Useful linux commands: part 2: Process related commands

1. PS

Process status (PS) gives information about processes running in memory. If you want a repetitive update of this status, use top. The options mostly used with ps are given below.

-e    select all processes

-f    does full listing

-a    select all with a tty except session leaders

-d    select all, but omit session leaders

a      select all processes on terminal,including those of other users

x     select processes without controlling ttys
For a full list of ps options, click here.

Here are some examples of ps:

  • Display all processes

# ps -ef

  • Display process by user

# ps -f -u sagar

  • Show process by name or process id

# ps -C apache2

# ps -f -p 3255,9218,7542

  • Search process by partial name

# ps -ef | grep apache

  • Sort process by cpu or memory usage

# ps aux –sort=-pcpu,+pmem

(+ = ascending order, – = descending order)

  • Display process hierarchy in a tree style

# ps -f –forest -C apache2

  • Display child processes of a parent process

# ps -o pid,uname,comm -C apache2

2359  root      apache2
4524  www-data apache2
4525  www-data apache2
4526  www-data apache2
4527  www-data apache2
4528  www-data apache2

  • Display threads of a process

# ps -p 3150 -L

  • Change the columns to display

# ps -e -o pid,uname,pcpu,pmem,comm

It is possible to rename the column labels

# ps -e -o pid,uname=USERNAME,pcpu=CPU_USAGE,pmem,comm

  • Display elapsed time of processes

# ps -e -o pid,comm,etime

  • Turn ps into an realtime process viewer

# watch -n 1 ‘ps -e -o pid,uname,cmd,pmem,pcpu –sort=-pmem,-pcpu | head -15’


Kill a process by specifying its PID, either via a signal or forced termination.

# kill [-s sigspec] [-n signum] [-sigspec] jobspec or pid

# kill -l [exit_status]

# kill -l [sigspec]

-l   List the signal names

-s   Send a specific signal

-n   Send a specific signal number

Send a signal specified by sigspec or signum to the process named by job specification jobspec or process ID pid.

sigspec is either a case-insensitive signal name such as SIGINT (with or without the SIG prefix) or a signal number; signum is a signal number.

If sigspec is not present, SIGTERM is used (Terminate).

If any arguments are supplied when `-l’ is given, the names of the signals corresponding to the arguments are listed, and the return status is zero. exit_status is a number specifying a signal number or the exit status of a process terminated by a signal.

The return status is true if at least one signal was successfully sent, or false if an error occurs or an invalid option is encountered.

Common Kill Signals
Signal name Signal value Effect
SIGHUP 1 Hangup
SIGINT 2 Interrupt from keyboard
SIGKILL 9 Kill signal
SIGTERM 15 Termination signal – allow an orderly shutdown
SIGSTOP 17,19,23 Stop the process

Here are some examples of kill:

  • List the running process: # ps

PID TTY TIME CMD 1293 pts/5 00:00:00 MyProgram

  • Then Kill it: # kill 1293

[2]+ Terminated MyProgram

  • To run a command and then kill it after 5 seconds:

# my_command & sleep 5
# kill -0 $! && kill $!

kill is a bash built in command: # help kill

3. TOP

Top command displays processor activity of your system and also displays tasks managed by kernel in real-time. It’ll show processor and memory being used. Use top command with ‘u‘ option this will display specific User process details as shown below.

# top -u sagar

# top

Press ‘O‘ (uppercase letter) to sort as per desired by you. Press ‘q‘ to quit from top screen.

Press (Shift+O) to Sort field via field letter, for example press ‘a‘ letter to sort process with PID (Process ID).

Press ‘z‘ option in running top command will display running process in color which may help you to identified running process easily.

Press ‘c‘ option in running top command, it will display absolute path of running process.

By default screen refresh interval is 3.0 seconds, same can be change pressing ‘d‘ option in running top command and change it as desired as shown below.

You can kill a process after finding PID of process by pressing ‘k‘ option in running top command without exiting from top window as shown below.

You can use ‘r‘ option to change the priority of the process also called Renice.

Press (Shift+W) to save the running top command results under /root/.toprc.

Press ‘h‘ option to obtain the top command help

Top output keep refreshing until you press ‘q‘. With below command top command will automatically exit after 10 number of repetition.

# top -n 10


Free command shows free, total and swap memory information in bytes.

# free

Free with -t options shows total memory used and available to use in bytes.

# free -t


Service command calls script located at /etc/init.d/ directory and executes the script. There are two ways to start any service.

# service httpd start


# /etc/init.d/httpd start

We can also stop or restart the service accordingly.


kill processes by name.

# killall [option(s)] [–] name …

-g    –process-group           Kill the process group to which the process belongs. The kill signal is only sent once per group, even if multiple processes belonging to the same process group were found.

-l     List all known signal names.

–list name    The command/process to be killed

-r, –regexp       Interpret process name pattern as an extended regular expression.

-s signal, –signal signal           Send signal instead of the default SIGTERM.  e.g. -9 = SIGKILL

-u user    –user user           Kill only those processes the specified user owns. Command names are optional.


Kill firefox: # killall -9 mozilla-bin


Interactive Process viewer, find the CPU-intensive programs currently running. You might need to install htop since it doesn’t come in the linux distribution.

# htop

HTOP has many instructions available on its console output. Here is the link for it’s man page for further details. It is similar to TOP, but better in the sense it provides more functionality and ease of use.


It is used to identify processes using files or sockets and optionally kill the process that are accessing the file.

#fuser [-a|-s|-c] [-4|-6] [-n space ] [-k [-i] [-signal ] ] [-muvf] name

  • To view processes using a directory

# fuser –v

  • To view if a process is using your tcp or udp socket

# fuser -v -n tcp 80

  • To kill a process

# fuser -k 123/tcp

  • To kill a process with confirmation

# fuser -i -k 123/tcp

  • Display all processes accessing filesystem on which ‘example.txt’ resides.

# fuser -v -m example.txt

  • You can send a specific signal to a process. To view a complete list of signals available in fuser.

# fuser –l

There are many more options available in fuser. It is one of the most popular tool to troubleshoot and manage processes. Here is the link to it’s man page.


Kill processes by a full or partial name.

pgrep searches the process table on the running system and prints the process IDs of all processes that match the criteria given on the command line.

pkill searches the process table on the running system and signals all processes that match the criteria given on the command line.

All the criteria have to match.


# pgrep -u root sshd

will only list the processes called sshd and owned by root.

# pgrep -u root,daemon

will list the processes owned by root OR daemon.

  • Find the process ID of the named daemon

# pgrep -u root named

  • Make syslog reread its configuration file

# pkill -HUP syslogd

  • Give detailed information on all xterm processes

# ps -fp $(pgrep -d, -x xterm)


Pgrep man page is here and pkill man page is here

10. PMAP

This command is used to show the memory map of a process.

  • To get the pid

# ps aux | grep <process_name>

Then run

# pmap -x <pid>

  • Display process map in extended format

# pmap -x 3401

3401: man pmap
Address Kbytes RSS Anon Locked Mode Mapping
00110000 1272 – – – r-x–
0024e000 4 – – – —–
0024f000 8 – – – r—-

b785e000 8 – – – rw— [ anon ]
bf7eb000 84 – – – rw— [ stack ]
——– ——- ——- ——- ——-
total kB 2192 – – –

  • Display in Device Format

# pmap -d 18282



One thought on “Useful linux commands: part 2: Process related commands

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s