How to Use ps, top, and kill - Linux Process Management Tutorial

How to Use ps, top, and kill - Linux Process Management Tutorial
Reading time: About 10 min Difficulty: Beginner

What you'll be able to do

  • Check running processes with ps aux and top
  • Choose between kill and kill -9 to stop a process safely
  • Avoid stopping the wrong process by mixing up PIDs

Prerequisites (read these first)

When working with Linux, you will run into situations like these.

  • A command that will not respond.
  • CPU usage suddenly spiking.
  • Not knowing which processes are running.

This article aims to help you make informed decisions about process management, not just memorize commands.

Key term: A process is one running program. Some people say task or job. This article always says process.

Conclusion First: The Decision Pattern

When you have process trouble, check in this order:

  1. See what is running right now.
  2. Check the load and the status.
  3. Only if you must, stop it gently.

Not running kill right away is the key to preventing accidents.

What Is a Process (Minimum Knowledge)

Conclusion: A process is a running program. It gets a new PID each run, so always confirm the PID before you kill it.

A process is a running instance of a program. Even the same command counts as a different process each time it runs.

Key Points to Remember

  • Each process is given a PID (Process ID).
  • PIDs change with each run.

If you miss the fact that PIDs change, you can act on the wrong one.

ps: Get the Big Picture First

Conclusion: ps aux shows the PID, the CPU use, and the COMMAND. Start here every time.

Basic Form

$ ps aux
USER   PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root     1  0.0  0.1 169084  1208 ?        Ss   10:00   0:01 /sbin/init
user  2345 80.2  5.1 512000 42000 ?        R    10:15   2:34 python app.py

What aux means: a also shows processes owned by other users. u prints the user-oriented format with the owner name and the CPU and memory shares. x also shows processes not attached to a terminalAn interactive program that reads the commands you type and runs them.. Together they mean "show everything that runs, in detail". This form takes no hyphen.

What to Look At

  • PID: the number you will use for later commands.
  • %CPU / %MEM: load indicators.
  • COMMAND: what is running.

The ps command only reads state. It never stops or changes a process, so you can run it as often as you like.

top: See What's Heavy in Real-Time

Conclusion: Use top to watch the load average and the CPU use live. Narrow down the cause before you act.

Running It

$ top

Common Items to Watch

  • The load average at the top. It shows how much work is waiting in line.
  • The %CPU column in the process list.

Decision Examples

  • A high load average means the CPU is busy. Compare it with your CPU core count, which nproc prints. Above that number, treat the machine as congested.
  • A process with a high %CPU is the likely culprit.

Exit top with the q key.

Common Mistake #1: Killing at 100% CPU

Conclusion: Do not reach for kill -9 at 100% CPU. It skips cleanup and can lose data, so watch first.

Common Misconception

$ kill -9 2345

This command can do the following.

  • It skips cleanup steps.
  • It causes data loss or corrupt files.

High CPU is often just temporary work, so watching first is the better call.

kill: Understanding Safe Termination

Conclusion: Send the gentle kill PID (SIGTERM) first. Use kill -9 (SIGKILL) only when the process ignores it.

Basic (Gentle Stop)

$ kill 2345

This sends SIGTERM. SIGTERM is a request that says "please exit". The process can save its work and then close.

Force Termination (Last Resort)

$ kill -9 2345
  • Use it only when nothing else works.
  • Do not make it a habit.

What happens if you get it wrong: kill -9 sends SIGKILL. Unlike an app's Quit button, it gives no time for cleanup, so a half-written file can end up broken. If you type the wrong PID, you stop a different process.

How to try this safely: practice only on processes you started yourself. These three steps are safe.

$ sleep 300 &          # 1. start a practice process (& runs it in the background)
[1] 3456               #    the number shown is the PID
$ ps aux | grep sleep  # 2. confirm the COMMAND really is sleep
$ kill 3456            # 3. stop only the process you started

The sleep command just waits for the given number of seconds. Stopping it affects nothing else. The virtual terminal on this site is for learning, so your own machine cannot break.

