Processes and System Monitoring

Welcome back.

In the previous lesson, you learned how to install software from the terminal.

Now we need to answer an important question:

What is actually running on this machine?

Because your computer may look calm.

But inside, there are processes, services, background tasks, browser tabs, and one mysterious thing using 40% CPU for no reason.

Today we investigate.

What You’ll Learn

In this lesson, you’ll learn how to:

• understand what a process is;
• list running processes with ps;
• monitor the system with top;
• use htop;
• check memory with free;
• check system uptime with uptime;
• stop processes with kill;
• avoid killing the wrong thing.

The Mission

Your mission is simple:

Learn how to see what is running, understand what uses system resources, and stop a process when it behaves badly.

The terminal becomes your control room.

Very serious.

Almost NASA, but with more coffee.

What Is a Process?

A process is a running program.

When you open a browser, it creates processes.

When you open a terminal, it creates a process.

When Linux runs background services, those are processes too.

A process has an ID called a PID.

PID means:

Process ID

Think of it as the process number.

Like a name tag, but less friendly.

Show Your Current Shell Process

Run:

echo $$

This shows the PID of your current shell.

You may see something like:

24891

That number is the process ID of your current terminal shell.

Not very poetic.

Very useful.

List Processes with ps

To show processes connected to your current terminal, use:

ps

You may see something like:

PID TTY          TIME CMD
24891 pts/0    00:00:00 zsh
24930 pts/0    00:00:00 ps

This shows:

• PID — process ID;
• TTY — terminal;
• TIME — CPU time used;
• CMD — command name.

To see more processes, use:

ps aux

This shows many running processes.

Maybe too many.

Do not panic.

Linux is just showing you the backstage.

Search for a Process

You can combine ps with grep.

For example, to search for firefox:

ps aux | grep firefox

Or for node:

ps aux | grep node

The | symbol is called a pipe.

It sends output from one command into another command.

Very powerful.

A little magical.

We will use pipes more in future lessons.

Monitor with top

Run:

top

top shows live system activity.

You can see:

• running processes;
• CPU usage;
• memory usage;
• process IDs;
• command names.

To quit top, press:

q

Again, q.

The terminal world really loves that key.

Monitor with htop

If you installed htop in the previous lesson, run:

htop

htop is easier to read than top.

It shows:

• CPU bars;
• memory usage;
• running processes;
• search and filter options;
• process tree.

To quit:

q

If htop is not installed, install it.

Arch Linux

sudo pacman -S htop

Ubuntu or Debian

sudo apt install htop

Fedora

sudo dnf install htop

Check Memory Usage

To check memory, use:

free -h

The -h means human-readable.

Because numbers like 8283475968 are not friendly.

You may see:

total        used        free      shared  buff/cache   available
Mem:          15Gi       4.2Gi       6.1Gi       500Mi       5.2Gi        10Gi
Swap:        4.0Gi          0B       4.0Gi

Important columns:

• total — total memory;
• used — used memory;
• free — completely free memory;
• available — memory available for new programs.

Usually, available is more useful than free.

Linux uses memory for cache because it is smart.

It is not wasting memory.

It is preparing snacks for future work.

Check System Uptime

To see how long your system has been running, use:

uptime

You may see something like:

15:42:18 up 3 hours, 2 users, load average: 0.42, 0.36, 0.30

This shows:

• current time;
• how long the system has been running;
• number of users;
• load average.

Load average shows how busy the system has been.

Do not worry too much about it now.

Just know: very high numbers can mean your system is under pressure.

Like a waiter during Sunday lunch in Italy.

Stop a Process with kill

Sometimes a process freezes.

Sometimes a program refuses to close.

Sometimes software becomes dramatic.

First, find its PID.

For example:

ps aux | grep sleep

Let’s create a harmless test process:

sleep 300

This command waits for 300 seconds.

Open another terminal and search for it:

ps aux | grep sleep

Find the PID, then stop it:

kill PID_NUMBER

Example:

kill 24999

Replace 24999 with the real PID.

Force Stop a Process

If normal kill does not work, you may see people use:

kill -9 PID_NUMBER

-9 is stronger.

It forces the process to stop.

Use it carefully.

kill -9 is not a polite conversation.

It is the terminal equivalent of removing the chair while the process is still sitting.

Kill by Name

Some systems have pkill.

Example:

pkill firefox

This kills processes by name.

Be careful.

If you run:

pkill node

you may stop all Node.js processes.

That could include your development server.

Your website disappears.

You become confused.

The terminal says nothing.

Classic.

Common Mistakes

Killing the wrong PID

Always check before killing:

ps aux | grep process-name

Read carefully.

Do not randomly kill processes like a cowboy in a data center.

Using sudo too quickly

If you cannot kill a process, you may try:

sudo kill PID_NUMBER

But before using sudo, ask yourself:

Do I understand what this process is?

If the answer is no, slow down.

Linux rewards patience.

It punishes heroic guessing.

Confusing memory usage

Linux may show low free memory.

That does not always mean a problem.

Check:

free -h

Look at available.

Linux uses memory for caching because unused memory is wasted memory.

Very philosophical.

Very efficient.

Practice

Try this:

ps
ps aux
top
free -h
uptime

Then install and run htop if needed:

htop

Then answer:

1. What is a process?
2. What is a PID?
3. Which command shows live processes?
4. Which command shows memory usage?
5. What does kill do?

Mini Challenge

Create a test process:

sleep 300

Then, in another terminal:

1. Find it with ps aux | grep sleep.
2. Find its PID.
3. Stop it with kill.
4. Confirm it is gone.

Do not use kill -9 unless normal kill does not work.

Today we are professionals.

Not terminal pirates.

Summary

Today you learned:

• a process is a running program;
• every process has a PID;
• ps shows processes;
• ps aux shows many system processes;
• top shows live system activity;
• htop is a friendlier system monitor;
• free -h shows memory usage;
• uptime shows how long the system has been running;
• kill stops processes;
• kill -9 forces a process to stop and should be used carefully.

Now you can see what is happening inside your system.

This is a big step.

You are no longer just using Linux.

You are watching it breathe.

Slightly creepy.

Very useful.

Next Lesson

In the next lesson, we’ll learn networking commands like ping, curl, ip, and ss.

Because computers are not islands.

They talk to other computers.

Sometimes too much.