Linux systems run dozens of background tasks, but you can easily list every active process with a single command. Understanding how to see what processes are running on linux is a fundamental skill for any system administrator or power user. This guide will walk you through every method, from simple commands to advanced monitoring tools, so you can always know exactly what your system is doing.
When you first start using Linux, the terminal can feel overwhelming. But once you learn a few key commands, you will feel like you have superpowers. Process management is one of those superpowers. It lets you spot runaway programs, check system health, and even kill stuck applications.
Let’s get started with the most common and powerful tools. You will be a process pro in no time.
How To See What Processes Are Running On Linux
The ps command is the classic way to view processes. It stands for “process status.” This command gives you a snapshot of what is running at that exact moment.
Open your terminal. Type ps and press Enter. You will see a short list. This list only shows processes tied to your current terminal session. That is not very useful for seeing everything.
To see all processes across the entire system, you need to add flags. The most common combination is ps aux. This shows every process for every user, in a detailed format.
Here is what ps aux displays:
- USER: The user who owns the process.
- PID: The process ID, a unique number.
- %CPU: CPU usage percentage.
- %MEM: Memory usage percentage.
- VSZ: Virtual memory size.
- RSS: Resident set size (physical memory used).
- TTY: The terminal associated with the process.
- STAT: Process status (e.g., running, sleeping).
- START: When the process started.
- TIME: Total CPU time used.
- COMMAND: The command that started the process.
Another useful variant is ps -ef. This also lists all processes, but in a slightly different format. Try both and see which one you prefer. The -e flag means “every process,” and -f means “full format listing.”
You can also filter the output. For example, to find a specific process like Firefox, use ps aux | grep firefox. The pipe (|) sends the output of ps aux to grep, which searches for the word “firefox.” This is incredibly handy when you have many processes running.
Using The Top Command For Real-Time Monitoring
While ps gives you a snapshot, top shows you a live, updating view. It is like a task manager for the terminal. Type top and press Enter. The display will refresh every few seconds.
The top of the screen shows system summary information. You will see uptime, number of users, and load average. Below that is a list of processes sorted by CPU usage by default.
Inside top, you can press keys to change the view:
- Press
Pto sort by CPU usage. - Press
Mto sort by memory usage. - Press
kto kill a process (you will be prompted for the PID). - Press
qto quit.
Top is great for quickly seeing which process is hogging resources. If your system feels slow, top is often the first command you should run.
A modern alternative to top is htop. It is more colorful and user-friendly. You may need to install it first with sudo apt install htop (on Debian/Ubuntu) or sudo dnf install htop (on Fedora). Htop lets you scroll vertically and horizontally, and you can kill processes with the F9 key. It is a big improvement over the classic top.
Checking Processes With The Pgrep And Pidof Commands
Sometimes you just need to find the process ID (PID) of a specific program. The pgrep command is perfect for this. For example, pgrep ssh will return the PID of any process named “ssh.”
If you want the process name along with the PID, use pgrep -l ssh. The -l flag lists the process name.
Another similar command is pidof. It returns the PID of a program. For instance, pidof firefox will show the PID of Firefox. Note that pidof might not be installed by default on all distributions.
These commands are useful for scripting. You can capture the PID and then use it with other commands like kill.
Using The /Proc Filesystem To See Processes
Linux exposes process information through a virtual filesystem called /proc. Each running process has a directory named after its PID inside /proc. For example, if a process has PID 1234, you can find its information in /proc/1234/.
You can browse this directory with commands like ls /proc. Inside each PID directory, you will find files like:
status: Human-readable process status.cmdline: The command that started the process.cwd: A symbolic link to the current working directory.exe: A symbolic link to the executable file.
For example, to see the command line of process 1234, you would type cat /proc/1234/cmdline. This is a low-level way to inspect processes, and it is very powerful for debugging.
You can also use ls -l /proc to see all running processes as directories. This method is not as user-friendly as ps or top, but it gives you direct access to the kernel’s process data.
Using System Monitor GUI Tools
If you prefer a graphical interface, Linux has you covered. Most desktop environments come with a system monitor application. On GNOME, it is called “System Monitor.” On KDE, it is “KSysGuard.” On Xfce, it is “Task Manager.”
These tools show processes in a table, similar to Windows Task Manager. You can sort by CPU, memory, or process name. You can also right-click a process to kill it or change its priority.
To open the system monitor, search for it in your applications menu. It is usually under “System” or “Administration.” If you cannot find it, you can often launch it from the terminal. For GNOME, type gnome-system-monitor. For KDE, type ksysguard.
GUI tools are great for beginners. They provide a visual overview without needing to remember command flags. However, for remote servers or minimal installations, you will rely on the command line.
Killing Processes That Are Misbehaving
Once you know how to see what processes are running on linux, you will eventually need to stop one. The kill command sends a signal to a process. The most common signal is SIGTERM (signal 15), which asks the process to terminate gracefully.
To kill a process by PID, use kill 1234. If the process does not respond, you can use SIGKILL (signal 9) with kill -9 1234. This force-kills the process immediately, but it may cause data loss.
You can also kill processes by name using pkill. For example, pkill firefox will send SIGTERM to all processes named “firefox.” Use pkill -9 firefox to force-kill them.
