Linux administrators often need to answer a simple question: which process is using the CPU, memory, or a particular service? This lesson introduces safe, repeatable process inspection before making changes.

Learning objectives

• Identify processes with ps and pgrep.
• Inspect live activity using top.
• Understand PID, PPID, CPU and memory columns.
• Use signals cautiously with kill.

Inspect running processes

Run ps aux to list processes. To sort by CPU usage, run ps -eo pid,ppid,user,%cpu,%mem,comm --sort=-%cpu | head. To find an SSH daemon, run pgrep -a sshd.

ps aux displays a snapshot; pgrep -a matches a process name and prints its command line. A PID identifies a process, while PPID identifies its parent. Avoid assuming that a PID still belongs to the same process later: identifiers can be reused.

Watch activity live

Run top to monitor processes interactively, or top -p 1234 to monitor one verified PID.

Use q to exit. Replace 1234 with a verified process ID. CPU percentages and memory columns help identify candidates for investigation, but a high reading alone does not prove a fault.

Signals are requests, not guaranteed shutdowns

Use kill -TERM 1234 to request a graceful shutdown, or kill -0 1234 to check process existence and signaling permission without sending a termination signal.

SIGTERM requests termination and gives a process an opportunity to clean up. kill -0 checks whether the process exists and whether you have permission to signal it; it does not stop anything. Do not use SIGKILL as a routine first step, particularly on databases, storage services, or production workloads. Verify the PID and service owner first.

Practice lab

1. Run sleep 120 & in a test shell.
2. Find the process with pgrep -a sleep.
3. Inspect its PID and parent with ps -o pid,ppid,stat,comm -p PID.
4. Send kill -TERM PID using the PID you verified.
5. Confirm the process is gone. Do not target unrelated processes.

Knowledge check

1. How does ps differ from top? 2. What does PPID mean? 3. Why should you verify a PID immediately before signaling it? 4. What signal does kill -TERM request?

Answer guide

1. ps shows a snapshot, while top updates interactively. 2. Parent process ID. 3. PIDs may be reused and targeting the wrong process is dangerous. 4. SIGTERM, a request for orderly termination.

Continue practicing with the Linux Foundation Introduction to Linux course and the Linux ps manual.