Processes and System Monitoring

When a Linux server misbehaves — high CPU, memory exhaustion, a hung service — you need to know exactly what's running and how to intervene. These monitoring and process management skills are core to any cloud or systems administration role.

What is a Process?

Every program running on Linux is a process. Each process has:

• A unique PID (Process ID)
• A PPID (Parent Process ID) — the process that spawned it
• An owner (the user who started it)
• CPU and memory usage
• A state: running, sleeping, stopped, zombie

The first process started at boot is PID 1 — on modern systems this is systemd.

Viewing Processes

ps — snapshot of running processes

ps aux               # all processes, BSD format
ps -ef               # all processes, UNIX format
ps aux | grep nginx  # find nginx processes
ps -p 1234           # details for a specific PID

Key columns in ps aux: USER, PID, %CPU, %MEM, VSZ (virtual memory), RSS (resident memory), STAT (state), COMMAND.

top — live updating view

top             # live process list (q to quit)
top -u alice    # show only alice's processes

In top: press P to sort by CPU, M by memory, k to kill a process.

htop — improved interactive view

sudo apt install htop   # install on Ubuntu/Debian
htop                    # colourful, mouse-friendly view

pgrep / pstree

pgrep nginx         # print PIDs of nginx processes
pstree              # visual tree of process hierarchy

Killing Processes

Signals are messages sent to processes:

kill 1234           # send SIGTERM to PID 1234
kill -9 1234        # send SIGKILL (force kill)
kill -HUP 1234      # send SIGHUP (reload)
killall nginx       # send SIGTERM to all nginx processes
pkill -f "python app.py"  # kill by matching command name

Background and Foreground Jobs

long-running-command &    # run in background
jobs                       # list background jobs
fg %1                      # bring job 1 to foreground
bg %1                      # resume stopped job in background
Ctrl+Z                     # suspend foreground process
nohup command &            # run immune to terminal close

Managing Services with systemctl

On modern Linux (Ubuntu 16.04+, RHEL 7+), systemd manages services:

systemctl status nginx         # show service status
systemctl start nginx          # start service
systemctl stop nginx           # stop service
systemctl restart nginx        # restart service
systemctl reload nginx         # reload config without restart
systemctl enable nginx         # start on boot
systemctl disable nginx        # don't start on boot
systemctl list-units --type=service  # list all services
journalctl -u nginx            # view service logs
journalctl -f                  # follow system journal

System Resource Monitoring

free -h            # memory usage (human-readable)
df -h              # disk space usage
du -sh /var/log    # disk usage of a specific directory
uptime             # system uptime and load average
lscpu              # CPU details
lsmem              # memory details
vmstat 1 5         # virtual memory stats every 1s, 5 times
iostat             # disk I/O statistics
netstat -tulnp     # listening network ports
ss -tulnp          # modern replacement for netstat

In the next lesson, you'll learn how to install and manage software using Linux package managers.