective ways to monitor and manage processes directly from your terminal.

Processes are the heart of any Linux system. Every program you run, from a simple text editor to a web server, is a process. Knowing how to check them is a fundamental skill for system administrators, developers, and power users.

Let’s start with the basics and work our way up to more advanced techniques. You’ll learn commands that work on Ubuntu, CentOS, Debian, and almost every other Linux distribution.

Why You Need To Check Running Processes

Checking processes helps you troubleshoot problems. If your system is slow, you can find which program is using too much CPU or memory. If an application freezes, you can identify and kill it.

It also helps with security. You can spot unauthorized processes or malware running on your machine. Regular monitoring keeps your system healthy and responsive.

The most common command for checking processes is `ps`. It stands for “process status.” Without any options, `ps` shows only processes running in your current terminal session.

To see all processes on the system, use:

ps aux

This command shows every process from every user. The output includes the user, process ID (PID), CPU and memory usage, and the command that started the process.

Another useful variant is:

ps -ef

This gives similar information but in a different format. Both commands are widely used and equally effective.

Understanding The Ps Output

The `ps aux` output has several columns:

USER: The owner of the process
PID: Process ID number
%CPU: CPU usage percentage
%MEM: Memory usage percentage
VSZ: Virtual memory size
RSS: Resident set size (physical memory used)
TTY: Terminal associated with the process
STAT: Process status (running, sleeping, etc.)
START: Time the process started
TIME: Total CPU time used
COMMAND: The command that launched the process

Knowing these columns helps you interpret the data quickly. For example, if %CPU is above 90%, that process is likely causing high load.

Filtering Processes By User

To see processes owned by a specific user, use the `-u` option:

ps -u username

Replace “username” with the actual user name. This is helpful when you want to check what a particular user is running.

You can also combine options:

ps -u root -u www-data

This shows processes for both root and the web server user.

Searching For Specific Processes

When you have many processes running, finding one can be hard. Use `grep` to search:

ps aux | grep apache

This filters the output to show only lines containing “apache.” You can replace “apache” with any process name.

Note that the grep command itself will appear in the output. To exclude it, add `grep -v grep`:

ps aux | grep apache | grep -v grep

Or use `pgrep` for a cleaner approach:

pgrep -l apache

This shows only the PID and name of matching processes.

Using Top For Real-Time Monitoring

The `top` command provides a dynamic, real-time view of running processes. It updates every few seconds by default.

Simply type:

top

The output shows system summary information at the top, followed by a list of processes sorted by CPU usage. You can press keys to interact:

q: Quit top
k: Kill a process (enter PID)
r: Renice a process (change priority)
M: Sort by memory usage
P: Sort by CPU usage
u: Show processes for a specific user

Top is excellent for spotting resource hogs immediately. If your system feels sluggish, run top and look for processes with high %CPU or %MEM.

Htop: A Better Alternative

`htop` is an improved version of top. It offers a more colorful and user-friendly interface. Install it with:

sudo apt install htop   # Debian/Ubuntu
sudo yum install htop   # CentOS/RHEL

Then run:

htop

Htop shows processes in a tree view by default. You can scroll vertically and horizontally. Use function keys to filter, search, and kill processes.

It also displays CPU cores individually, making it easier to spot imbalances.

Checking Processes With Pstree

The `pstree` command shows processes in a tree format. This helps you understand parent-child relationships.

pstree

Output looks like:

systemd─┬─NetworkManager───2*[{NetworkManager}]
        ├─cron
        ├─sshd───sshd───bash───pstree

You can see that `sshd` started a `bash` shell, which then ran `pstree`. This visual representation is useful for debugging.

To show PIDs alongside process names:

pstree -p

To show processes for a specific user:

pstree username

Using Lsof To Check Open Files

Every process opens files. The `lsof` command lists open files and the processes that opened them.

lsof

This can produce a lot of output. Filter by process name:

lsof -c apache

Or by PID:

lsof -p 1234

Replace 1234 with the actual PID. Lsof is invaluable when you need to know which process is using a file or network port.

