How to Use ps, top, and kill - Linux Process Management Tutorial
When working with Linux, you'll inevitably encounter situations like these:
- A command that won't respond
- CPU usage suddenly spiking
- Not knowing which processes are running
This article aims to help you make informed decisions about process management, not just memorize commands.
Conclusion First: The Decision Pattern
When you have process trouble, check in this order:
- See what's currently running
- Check the load and status
- Only if necessary, stop it gently
Not immediately running kill is the key to preventing accidents.
What Is a Process (Minimum Knowledge)
Conclusion: A process is a running program with a new PID each run; confirm PID before kill.
A process is a running instance of a program. Even the same command is treated as a different process each time it runs.
Key Points to Remember
- Each process is assigned a PID (Process ID)
- PIDs change with each execution
Not understanding that "PIDs change" can lead to incorrect operations.
ps: Get the Big Picture First
Conclusion: ps aux shows PID, CPU, and COMMAND — always see the full picture before you act.
Basic Form
$ ps aux
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.1 169084 1208 ? Ss 10:00 0:01 /sbin/init user 2345 80.2 5.1 512000 42000 ? R 10:15 2:34 python app.py
What to Look At
- PID: The number you'll use for operations
- %CPU / %MEM: Load indicators
- COMMAND: What's running
top: See What's Heavy in Real-Time
Conclusion: Use top to see load average and CPU usage live; always identify the cause first.
Running It
$ top
Common Items to Watch
- load average at the top
- %CPU in the process list
Decision Examples
- High load average → CPU is congested
- Specific process with high %CPU → Likely culprit
Exit top with the q key.
Common Mistake #1: Killing at 100% CPU
Conclusion: Avoid kill -9 at 100% CPU — it skips cleanup and risks data loss. Observe first.
Common Misconception
$ kill -9 2345
This operation can:
- Skip cleanup procedures
- Cause data corruption or inconsistency
High CPU is often temporary processing, so first observing is an important decision.
kill: Understanding Safe Termination
Conclusion: Send SIGTERM with kill PID first; use kill -9 only when the process ignores it.
Basic (Gentle Stop)
$ kill 2345
This sends SIGTERM. Think of it as "asking" the process to terminate.
Force Termination (Last Resort)
$ kill -9 2345
- Use only when nothing else works
- Don't make it a habit
Common Mistake #2: Killing the Wrong Process
Conclusion: grep shows itself; check COMMAND before you kill — never rely on PID alone.
Pattern That Requires Caution
$ ps aux | grep python $ kill 1234
- grep itself appears in the output
- Misreading the PID
Countermeasures
- Always check COMMAND
- Don't decide by PID alone
When Processes Keep Multiplying
Conclusion: When processes keep growing, check cron, auto-start, and parent first.
Points to Check
- Is it auto-starting?
- Is it scheduled (cron, etc.)?
- What's the parent process?
Instead of immediately stopping processes, thinking about why they're multiplying prevents recurrence.
Practice: Safe Check-and-Stop Procedure
Conclusion: ps, then top, then kill: follow this order to observe, decide, and act safely.
Recommended Steps
$ ps aux # 1. Get big picture $ top # 2. Check load $ kill 2345 # 3. Stop gently
What This Order Prevents
- Mistaken operations
- Unnecessary force terminations
Why This Procedure Is Safe
- It follows: observe situation → decide → act
- Prevents mixing up PIDs
- Makes it harder to accidentally kill temporary loads
In process management, "not rushing" leads to safety.
Next Reading
Conclusion: Next: process management practical and LPIC-1 hub to practice ps, top, and kill.
- Process Management Practical - Job control, pkill, nice
- Essential Linux Commands
- Permissions Basics