How to List Running Processes in Linux: Command Line Guide

Coded Java

9 min read

·

10-11-2024

63

0

Share

Understanding and managing running processes is a fundamental skill in Linux system administration. Whether you're troubleshooting a performance issue, identifying resource hogs, or simply need to see what's currently active, knowing how to list and manipulate processes is essential. This comprehensive guide will provide you with a detailed exploration of Linux process management, equipping you with the tools and knowledge to navigate the complex world of running applications.

Understanding Linux Processes

Before we delve into the command-line tools, let's establish a basic understanding of what processes are in the context of Linux. A process represents an instance of a program in execution. When you launch a software application, the operating system creates a process to handle its execution. Each process is a separate, isolated environment with its own memory space, resources, and execution context.

Linux employs a hierarchical process model, with a single "init" process at the root. Every other process is a descendant of this initial process. This hierarchical structure enables a systematic and organized approach to process management.

The Power of ps

The ps command is a cornerstone of Linux process management. It stands for "process status" and offers a wealth of information about running processes. Let's break down its usage and explore its diverse options:

Basic Process Listing

At its simplest, ps displays a list of currently running processes. The output is displayed in a tabular format with columns representing different attributes of each process.

ps

Output:

Explanation:

• PID (Process ID): A unique numerical identifier for each process.
• USER (User Name): The user account that owns the process.
• %CPU (CPU Usage): Percentage of CPU time consumed by the process.
• %MEM (Memory Usage): Percentage of system memory consumed by the process.
• VSZ (Virtual Memory Size): Virtual memory size in kilobytes.
• RSS (Resident Set Size): Resident set size in kilobytes (actual memory occupied).
• TTY (Terminal): The terminal or pseudo-terminal from which the process is running.
• STAT (Status): A code reflecting the process's current state (e.g., "S" for sleeping, "R" for running).
• START (Start Time): Time when the process was started.
• TIME (Elapsed Time): CPU time used by the process.
• COMMAND (Command Name): The command used to launch the process.

Refining the Output with ps Options

ps offers a plethora of options to customize the output and retrieve specific information. Here are some of the most useful ones:

• -a (all processes): Lists all processes, including those owned by other users.
• -e (all processes): Equivalent to -a.
• -f (full process information): Provides a more comprehensive output with additional columns like process ID, parent process ID, and command arguments.
• -u (user information): Displays information about processes belonging to a specific user.
• -x (display even non-terminal processes): Lists processes that are not associated with a terminal.
• -l (long listing): Similar to -f, but also includes the process's terminal, status, and priority.

Example:

To list all processes owned by the user "user," use the following command:

ps -u user

To display a long listing of processes, including the command arguments, use:

ps -ef

The Versatility of top

The top command provides a dynamic and interactive view of system processes, continuously updating the list of processes and their resource usage. It's an invaluable tool for monitoring system performance and identifying potential bottlenecks.

Exploring top

Upon execution, top presents a real-time display of system statistics, including:

• Task: The number of processes currently running.
• CPU: CPU usage statistics, broken down into different states (user, system, nice, idle, I/O wait, etc.).
• Mem: Memory usage statistics, including total memory, used memory, free memory, and buffers.
• Swap: Swap space usage statistics, including total swap, used swap, and free swap.

Below this system summary, top displays a list of running processes, similar to ps, but with additional columns:

• PID: Process ID.
• USER: User name.
• PR (Priority): Process priority (higher values indicate higher priority).
• NI (Nice Value): Nice value, a numerical indicator of how much CPU time the process should receive (lower values indicate higher priority).
• VIRT (Virtual Memory): Virtual memory size in kilobytes.
• RES (Resident Set Size): Resident set size in kilobytes (actual memory occupied).
• SHR (Shared Memory): Shared memory size in kilobytes.
• %CPU: CPU usage percentage.
• %MEM: Memory usage percentage.
• TIME+: Cumulative CPU time used by the process.
• COMMAND: Command name.

