Linux Process Management: ps, top, kill, and systemctl

Every program running on Linux is a process. Knowing how to view, analyze, and control processes is essential for sysadmins — whether you are killing a runaway script, diagnosing high CPU usage, or understanding why a service will not stay up. This guide covers the tools you will use daily.

What Is a Process?

A process is a running instance of a program. Each process has a PID (Process ID), a PPID (Parent Process ID), an owner, and resource usage stats. PID 1 is always systemd — it is the ancestor of all other processes.

Viewing Processes with ps

ps aux                       # All processes, BSD-style output
ps -ef                       # All processes, UNIX-style output
ps aux | grep nginx          # Filter for nginx
ps -u alok                   # Processes owned by alok
ps -p 1234                   # Info for specific PID
ps --forest                  # Show parent-child tree

Key columns in ps aux: USER, PID, %CPU, %MEM, VSZ (virtual memory), RSS (actual RAM), STAT (R=running, S=sleeping, Z=zombie, D=I/O wait), COMMAND.

Real-Time Monitoring with top

top

Inside top, press: P sort by CPU, M sort by memory, k kill a PID, r renice, u filter by user, 1 show each CPU core, q quit.

top -b -n 1 | head -20    # One-shot batch output (for scripts)

htop — A Better top

sudo apt install htop -y
htop

htop provides color-coded CPU/memory bars, tree view, and mouse support. Press F9 to send signals, F6 to sort, F5 for tree view.

Finding Processes

pgrep nginx               # Get PID(s) of nginx
pgrep -l nginx            # PID + process name
pgrep -u alok             # All processes by user alok
pidof sshd                # PID of named program

Sending Signals with kill

kill 1234                  # SIGTERM (15) — graceful shutdown
kill -9 1234               # SIGKILL — force kill (no cleanup)
kill -HUP 1234             # SIGHUP — reload config
kill -STOP 1234            # Pause process
kill -CONT 1234            # Resume paused process

pkill nginx                # Kill by name (SIGTERM)
pkill -9 nginx             # Force kill by name
pkill -u alok              # Kill all processes by user
killall -HUP nginx         # Send signal to all nginx processes

Always try SIGTERM first. Use SIGKILL only when the process does not respond — it can leave locks and temp files behind.

Process Priority: nice and renice

Nice values range from -20 (highest priority) to 19 (lowest). Normal users can only lower priority. Root can set any value.

nice -n 10 ./backup.sh              # Start with low priority
renice -n 5 -p 1234                 # Change priority of running process
renice -n 15 -u backup_user         # Lower priority for all user processes

Background and Foreground Jobs

./long-script.sh &          # Run in background
jobs                        # List background jobs
fg 1                        # Bring job 1 to foreground
bg 1                        # Send job 1 to background
nohup ./script.sh &         # Run immune to hangup (survives logout)

Managing Services with systemctl

systemctl status nginx              # Show status and recent logs
systemctl start nginx               # Start service
systemctl stop nginx                # Stop service
systemctl restart nginx             # Stop + start
systemctl reload nginx              # Reload config without full restart
systemctl enable nginx              # Start automatically at boot
systemctl disable nginx             # Disable autostart
systemctl list-units --type=service # List all service units

Checking Resource Usage

ps aux --sort=-%cpu | head -10     # Top CPU consumers
ps aux --sort=-%mem | head -10     # Top memory consumers
lsof -p 1234                       # Files/sockets open by PID
lsof -i :80                        # What process is using port 80

Summary

Use ps and top to see what is running, kill and pkill to stop misbehaving processes, and systemctl to manage services reliably. Understanding process states, signals, and priority lets you keep systems stable even under load.