5.8 Processes
A process is a running program. Each has a PID (process ID).
| Command | Purpose |
|---|---|
ps aux |
All processes with user, CPU, memory |
ps aux | grep nginx |
Find a specific process |
pgrep -a node |
PIDs and command lines matching a name |
top |
Live view (press q to quit, M sort by memory, P by CPU) |
kill PID |
Politely ask process to stop (SIGTERM, 15) |
kill -9 PID |
Force kill (SIGKILL) — last resort |
pkill -f app.py |
Kill by name/pattern |
command & |
Run in background |
jobs, fg, bg |
Manage background jobs of the current shell |
nohup command & |
Keep running after you log out |
uptime |
Load average and how long the system has run |
free -h |
RAM and swap usage |
ps aux --sort=-%cpu | head -5 # top CPU users
ps -ef --forest | less # parent-child tree
sudo lsof -i :22 # which process owns port 22?
Why this matters for security
Crypto-miners and reverse shells show up as strange processes: high CPU, odd names, running from /tmp, or a shell whose parent is the web server user. ps -ef --forest and lsof -i are standard first-response commands.
Ravindra Bagale's Tip
When a process hangs, many students immediately use kill -9. First send a plain kill PID (SIGTERM) – it gives the process time to clean up. -9 is only the last resort. Running kill -9 on a database can corrupt data.
Ravindra Bagale's Tip – मराठी
Process अडकला की बरेच students लगेच kill -9 वापरतात. आधी साधा kill PID (SIGTERM) द्या – process ला cleanup करायला वेळ मिळतो. -9 फक्त शेवटचा उपाय. Database वर kill -9 केलं तर data बिघडू शकतो.
Ravindra Bagale's Tip – हिंदी
Process अटकने पर बहुत से students तुरंत kill -9 इस्तेमाल करते हैं. पहले सादा kill PID (SIGTERM) दो – process को cleanup करने का समय मिलता है. -9 सिर्फ़ आख़िरी उपाय है. Database पर kill -9 करने से data बिगड़ सकता है.
Practice task
Start sleep 600 &, find it with pgrep -a sleep, view it in top, and stop it with kill. Then list the five processes using the most memory.