Navigating top

top provides interactive controls to navigate through the process list and adjust its display:

• q (quit): Exits the top command.
• h (help): Displays a help message with available commands.
• z (toggle display mode): Toggles between a full and compressed display of the process list.
• k (kill process): Allows you to send a signal (e.g., SIGKILL) to a specific process.
• c (show command): Displays the full command line used to launch the process.
• r (rename process): Allows you to rename a process.
• s (sort by column): Sorts the process list by a specific column.

Using top to Identify Resource Hogs

One of the primary uses of top is to identify processes that are consuming excessive CPU or memory resources. By observing the %CPU and %MEM columns, you can quickly pinpoint processes that may be causing performance issues.

Example:

If you suspect a specific application is causing high CPU utilization, you can use top to confirm this suspicion. Once top is running, press s to sort by %CPU and observe the processes at the top of the list. If an application you suspect is listed among the highest CPU users, you can investigate further and potentially take steps to mitigate its resource consumption.

The Precise pidof

The pidof command, which stands for "process ID of," is a simple yet powerful tool for retrieving the process ID (PID) of a running process based on its name. This is particularly useful when you need to target a specific process for further actions like killing or sending signals.

Using pidof

pidof takes the process name as an argument and returns its PID. If multiple processes share the same name, pidof will list the PIDs of all instances.

Example:

To retrieve the PID of the firefox process:

pidof firefox

Output:

1639 1640

This indicates that two firefox processes are running with PIDs 1639 and 1640.

Beyond Basic Usage

pidof offers options to modify its behavior:

• -s (single PID): Returns only the first PID found, even if multiple processes share the name.
• -x (exact match): Matches only the exact process name, not partial matches.
• -c (command line): Matches the complete command line, not just the process name.

Example:

To retrieve the PID of a process that's running a specific command, you can use the -c option:

pidof -c "firefox -P profile1"

This would only return the PID of the firefox process that's running with the specific profile "profile1."

The kill Command: Controlling Processes

The kill command provides you with the power to send signals to processes, allowing you to control their behavior. Signals are a mechanism for communicating with running processes and can be used for various purposes, including:

• Terminating a process: Sending the SIGTERM signal gracefully requests the process to shut down.
• Forcefully terminating a process: Sending the SIGKILL signal immediately terminates the process without giving it a chance to clean up.
• Suspending a process: Sending the SIGSTOP signal pauses the process.
• Resuming a process: Sending the SIGCONT signal resumes a suspended process.

kill Syntax

The basic syntax of the kill command is:

kill [signal] [pid]

• signal: The signal to send (e.g., SIGKILL, SIGTERM, SIGSTOP).
• pid: The process ID of the target process.

Examples

• To gracefully terminate a process with PID 1639:

kill SIGTERM 1639

• To forcefully terminate a process with PID 1640:

kill SIGKILL 1640

• To suspend a process with PID 1639:

kill SIGSTOP 1639

• To resume a suspended process with PID 1639:

kill SIGCONT 1639

Monitoring and Debugging with strace

strace is a powerful tool that allows you to trace system calls made by a process. It's invaluable for debugging programs, understanding process behavior, and identifying performance bottlenecks.

Tracing System Calls

strace intercepts and logs every system call made by a process. This provides a detailed view of the process's interaction with the operating system, revealing valuable insights into its actions.

Using strace

The basic syntax of strace is:

strace [options] [command] [arguments]

• options: Options to modify strace's behavior (e.g., -p to trace a specific process, -f to follow forked processes).
• command: The command to execute or the process to trace.
• arguments: Arguments to the command or process.

Example

To trace system calls made by the firefox process with PID 1639:

strace -p 1639

Output:

execve("/usr/bin/firefox", ["firefox"], [/* 63 arguments */]) = 0
brk(0)                                  = 0x55e6d7f11000
mmap(NULL, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED|MAP_LOCKED, -1, 0) = 0x55e6d7f11000
mprotect(0x55e6d7f11000, 4096, PROT_READ|PROT_WRITE|PROT_EXEC) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x55e6d7f10000
mprotect(0x55e6d7f10000, 4096, PROT_READ|PROT_WRITE) = 0
arch_prctl(ARCH_SET_FS, 0x55e6d7f10780) = 0
...

