BeginnerLinux

Linux Process Management: Monitoring and Controlling Processes

Learn to manage Linux processes effectively including monitoring tools, signals, priority control, background jobs, and automation with systemd.

#process management#Linux#systemd#signals#monitoring

Controlling Processes in Linux

When a system is compromised, malicious processes hide among legitimate ones. Knowing how to inspect, prioritize, and terminate processes gives you the ability to identify anomalies, stop attacks in progress, and keep your own tools running efficiently. This guide covers the practical skills you need to manage processes from the command line.

Prerequisites

Basic Linux command line knowledge. Familiarity with ps and top commands.

Process States

| State | Code | Description |

|-------|------|-------------|

| Running | R | Currently executing or in run queue |

| Sleeping | S | Waiting for an event (interruptible) |

| Uninterruptible Sleep | D | Waiting for I/O |

| Stopped | T | Paused by a signal |

| Zombie | Z | Terminated but not cleaned up by parent |

Viewing Processes

ps — Process Snapshot

ps aux                          # All processes with details
ps ux                           # Current user's processes
ps auxf                         # Process tree
ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%mem | head -10  # Sort by memory

Output columns: USER, PID, %CPU, %MEM, VSZ, RSS, TTY, STAT, START, TIME, COMMAND.

top — Dynamic Process Viewer

top

Interactive keys: P (sort by CPU), M (sort by memory), k (kill process), u (filter by user), q (quit).

htop — Enhanced Viewer

sudo apt install htop
htop

Color-coded, mouse support, easier process management.

Process Signals

kill -1 PID     # SIGHUP - Reload configuration
kill -2 PID     # SIGINT - Interrupt (Ctrl+C)
kill -9 PID     # SIGKILL - Force kill (cannot be ignored)
kill -15 PID    # SIGTERM - Terminate gracefully (default)
kill -19 PID    # SIGSTOP - Pause
kill -18 PID    # SIGCONT - Resume

Sending Signals

kill -15 1234                  # Kill by PID
pkill -9 firefox               # Kill by name
killall -15 chrome             # Kill by name pattern
pkill -u username              # Kill all processes for a user
timeout 5 tail -f /var/log/syslog  # Kill after timeout

Always try SIGTERM (15) first — allows clean shutdown. Use SIGKILL (9) only when a process does not respond.

Process Priority (Nice Values)

Values range from -20 (highest priority) to 19 (lowest).

nice -n 10 ./backup_script.sh     # Start with lower priority
renice -n -5 -p 1234              # Change priority of running process (root only)
ps -eo pid,ni,cmd | sort -k2      # View priorities

Background and Foreground Jobs

nmap -sV 192.168.1.1 &            # Run in background
# Ctrl+Z suspends current foreground job
jobs                               # List background jobs
fg %1                              # Bring job to foreground
bg %1                              # Send to background
nohup ./long_script.sh &           # Continue after logout
disown %1                          # Remove from job table

systemd Service Management

systemctl list-units --type=service    # List all services
systemctl status ssh                   # Check service status
sudo systemctl start ssh               # Start a service
sudo systemctl stop ssh                # Stop a service
sudo systemctl restart ssh             # Restart a service
sudo systemctl enable ssh              # Enable at boot
sudo systemctl disable ssh             # Disable at boot
journalctl -u ssh                      # View service logs
journalctl -u ssh -f                   # Follow service logs

Monitoring Resource Usage

sudo iotop              # Disk I/O monitoring
sudo nethogs            # Network usage per process
free -h                 # Memory usage
lsof -p 1234            # Open files for a process
lsof -i -P -n           # Network connections

Real-World Examples

Finding resource hogs: ps aux --sort=-%mem | head -5

Monitoring user activity: ps -u username -o pid,cmd,etime

Detecting suspicious processes: Unusual names, hidden from ps, running from /tmp, high network I/O may indicate malware.

Killing unresponsive scans: pkill -9 nmap

Common Mistakes

Using kill -9 as first resort — always try SIGTERM first. Ignoring zombie processes. Running GUI tools without backgrounding (wireshark &). Not using cgroups for resource limits in production.

