What a Process Is

Programs that are running

A process is a program that’s running. Linux runs many at once by switching between them very quickly, so it seems they all run together ¹.

At boot, the kernel starts a program called init, which on nearly every distribution today is systemd. It’s always process ID 1, and it starts all the system’s services ¹. Many of those services are daemons: programs that sit in the background with no window or terminal, like the SSH server, the scheduler cron, and the network manager. So even with nobody logged in, the system is quietly busy ¹.

Any process can start others. The starter is the parent, the new one its child: your login session starts bash, and bash starts every command you type ¹. A child inherits its parent’s user and environment, which is why export works the way it does.

The kernel keeps track of each process: a process ID (PID), its owner, the memory it uses, and whether it’s ready to run ¹. Processes have owners just like files do.

ps

ps takes a snapshot of processes ¹:

me@linuxbox:~$ ps
    PID TTY          TIME CMD
   2210 pts/0    00:00:00 bash
   2390 pts/0    00:00:00 ps

Plain ps shows only this terminal’s processes. Two option sets cover most needs ¹:

me@linuxbox:~$ ps x          # all your processes, terminal or not
me@linuxbox:~$ ps aux        # everyone's processes, with details

(They’re written without a dash, in the older BSD style; ps -ef is the equivalent you’ll see in other guides.)

The ps aux columns ¹:

The state letters ¹:

Extra letters after it mean higher (<) or lower (N) priority, among other things. Mostly you’ll see S: most processes spend their lives waiting.

ps aux is long, so pipe it: ps aux | less, ps aux | grep firefox, or sort by memory with ps aux --sort=-rss | head.

top

top shows processes live, refreshing every few seconds, busiest first ¹:

me@linuxbox:~$ top
top - 09:52:01 up 3 days,  2:11,  1 user,  load average: 0.42, 0.37, 0.30
Tasks: 213 total,   1 running, 212 sleeping,   0 stopped,   0 zombie
%Cpu(s):  3.1 us,  1.0 sy,  0.0 ni, 95.6 id,  0.2 wa, ...
MiB Mem :  15899.6 total,   6412.3 free,   4214.0 used,   5273.3 buff/cache

The header ¹:

• Load average: how many processes were running or waiting to run, averaged over the last 1, 5, and 15 minutes. Compare it with your number of CPU cores (nproc): below that, the machine is keeping up; well above it, work is queueing.
• %Cpu: us is your programs, sy the kernel, id idle, wa waiting on the disk.
• Mem: buff/cache is memory Linux borrows to cache files; it gives it back the moment a program needs it, so “free” looking small isn’t a problem. available is the number to watch.

Keys inside top: M sorts by memory, P by CPU, k kills a process by PID, 1 shows each core, h for help, q to quit.

htop (sudo apt install htop) is a friendlier version with colors, scrolling, and mouse support. It’s what most people use day to day.

pstree and friends

pstree draws the parent-child tree ¹:

me@linuxbox:~$ pstree -p | less
systemd(1)─┬─cron(640)
           ├─sshd(812)
           ...

Other quick checks: uptime for load, free -h for memory, vmstat 5 for a running summary every five seconds (Ctrl-C to stop) ¹, and pgrep firefox to get a program’s PIDs by name.

Your turn

So

Every running program is a process with an ID, an owner, and a parent, all descending from systemd, PID 1. ps aux takes a snapshot, top or htop watches live, and pstree shows the family tree. Read load average against your core count, and watch available memory, not free.