Common Mistake #2: Killing the Wrong Process

Conclusion: grep lists itself too. Read the COMMAND column before you kill, and never go by the PID alone.

Pattern That Requires Caution

$ ps aux | grep python
$ kill 1234
  • The grep command itself shows up in the output.
  • So it is easy to read the wrong PID.

Countermeasures

  • Always check the COMMAND column.
  • Never decide by the PID alone.

Troubleshooting

Conclusion: Work each symptom as cause, then check, then fix. Do not jump straight to a force kill.

Symptom: the command never returns

Cause: the running process is still working.

Check: open a second terminal and look at its state.

$ ps aux | grep command-name

Fix:

  1. Press Ctrl + C in the window where it runs.
  2. Only if that does nothing, send kill PID from the other terminal.

Symptom: kill does not stop it

Cause: the process cannot receive SIGTERM. Waiting on disk input or output is the usual reason.

Check:

$ ps -p 2345 -o pid,stat,comm

A D in the STAT column means an uninterruptible wait on input or output. In that state even SIGKILL does not stop it.

Fix: the STAT column decides which branch you take.

  1. If STAT is anything but D, such as S or R: wait a few dozen seconds, check again, and only then run kill -9 2345.
  2. If STAT is D: kill -9 will not stop it. Wait for the input or output to finish. If it stays D for several minutes, suspect the disk or the network storage.

When Processes Keep Multiplying

Conclusion: When the count keeps growing, do not just stop them. Check auto-start, cron, and the parent first.

Points to Check

  • Is it starting automatically?
  • Is it on a schedule, such as cron?
  • What is the parent process?

Instead of stopping processes right away, ask why they keep multiplying. That is what prevents a repeat.

Practice: Safe Check-and-Stop Procedure

Conclusion: Follow ps, then top, then kill. That order keeps observe, decide, and act in the right sequence.

$ ps aux          # 1. Get big picture
$ top             # 2. Check load
$ kill 2345       # 3. Stop gently

Note: 2345 is only an example. Do not type it as is. Replace it with the PID that step 1's ps aux showed for the process you want to stop.

What This Order Prevents

  • Mistaken operations.
  • Force terminations you did not need.

Why This Procedure Is Safe

  • It follows observe, then decide, then act.
  • It keeps you from mixing up PIDs.
  • It makes it harder to kill a load that was only temporary.

In process management, not rushing is what keeps you safe.

Completion Checklist

Conclusion: Fill in observe, decide, act, and verify in order. If a stage is blank, go back to it.

Step 1: Observe

  • Checked the PID and the COMMAND of the target with ps aux.
  • Checked %CPU and load average with top.

Step 2: Decide

  • Confirmed the work is not just temporary.
  • Confirmed by COMMAND name that this process is safe to stop.

Step 3: Act

  • Sent kill PID (SIGTERM) first.
  • Used kill -9 PID only after waiting a few dozen seconds.

Step 4: Verify

  • Ran ps aux again and confirmed the process is gone.
  • Confirmed no other process was stopped.

Summary

Conclusion: Four commands cover every case. Learn this table and the decision is easy.

Situation Command Purpose
See the whole ps aux Check the PID and the COMMAND
Check the load top Watch load average and %CPU live
Stop gently kill PID Send SIGTERM so the process can clean up first
Last resort kill -9 PID Force the process to end with SIGKILL

Next Reading

Conclusion: Next, use the practical article and the LPIC-1 hub to practice ps, top, and kill.

Continue Your LPIC-1 Journey

Conclusion: Use the LPIC-1 hub and the linked articles to go deeper on Linux process management.

LPIC-1 Hub

  • LPIC-1 Learning Hub — Full LPIC-1 article map, progress tracking, and exam objective coverage

Practice

Share this article

Next steps

Next article → How to Use pwd, cd, and ls - Linux Basic Commands Tutorial Practice with quiz → Verify your understanding Practice with lesson → Run commands in the terminal