Best Practices

Use top/htop for interactive monitoring. Always SIGTERM before SIGKILL. Use systemd for long-running processes. Monitor resources proactively. Use ulimit -n to check file descriptor limits.

Related Tools

htop — Enhanced process viewer. atop — Advanced monitor with logging. glances — Cross-platform monitoring. lsof — List open files. strace — Trace system calls. perf — Linux profiling.

linux-commands-explained

command-line-essentials

linux-terminal-guide

linux-file-permissions

kali-linux-beginner-guide

Summary

Linux process management involves viewing (ps,top, htop), sending signals (kill, pkill), controlling priority (nice, renice), managing jobs (&, jobs, fg, bg), and administering systemd services (systemctl, journalctl).

Knowledge Check

What are the main columns shown by `ps aux`?

What is the difference between SIGTERM and SIGKILL?

How do you run a command in the background?

What command checks systemd service status?

What does a zombie process indicate?

Frequently Asked Questions

What is the difference between SIGTERM and SIGKILL?

SIGTERM (kill -15) asks the process to shut down gracefully, allowing it to save data and release resources. SIGKILL (kill -9) forces immediate termination with no cleanup. Always try SIGTERM first — use SIGKILL only when a process ignores SIGTERM. See our [Linux commands guide](/learn/linux-commands-explained) for more signals.

How do I find which process is using a specific port?

Use `ss -tulpn | grep :80` or `lsof -i :80` to find processes bound to a port. `netstat -tulnp` also works on older systems. For root processes, you may need sudo. This is essential for troubleshooting port conflicts and identifying unauthorized services.

What does ps aux output mean?

USER is the owner, PID is the process ID, %CPU and %MEM show resource usage, STAT indicates process state (R=running, S=sleeping, Z=zombie), and COMMAND shows the full command. Use `ps aux --sort=-%mem | head` to find memory hogs quickly.

What is a zombie process and how do I fix it?

A zombie process (Z state) has finished executing but its parent hasn't collected its exit status. Zombies consume no resources but indicate a parent process bug. Find them with `ps aux | grep Z`, identify the parent with `ps -o ppid= -p PID`, and fix or restart the parent process.

How do I run a process in the background?

Append & to any command: `nmap -sV target &`. Use Ctrl+Z to suspend a foreground process, then bg to send it to background. Use jobs to list background jobs and fg %1 to bring job 1 back to foreground. Use nohup to keep processes running after logout.

What is systemctl and how do I use it?

systemctl manages systemd services: `systemctl status ssh` checks status, `sudo systemctl start/stop/restart ssh` controls the service, and `systemctl enable/disable ssh` controls boot behavior. Use `journalctl -u ssh -f` to follow service logs in real time.

What is the difference between nice and renice?

nice sets priority when starting a process: `nice -n 10 ./script.sh` starts with lower priority (19 is lowest). renice changes priority of a running process: `renice -n -5 -p 1234` requires root. Lower values mean higher priority — only root can use negative values.

How do I monitor system resources in real time?

Use htop for an interactive process viewer with sorting, filtering, and mouse support. Use `iotop` for disk I/O per process, `nethogs` for network usage per process, and `free -h` for memory overview. For persistent monitoring, install glances with `sudo apt install glances`.

What are the different process states in Linux?

R=Running or in run queue, S=Sleeping (interruptible), D=Uninterruptible sleep (I/O bound), T=Stopped by signal, Z=Zombie (terminated but not reaped). Use `ps aux` or `top` to see the STAT column. D-state processes are waiting for disk I/O and usually clear quickly.

How do I kill all processes for a specific user?

Use `pkill -u username` to terminate all processes owned by that user, or `killall -u username` for the same effect. For a specific process name, use `pkill -9 firefox`. Always verify with `ps -u username` before killing to avoid terminating critical processes.

How do I check open files for a running process?

Use `lsof -p PID` to list all files, network connections, and sockets for a specific process. `lsof -i -P -n` shows all network connections system-wide. For a specific file, `lsof /var/log/syslog` shows which processes have it open.

What is the difference between nohup and disown?

nohup makes a command immune to the HUP signal (sent when terminal closes) and redirects output to nohup.out. disown removes a job from the shell's job table so it won't receive HUP. Use nohup when starting new processes and disown for already-running background jobs.