When a Linux computer becomes slow, overheats, freezes, or stops responding normally, I usually check its active processes before changing configurations or restarting the machine. A single application may be consuming too much memory, a background service may be stuck, or an unexpected process may be using most of the available CPU.
Learning How to Monitor Running Processes in Linux gives you a direct view of what the operating system is doing. Linux includes several built-in commands for viewing process IDs, resource consumption, process states, parent-child relationships, and system services. Some commands provide a one-time snapshot, while others update continuously.
Understanding Linux Processes and PIDs
A process is an active instance of a program. Opening a browser, starting a web server, running a script, or launching a terminal creates one or more processes.
Every process receives a unique process ID, commonly called a PID. Linux uses this number to track and manage the process. Processes may also have a parent process ID, which identifies the process that started them.
Common process states include running, sleeping, stopped, zombie, and uninterruptible sleep. A sleeping process is not necessarily a problem. Many background services remain asleep until they receive work. A zombie process, however, has completed but has not been properly collected by its parent.
Use ps to View a Process Snapshot
The ps command displays a snapshot of processes at the moment the command runs. It does not update continuously, making it useful for reports, scripts, and quick inspections.
Run the following command to see processes associated with the current terminal:
ps
For a more complete view, use:
ps aux
This version displays processes from all users along with CPU usage, memory usage, PID, start time, status, and command information.
The %CPU column shows processor consumption, while %MEM shows the percentage of physical memory being used. The STAT column indicates the process state.
Sort Processes by CPU Usage
To identify applications consuming the most processor time, run:
ps aux –sort=-%cpu | head
The minus sign sorts the results from highest to lowest. This command is especially useful when a machine suddenly becomes slow or its fans begin running heavily.
Sort Processes by Memory Usage
To find the largest memory consumers, use:
ps aux –sort=-%mem | head
A process using significant memory is not automatically faulty. Databases, browsers, virtual machines, and development tools may legitimately require large amounts of RAM. Investigate unusual growth or consumption that affects other applications.
Use top for Real-Time Monitoring
The top command provides a continuously updating view of system activity:
top
The upper section shows load averages, task counts, CPU activity, memory usage, and swap usage. The lower section lists individual processes.
Inside top, press P to sort by CPU consumption and M to sort by memory consumption. Press k to send a signal to a process, r to change its priority, and q to exit.
Load average represents the amount of work waiting for or using system resources over one, five, and fifteen minutes. A consistently high load may indicate CPU pressure, blocked disk operations, or too many competing tasks.
Use htop for an Interactive View
On Debian or Ubuntu systems, install it with:
sudo apt install htop
On Fedora or similar distributions, use:
sudo dnf install htop
Then start it by running:
htop
You can navigate with the keyboard, search for processes, display processes as a tree, change priorities, and send termination signals. Although htop is convenient, it may not be installed by default on minimal servers.
Find a Specific Process with pgrep
When you know the application or service name, pgrep is faster than reading a long process list.
pgrep nginx
To display both the PID and command name, use:
pgrep -a nginx
You can also use pidof for programs that are already running:
pidof nginx
Another common method combines ps with grep:
ps aux | grep nginx
However, this may include the grep command itself. pgrep usually produces cleaner results.
View Parent and Child Processes with pstree
The htop utility provides a more visual and user-friendly alternative to top. It uses colored meters, supports scrolling, and makes searching or filtering easier.
On Debian or Ubuntu systems, install it with:
sudo apt install htop
On Fedora or similar distributions, use:
sudo dnf install htop
Then start it by running:
htop
You can navigate with the keyboard, search for processes, display processes as a tree, change priorities, and send termination signals. Although htop is convenient, it may not be installed by default on minimal servers.
Find a Specific Process with pgrep
When you know the application or service name, pgrep is faster than reading a long process list and can help you quickly check per process user activity.
pgrep nginx
To display both the PID and command name, use:
pgrep -a nginx
You can also use pidof for programs that are already running:
pidof nginx
Another common method combines ps with grep:
ps aux | grep nginx
However, this may include the grep command itself. pgrep usually produces cleaner results.
Monitor Services Managed by systemd
Many background applications run as systemd services. Check a service with:
systemctl status nginx
This displays its current state, main PID, recent log messages, and resource information.
For more detailed logs, run:
journalctl -u nginx
To follow new entries continuously, add the -f option:
journalctl -u nginx -f
Monitoring both the process and its logs provides more context than relying on CPU or memory figures alone.
Stop a Problematic Process Safely
Once you identify a faulty process, try a normal termination signal first:
kill PID
Replace PID with the actual process ID. This sends SIGTERM, allowing the program to perform cleanup before closing.
Use forceful termination only when the process ignores the normal signal:
kill -9 PID
You can terminate processes by name with pkill, but use it carefully because multiple matching processes may be affected.
For systemd services, restarting through systemd is generally safer:
sudo systemctl restart nginx
Frequently Asked Questions
1. What is the easiest way to learn How to Monitor Running Processes in Linux?
Start with ps aux for a one-time snapshot, top for live updates, and htop for a more interactive interface.
2. How can I monitor only one Linux process?
Find its PID with pgrep, then use top -p PID or pidstat -p PID to focus on that process.
3. How do I identify a zombie process?
Run ps aux and look for Z in the STAT column. You normally need to address its parent process rather than killing the zombie directly.
The Final Check Before You Restart Everything
I prefer investigating the active workload with a one time snapshot before restarting an entire Linux system. A restart may temporarily hide the symptom without revealing the process, service, or application responsible for it.
My usual workflow begins with ps aux, moves to top or htop for live activity, and then uses pgrep, pstree, pidstat, or iotop for deeper investigation. When a service is involved, I check both systemctl and journalctl before taking action.
Once you understand How to Monitor Running Processes in Linux, performance problems become easier to isolate, explain, and resolve without unnecessary disruption.
Leave a Reply