Scope: Debian-based and RHEL-based Linux distributions
Topics: Process listing, signals, priority, background jobs, zombie diagnosis, and the /proc filesystem.

1. List Running Processes#

List all processes of all users in BSD style:

ps aux

Columns:

• USER: Owner of the process.
• PID: Process ID.
• %CPU and %MEM: CPU and memory usage.
• VSZ and RSS: Virtual and resident memory in kibibytes.
• TTY: Controlling terminal. ? means no terminal.
• STAT: Process state. R running, S sleeping, Z zombie, T stopped.
• START: Start time of the process.
• TIME: Accumulated CPU time.
• COMMAND: Executed command.

List all processes in System V style:

ps -ef

Columns:

• UID: Owner of the process.
• PID and PPID: Process ID and parent process ID.
• C: CPU utilization.
• STIME: Start time.
• TTY, TIME: Terminal and accumulated CPU time.
• CMD: Full command line.

Filter the output with grep:

ps aux | grep <PROCESS_NAME>

2. Monitor Processes in Real Time#

Start the interactive monitor:

top

Options:

• P: Sorts by CPU usage.
• M: Sorts by memory usage.
• k: Prompts for a PID and sends a kill signal.
• 1: Shows one line per CPU core.
• q: Quits.

Install htop for a more readable interface.

On Debian-based systems:

apt install htop

On RHEL-based systems:

dnf install htop

Run it:

htop

3. Find Processes by Name#

Find PIDs by process name:

pgrep <PROCESS_NAME>
pidof <PROCESS_NAME>

Show the process name next to the PID:

pgrep -l <PROCESS_NAME>

Match against the full command line:

pgrep -a -f <PATTERN>

Expected output:

1234 /usr/bin/myapp --config /etc/myapp/myapp.conf

Options:

• -l: Prints the process name next to each PID.
• -a: Prints the full command line.
• -f: Matches the pattern against the full command line instead of the process name.

4. Send Signals to Processes#

Send the default signal (SIGTERM) by PID:

kill <PID>

Send a signal to every process with a given name:

killall <PROCESS_NAME>

Match processes by name or full command line:

pkill <PROCESS_NAME>
pkill -f <PATTERN>

Force a stuck process to stop:

kill -9 <PID>
kill -KILL <PID>

Options:

• -9 or -KILL: Sends SIGKILL. The process cannot catch or ignore it.
• -1 or -HUP: Sends SIGHUP. Many daemons reload their configuration.
• -f: Matches the pattern against the full command line.

Signal reference:

Prefer SIGTERM first. Give the process a chance to clean up before using SIGKILL.

5. Adjust Process Priority#

Priority values range from -20 (highest priority) to 19 (lowest priority).

Start a command with a modified priority:

nice -n <NICE_VALUE> <COMMAND>

Change the priority of a running process:

renice -n <NICE_VALUE> -p <PID>

Options:

• -n <NICE_VALUE>: Sets the niceness value. Range -20 to 19.
• -p <PID>: Applies the change to an existing process.

Only root can set negative nice values or raise the priority of a process. Verify the result:

ps -o pid,ni,comm -p <PID>

Expected output:

  PID  NI COMMAND
 1234   5 myapp

6. Run Jobs in the Background#

Start a job in the background:

<COMMAND> &

List the current shell jobs:

jobs

Suspend a foreground job with Ctrl+Z, then resume it:

bg %<JOB_ID>

Bring a job back to the foreground:

fg %<JOB_ID>

Keep a job running after logout:

nohup <COMMAND> > <LOG_FILE> 2>&1 &

Options:

• &: Starts the job in the background.
• bg: Resumes a stopped job in the background.
• fg: Brings a background or stopped job to the foreground.
• nohup: Ignores SIGHUP so the job survives logout. Without redirection, output goes to nohup.out.
• Ctrl+C: Sends SIGINT and terminates the foreground job.

Background jobs belong to the shell session. Use nohup or a systemd service for long-running work.

7. Diagnose Zombie Processes#

List zombie processes:

ps aux | awk '$8 ~ /Z/'

Alternatively:

ps -eo pid,ppid,stat,cmd | awk '$3 ~ /Z/'

Identify the parent process:

ps -o pid,ppid,stat,cmd -p <ZOMBIE_PID>

A zombie is a terminated process whose exit status has not been read by its parent. It consumes no CPU and almost no memory, but it retains a process table entry.

Ask the parent to reap its children:

kill -SIGCHLD <PPID>

If the parent does not respond, restart the parent service. When the parent exits, the zombie is adopted by init or systemd and removed automatically. SIGKILL cannot remove a zombie because the process is already dead.

8. Inspect the /proc Filesystem#

Every running process has a directory under /proc/<PID>. Inspect it:

ls /proc/<PID>

Common entries:

• /proc/<PID>/cmdline: Command-line arguments, separated by null bytes.
• /proc/<PID>/status: State, memory, threads, and UID in readable form.
• /proc/<PID>/exe: Symlink to the executed binary. Resolve it with readlink.
• /proc/<PID>/cwd: Symlink to the working directory.
• /proc/<PID>/fd: Open file descriptors.
• /proc/<PID>/environ: Environment variables, separated by null bytes.

cat /proc/<PID>/cmdline
cat /proc/<PID>/status
readlink /proc/<PID>/exe
readlink /proc/<PID>/cwd
ls -l /proc/<PID>/fd

/proc/<PID> disappears when the process exits.

Part 3: Important Notes#

ps Output Comparison#

Signal Delivery Tools#

Job Control Reference#

Security Guidelines#

• Replace placeholders such as <PID>, <PROCESS_NAME>, and <NICE_VALUE> with real values. Do not include the angle brackets in commands.
• Send SIGTERM before SIGKILL. Forced kills can leave incomplete writes and corrupted state.
• Verify PIDs with ps before sending signals. killall and pkill affect every matching process.
• Test pkill -f <PATTERN> with pgrep -f <PATTERN> first to preview the matched processes.
• Do not run application processes as root. Use dedicated system accounts.
• Only root can set negative nice values or signal processes owned by other users.
• Treat /proc/<PID>/environ and /proc/<PID>/cmdline as sensitive; they may contain credentials.
• Redirect nohup output to a log file with restrictive permissions instead of relying on nohup.out.
• Fix zombie accumulation in the parent process. Do not attempt to kill the zombie itself.