The output logs each system call made by the process, including the call name, arguments, and return value.

The htop Tool: An Enhanced top

htop is a popular alternative to top, offering a user-friendly and feature-rich interface. It provides an enhanced view of system processes and resources, making it a preferred choice for many users.

Key Features of htop

• Interactive Interface: htop provides a comprehensive view of system processes and resource usage with interactive navigation and search capabilities.
• Real-time Updates: The display is continuously updated, allowing you to monitor process activity and system performance in real-time.
• Detailed Process Information: htop provides comprehensive information about each process, including its name, PID, user, CPU and memory usage, priority, state, and more.
• Process Tree View: Displays a tree structure of processes, showing the parent-child relationships between processes.
• Process Management: Enables you to send signals to processes, terminate them, change their priority, and perform other actions.
• Resource Visualization: Provides graphical visualizations of CPU and memory usage, making it easy to identify potential bottlenecks and resource hogs.

Using htop

Once installed, you can launch htop from the command line. The display presents a summary of system resources at the top, followed by a list of running processes. You can navigate the display using the arrow keys, page up/down, and other keyboard shortcuts.

htop Navigation

• Arrow Keys: Move between processes in the list.
• Page Up/Down: Scroll up and down the process list.
• F1 (Help): Displays a help screen with available commands.
• F2 (Filter): Allows you to filter processes based on name or other criteria.
• F5 (Tree): Toggles between the process list and the process tree view.
• F6 (Sort): Sorts the process list by a specific column.
• F8 (Kill): Sends a signal to a process.
• F9 (Rename): Renames a process.
• F10 (Exit): Exits htop.

Monitoring Processes with pgrep and pkill

pgrep and pkill are command-line utilities that provide efficient ways to find and manipulate processes based on name patterns.

Finding Processes with pgrep

pgrep retrieves the PIDs of processes matching a specified pattern. It offers a concise and flexible way to find processes without listing them all explicitly.

pgrep [options] pattern

• options: Options to modify pgrep's behavior, such as -f (full pattern matching), -x (exact pattern matching), and -u (match by user).
• pattern: The pattern to match against process names.

Example:

To find the PIDs of all processes named "firefox" or "chrome":

pgrep firefox|chrome

To find the PIDs of all processes that have "firefox" in their command line:

pgrep -f firefox

Killing Processes with pkill

pkill sends a signal to processes matching a specified pattern. It's a convenient way to kill processes without knowing their PIDs.

pkill [options] [signal] pattern

• options: Options to modify pkill's behavior, including -f (full pattern matching), -x (exact pattern matching), and -u (match by user).
• signal: The signal to send to the processes. If not specified, SIGTERM is used by default.
• pattern: The pattern to match against process names.

Example:

To gracefully terminate all processes named "firefox":

pkill firefox

To forcefully terminate all processes that have "firefox" in their command line:

pkill -f firefox

Conclusion

Understanding and managing running processes is an indispensable skill for Linux users. We've explored the power of commands like ps, top, pidof, kill, strace, htop, pgrep, and pkill, which provide a robust toolbox for monitoring, manipulating, and debugging processes on your Linux system. By mastering these command-line tools, you gain control over your system's resources and gain a deeper understanding of how Linux operates.

FAQs

1. How do I find the process that's consuming the most CPU time?

You can use the top command and sort the process list by %CPU to identify the processes with the highest CPU usage.

2. How do I terminate a process that's frozen or unresponsive?

You can use the kill command with the SIGKILL signal to forcefully terminate the process. However, this will not allow the process to clean up properly, and any unsaved data may be lost.

3. How do I monitor the memory usage of a specific process?

You can use the top command and filter the process list by the process name or PID to view its memory usage.

4. What is the difference between ps and top?

ps provides a static snapshot of running processes, while top provides a dynamic and real-time view of processes and system resources.

5. How can I find out more about a specific process?

You can use the ps command with the -f option or the top command to display detailed information about a process, including its PID, user, command line, and resource usage.