Another command is killall. It works similarly to pkill. For example, killall firefox will kill all Firefox processes. Be careful with killall because it kills all processes with that name, not just yours.
Always try a gentle kill first (SIGTERM). Only use SIGKILL if the process is completely stuck. This gives the process a chance to save data and clean up.
Understanding Process States And Zombies
When you look at process listings, you will see a status column. Common states include:
- R: Running or runnable (on the run queue).
- S: Sleeping (waiting for an event).
- D: Uninterruptible sleep (usually waiting for I/O).
- Z: Zombie (process has finished, but parent has not collected its exit status).
- T: Stopped (by a job control signal).
Zombie processes are dead processes that still appear in the process table. They do not use resources, but they clutter the list. A zombie is created when a child process ends but the parent process does not call wait() to read its exit status.
If you see many zombie processes, it indicates a bug in the parent program. You cannot kill a zombie directly. The zombie will disappear when the parent process calls wait() or when the parent itself is killed. If the parent is init (PID 1), the zombie will be cleaned up automatically.
To check for zombies, use ps aux | grep 'Z'. This filters for processes with status Z. If you find them, investigate the parent process.
Monitoring Processes With Systemd Tools
Modern Linux distributions use systemd as the init system. Systemd provides its own tools for managing processes and services. The systemctl command is used to manage systemd services.
To see all running services, use systemctl list-units --type=service --state=running. This shows services that are currently active. You can also use systemctl status to see detailed information about a specific service.
Another systemd tool is journalctl. It shows logs from systemd and other services. For example, journalctl -u ssh.service shows logs for the SSH service. This can help you understand why a process started or stopped.
Systemd also provides systemd-cgls, which shows the control group hierarchy. Control groups (cgroups) are used to limit and monitor resource usage for groups of processes. This is advanced, but useful for server environments.
Using The Lsof Command To See Open Files
The lsof command lists open files. Since everything in Linux is a file (including network sockets and pipes), lsof can show you what files a process has open. This is helpful for debugging why a file is locked or why a process is using a lot of file descriptors.
To see all open files for a specific process, use lsof -p 1234. Replace 1234 with the PID. To see which process has a specific file open, use lsof /path/to/file.
For network connections, use lsof -i. This shows all network connections and listening ports. For example, lsof -i :80 shows processes using port 80. This is invaluable for web server troubleshooting.
Lsof is not installed by default on all systems. You may need to install it with sudo apt install lsof or sudo dnf install lsof.
Checking Process Resource Usage With /Proc/Stat
For detailed resource usage, you can read /proc/stat and /proc/[pid]/stat. These files contain raw kernel statistics. They are not human-friendly, but they are used by tools like top and ps.
To see CPU statistics, use cat /proc/stat. The first line shows total CPU time spent in user mode, system mode, idle, and more. To see memory statistics, use cat /proc/meminfo.
For a specific process, cat /proc/1234/stat shows a long string of numbers. Each number represents a different metric, like process state, parent PID, priority, and CPU time. You can look up the format in the proc(5) man page.
This level of detail is usually overkill for everyday use. But if you are writing monitoring scripts or doing performance analysis, these files are gold mines.
Automating Process Monitoring With Scripts
You can combine these commands into scripts to monitor processes automatically. For example, a simple script to check if a process is running:
#!/bin/bash
if pgrep -x "firefox" > /dev/null
then
echo "Firefox is running."
else
echo "Firefox is not running."
fi
Save this as a file, make it executable with chmod +x script.sh, and run it. You can schedule it with cron to run periodically.
Another useful script is one that logs top CPU consumers. Use ps aux --sort=-%cpu | head -10 to get the top 10 processes by CPU usage. Redirect the output to a log file for later analysis.
Automation is where the real power lies. You can set up alerts when a process uses too much memory or when a critical service stops.
Common Mistakes And Troubleshooting
When learning how to see what processes are running on linux, you might run into a few issues. Here are some common mistakes:
- Forgetting flags: Running
pswithout flags shows only your processes. Always useps auxorps -effor a full list. - Mistaking PID for port: The PID is a number, not a port. Do not confuse them.
- Killing the wrong process: Double-check the PID before killing. Use
ps aux | grep [name]to confirm. - Not using sudo: Some processes are owned by root. You may need
sudoto see or kill them. - Ignoring zombie processes: A few zombies are normal, but many indicate a problem.
If a command does not work, check if it is installed. Many distributions do not include htop or lsof by default. Use your package manager to install them.
Frequently Asked Questions
What Is The Easiest Way To See Running Processes In Linux?
The easiest way is to use the top command. It shows a real-time, updating list of processes sorted by CPU usage. Just type top in the terminal and press Enter. Press q to quit.
How Do I See All Processes For All Users?
Use the ps aux command. This shows every process running on the system, regardless of which user started it. The output includes the user name, PID, CPU and memory usage, and the command.
Can I See Processes Without Using The Terminal?
Yes, most desktop environments have a graphical system monitor. On GNOME, it is called “System Monitor.” On KDE, it is “KSysGuard.” You can find it in the applications menu under “System.”
How Do I Find The Process ID Of A Specific Program?
Use the pgrep command followed by the program name. For example, pgrep firefox returns the PID of Firefox. Add the -l flag to see the name as well: pgrep -l firefox.