Create, monitor and kill processes
Start course

This course will focus on the Linux command line and the text-manipulation tools that let you effectively control just about anything on your system. We'll learn about terminal environments, working with text streams, file management and archives, system processes, advanced text searches, and terminal text editors.

The previous course covered installation package management, while "Filesystems and Partitions" is up next. 

Here's the complete first set of Linux certification courses.

If you have thoughts or suggestions for this course, please contact Cloud Academy at


While working with multiple processes from a command line interface might not be quite as intuitive as it is with graphic desktops which give you all kinds of visual indicators telling you what's happening and where moving between programs is as simple as clicking on a window. Linux provides server admins with a very rich set of tools nonetheless. In this video, we're going to explore how you can manage and keep track of the processes running on your machine.

Killing off misbehaving Linux system processes

First of all you will sometimes need to know exactly what is currently active. The quickest way to do that is by using ps. Ps displays useful information about a different live process on each line, indicating the user who started the process, who is often root, the process ID or PID, the percentage of CPU resources and memory this process is currently using and skipping over to the final column at the right, the command use to launch the process. On most systems and especially systems running graphic desktops, the number processes returned by ps will run in the hundreds. You will therefore often want to narrow down your search using grep. You can also get PIDs for individual processes using pgrep. This example will search for a process called SSHD that was launched by the user root.

Free will show you how much system memory you're currently using and how much is still free. Free-h will display that in more human readable terms. And uptime will tell you how long it's been since the last time you booted the system. One company I worked for took great pride in having uptime on some servers return well over a year.

If you're experiencing system slowdowns or other trouble, you can easily check which processes are selfishly grabbing most of the resources by running top. Top until you exit by pressing the Q key will display a regularly updated list of the processes using the most resources. The percentage of CPU and memory columns are the ones that the most interesting for us. Once you spot the culprit and decide you're going to have teach it a lesson it soon won't forget, you should note its PID or command name because that's what you'll use to shut it down. This is something that unfortunately I have to deal with almost daily. While Linux software is generally highly reliable there's one video production package in particular that while offering fantastic features and quality will often freeze on me. Shutting it down using the close button or other normal approaches just won't work so I have no choice but to kill its process from the command line. When a process, well let's call it my app, does freeze I have two choices, killall followed by the name of the process which is usually the same as the command you see listed in top or ps would do the job nicely, while just kill and the PID that was displayed in top will also work.

The kill command, by the way, can also be accompanied by a signal code. Here are the most common signal codes. Number one, or SIGHUP which stands for Signal Hangup signals to a process that its parent shell is closing. Number two, or SIGINT interrupt is the equivalent of a Ctrl-c that interrupts a process. Ckill -9 will force the process to shut down while SIGTERM15 will immediately terminate a process. Running kill with no signal code will default to 15. Pkill works much the same as killall with the important difference that it will guess what you meant with misspelled processes thus if rather than pkill SSHD we were to run SSH, pkill would kill SSHD and in the process of course shutdown our SSH session so be extra careful with pkill.

There is chance by the way that you will kill the process but its GUI window will still appear on your desktop. This is called a zombie process. Unlike real life zombies, these won't do you any harm and will disappear when you reboot.

To review ps will list all live processes. Pgrep allows you to narrow the listing down by user and process name. Free shows how much memory you're using. Top displays those processes using the most resources. Killall or pkill will shut down a process by name and kill will shut it down based on PID.

Using screen for multi-screen terminal sessions

Believe it or not you can actually have multiple working windows each with its own running processes within a single terminal. Screen is a rather complicated program that creates an entirely keyboard based environment for managing these multiple windows or more accurately screens. The LPIC exam expects you to be at least familiar with the basics of Screen so I'll give you a short walkthrough. First of all if it isn't already, you need to install Screen using App Get. To launch a new screen, type screen. After the initial information pages your terminal will look the way it normal does. Ctrl-a w will display a window bar at the bottom with your current shell. You should be aware that for some reason Screen documentation uses uppercase C-a rather than Ctrl-a to describe their escape key combination.

You can detach from your current session using Ctrl-a and d. This will dump you back in your normal Linux parent shell. Part of the challenge of using Screen is keeping track of where you are and indeed, whether you're inside or outside Screen. To list the currently running screen sessions from outside Screen type screen-ls. To get back into your screen type screen-x. Once inside you can create a new window using Ctrl-a c and split your screen horizontally using Ctrl a S. You can jump between screens using Ctrl-a tab. Ctrl-a/ will exit a screen and its programs.

That should be enough to get you started with Screen. Let's quickly review Screen commands. Screen run from a regular shell will open a new screen. Screen-ls will list all current screens and screen-x will attach you to a live screen. From inside a Screen shell Ctrl-a c will create a new screen. Ctrl-a S will split your screen horizontally. Ctrl-a d will detach you from a screen. Ctrl-a tab will move between screens and Ctrl-a/ will exit a screen and all its programs.

Controlling running Linux processes

Until now besides our detour into Screen we've discussed identifying and if necessary killing processes. Now we'll talk about directly managing ongoing processes that we don't want to kill. By default, every job you start will take complete control of the shell from which it was launched. As we'll see in a minute, it can be useful to see both its job number and its PID at startup. To do that add the & character to the command. I've created a very large file called Big File that I'll now copy the big file to, something that will take some time. Therefore we'll run it with the &. This will run the copy operation in the background. But besides learning the PID issued by the Linux kernel, we're also told that this is job ID one within this shell. Since everything is happening in the background, we've got control of our command line prompt. Should we want to bring the job back to the foreground, we would use fg, standing for foreground, and the job ID. Should we now want to send the job back to the background, we hit Ctrl-z and then bg and then the job ID. Let's delete the file we just created. A good Linux admin always cleans up his messes, right?

Now let's run this again in the background. To see what's going on we can use the jobs command to display all background processes and their status. We can also use ps by itself to display all processes running in this particular shell. Unlike psaux which displays all processes running on the whole system.

Finally we can run a command with nohup that's no hang up in front of it to ensure that even if I should close this particular shell the process will survive until it's complete. Just to review these last points adding an & character after a command will force the process to run in the background. Fg and the job ID will bring it back to the foreground. Ctrl-z and then bg along with the job ID will send it back to the background again. Jobs and ps will both display current shell processes. And adding nohup to a command will ensure that it completes regardless of what might happen to the shell itself.

About the Author
Learning Paths

David taught high school for twenty years, worked as a Linux system administrator for five years, and has been writing since he could hold a crayon between his fingers. His childhood bedroom wall has since been repainted.

Having worked directly with all kinds of technology, David derives great pleasure from completing projects that draw on as many tools from his toolkit as possible.

Besides being a Linux system administrator with a strong focus on virtualization and security tools, David writes technical documentation and user guides, and creates technology training videos.

His favorite technology tool is the one that should be just about ready for release tomorrow. Or Thursday.

Covered Topics