Checking Network Connections

To see which processes are using network connections, combine `lsof` with `-i`:

lsof -i

This shows all internet and x.25 network files. To check a specific port:

lsof -i :80

This reveals which process is listening on port 80, typically a web server.

Using Systemd Tools

Modern Linux systems use systemd. The `systemctl` command manages services, but you can also check processes with:

systemctl status service_name

This shows the main PID, status, and recent log entries for that service.

To list all running services:

systemctl list-units --type=service --state=running

This gives a clean overview of active services.

Journalctl For Process Logs

The `journalctl` command queries the systemd journal. To see logs for a specific process:

journalctl _PID=1234

Replace 1234 with the PID. This shows all log entries generated by that process.

To follow logs in real-time:

journalctl -f

This is useful when debugging a running process.

Killing Unresponsive Processes

Once you identify a problematic process, you may need to terminate it. The `kill` command sends signals to processes.

First, find the PID:

ps aux | grep bad_process

Then kill it:

kill 1234

Replace 1234 with the PID. This sends SIGTERM (signal 15), which asks the process to terminate gracefully.

If the process doesn’t respond, use SIGKILL:

kill -9 1234

This forces immediate termination. Use it only when necessary, as it doesn’t allow cleanup.

For convenience, use `pkill` to kill by name:

pkill bad_process

Or `killall`:

killall bad_process

Both commands kill all processes with that name.

Automating Process Monitoring

You can script process checks using shell scripts. For example, to check if Apache is running:

#!/bin/bash
if pgrep -x "apache2" > /dev/null
then
    echo "Apache is running"
else
    echo "Apache is not running"
fi

This script uses `pgrep` to check for the process. You can schedule it with cron for regular monitoring.

For more advanced monitoring, consider tools like `monit` or `nagios`. They provide alerts when processes fail.

Common Pitfalls And Tips

Beginners often confuse process names with command names. For example, the Apache process might be named “apache2” or “httpd” depending on the distribution.

Always check the exact process name with:

ps aux | grep -i apache

Another common mistake is forgetting that `ps` without options shows only your own processes. Always use `ps aux` or `ps -ef` for a system-wide view.

When using `grep`, remember that it matches patterns. If you search for “bash”, it will also match “bashrc” or “bash_history”. Use `-w` for whole-word matching:

ps aux | grep -w bash

This avoids false positives.

Finally, be careful with `kill -9`. It doesn’t give the process a chance to save data or release resources. Use SIGTERM first, and only escalate if necessary.

Frequently Asked Questions

What Is The Difference Between Ps And Top?

`ps` shows a snapshot of processes at a specific moment. `top` updates continuously in real-time. Use `ps` for one-time checks and `top` for ongoing monitoring.

How Do I See All Processes Including Those Of Other Users?

Use `ps aux` or `ps -ef`. These commands show processes for all users on the system. You need appropriate permissions to see other users’ processes.

Can I Check Running Processes Without Sudo?

Yes, most process-checking commands work without sudo. However, some processes may be hidden from non-root users. Use `sudo` when you need full visibility.

How Do I Find The Process Using The Most Memory?

Use `top` and press `M` to sort by memory. Alternatively, use `ps aux –sort=-%mem | head` to show the top memory consumers.

What Does The STAT Column In Ps Output Mean?

The STAT column shows process state. Common values include R (running), S (sleeping), D (uninterruptible sleep), Z (zombie), and T (stopped).

Putting It All Together

Now you know multiple ways to check running processes in Linux. Start with `ps aux` for a quick overview. Use `top` or `htop` for real-time monitoring. Filter with `grep` to find specific processes.

Remember the key commands:

ps aux – List all processes
top – Real-time process monitor
htop – Enhanced process viewer
pstree – Tree view of processes
lsof – List open files by process
kill – Terminate processes

Practice these commands on your system. The more you use them, the more natural they become. Process management is a core Linux skill that will serve you well in any sysadmin or development role.

If you encounter any issues, check the man pages:

man ps
man top
man kill

These provide complete documentation for each command.

With these tools, you can confidently monitor and manage processes on any Linux system. Start using them today to keep your system running smoothly.