Processes and system information

What a process is

Each process has a PID and consumes CPU, memory, and file descriptors. Every process also has a parent (PPID): your shell starts ls, and systemd (PID 1) is the ancestor of everything.

flowchart LR
  P["Process PID 4321<br/>ps, top"] --> T["SIGTERM 15<br/>kill 4321"]
  T -- "exits cleanly" --> OK["Stopped<br/>files closed"]
  T -- "ignores it" --> K["SIGKILL 9<br/>kill -9 4321"]
  K --> GONE["Killed<br/>no cleanup"]
  P -. "SIGHUP" .-> R["Reload config<br/>many daemons"]
  %% step P: Find the process and its PID with ps aux, pgrep or top.
  %% step T: Ask politely first: SIGTERM lets the program save state and exit.
  %% step OK: Most programs stop cleanly within a few seconds.
  %% step K: Only if it hangs, SIGKILL ends it immediately.
  %% step GONE: SIGKILL cannot be caught, so temporary files and locks may be left behind.
  %% step R: Many daemons treat SIGHUP as "reload your configuration".

Watch processes

ps -ef takes a snapshot; top refreshes interactively. ps aux --sort=-%mem | head lists the biggest memory users first. pgrep nginx is often more precise than ps ... | grep nginx, because that pipeline may also show the grep process itself.

The STAT column shows state: R running, S sleeping, D waiting on disk I/O, Z zombie (finished but not yet collected by its parent), and T stopped.

Signals

kill 1234 sends SIGTERM (15) by default, allowing an application to flush and clean up. kill -9 1234 sends SIGKILL, making the kernel stop it immediately; use it when graceful termination fails, not as the first step. pkill nginx signals processes by name.

Jobs

A command launched with & participates in shell job control; fg returns a job to the foreground. Ctrl+Z pauses the current job, bg resumes it in the background, and jobs lists them. Do not confuse a shell job ID with a system PID. nohup cmd & keeps a command running after you log out.

System information

Read load average against nproc: a load of 4 is busy on two cores but comfortable on eight. In free, low "free" memory is normal because Linux uses spare RAM for cache; watch "available" instead.