Understanding Processes in Linux

When we run a program in Linux, the system creates something called a process. Processes are at the core of how Linux executes multiple tasks simultaneously, whether they are graphical applications, terminal commands, or services running in the background. Understanding processes helps us know what is happening in the system, detect problematic programs, and later manage those processes. This chapter explains the concept of processes, their identity, states, and how to view running processes using ps, top, htop, pstree, as well as the System Monitor graphical application.

28.1 What Is a Process?

A process is an executing program. A program is merely a passive file stored on disk, but when executed, it is loaded into memory and becomes an active process. A single program can run in multiple processes at the same time. For example, when we open two terminal windows, each window is a different process even though both run the same program.

Each process has its own memory space, access permissions, and resources that are isolated from other processes. This isolation ensures that a single malfunctioning application does not immediately affect the entire system.

28.2 PID (Process ID) and PPID (Parent PID)

Every process is assigned a unique identification number called a PID (Process ID). The kernel uses the PID to track and manage each process. PID numbers are assigned sequentially when a new process starts, and will wrap around from small values after reaching the maximum limit defined by the kernel (/proc/sys/kernel/pid_max).

In addition to the PID, every process also has a PPID (Parent Process ID), which is the PID of the parent process that spawned it. Most processes have a parent, except for the very first process executed when the system boots. That first process has a PID of 1 and is executed by the init system, namely systemd on Ubuntu 26.04 LTS and Fedora Workstation 44.

This parent-child relationship forms a process tree structure. When we open a terminal and run a command, the terminal process becomes the parent of that command process.

All process information displayed by ps, top, and similar utilities is actually retrieved directly from the /proc virtual filesystem discussed in Chapter 12. Each running process has its own subdirectory in /proc/<PID>, for example /proc/1 for the systemd process, containing files like status, cmdline, and environ that describe the state of that process.

28.3 Process States

At any given time, a process resides in one of the following states.

Most processes spend their time in the sleeping state while waiting for input, network activity, or other events. A zombie process is a process that has completed execution, but its data entry has not been removed by its parent, usually within a short timeframe. If a large number of zombie processes persist for a long time, it typically indicates that the parent process is not handling child processes properly, and how to resolve this will be discussed in the next chapter.

28.4 Foreground vs Background Process

Processes can run in two modes: foreground and background.

• Foreground process runs in the front and controls the terminal, preventing us from typing other commands until that process finishes or is terminated.
• Background process runs behind the scenes without controlling the terminal, allowing us to continue with other work.

How to run processes in the background and manage them will be discussed further in the next chapter.

28.5 Viewing Running Processes

Linux provides several commands to view running processes.

28.5.1 ps: Process Snapshot

The ps command (process status) displays a snapshot of processes at a specific point in time. Run without options, ps displays only the processes running in our terminal. To view all processes on the system, use the following options.

ps aux

ps -ef

Both commands display all processes along with information such as PID, user, CPU and memory usage, as well as the command that started the process. The difference lies in the display style; ps aux uses BSD style, while ps -ef uses System V style. The most frequently observed columns in the output of ps aux are as follows.

To search for a specific process among hundreds of running processes, we usually pipe the output of ps to grep.

ps aux | grep firefox

Note that the grep command itself will also appear in the search results because it is part of the processes running at the moment the command is executed. Experienced sysadmins usually filter out that line by adding grep -v grep, for example ps aux | grep firefox | grep -v grep, to ensure the displayed list is completely clean.

28.5.2 top: Real-Time Process Monitor

The top command displays processes dynamically and updates them periodically.

top

In the top display, processes are sorted by CPU usage by default. Press q to exit. This command is useful for monitoring resource-intensive processes in real time.

28.5.3 htop: Interactive Process Monitor

htop is a more feature-rich and interactive version of top, presenting information in color and supporting navigation using arrow keys and mouse. htop is usually not installed by default, so we need to install it first.

sudo apt install htop

sudo dnf install htop

Once installed, run it with:

htop

Unlike top, htop provides a set of function keys at the bottom of the screen to interact directly with the process list.

28.5.4 pstree: Viewing the Process Tree Structure

As mentioned earlier, the parent-child relationships between processes form a tree structure. The pstree command displays this structure visually, allowing us to see which process spawned another, starting from systemd (PID 1) down to the most recently executed process.

pstree

Add the -p option to display PIDs alongside each process name.

pstree -p

pstree is very useful when we want to identify the parent process of an unresponsive application, for instance to ensure we terminate the correct process without killing a parent process that is still needed. This command is available by default on Ubuntu 26.04 LTS and Fedora Workstation 44 as part of the psmisc package.

28.5.5 System Monitor (GUI) in GNOME

If we prefer a graphical interface, GNOME provides the System Monitor application. This application displays a list of processes, CPU, memory, and network usage in graphical format, and allows us to terminate processes directly from the interface without typing commands. We can open it via application search by typing "System Monitor", or through the terminal using the command gnome-system-monitor.

Understanding processes is the foundation for managing a Linux system effectively. We now know about PID, PPID, parent-child relationships along with their connection to /proc, various process states, and how to monitor them using ps, top, htop, pstree, and System Monitor. In the next chapter, we will learn how to control processes, ranging from sending signals and terminating hung processes to running tasks in the background.