Red Hat System Administration I · RH124

Chapter 15

Monitoring and Managing Linux Processes

ps & top · Job control · Signals & kill · Priority & nice

CIS126RH — Mesa Community College

Chapter Objective

View running processes, control jobs in the shell, send signals to processes, and adjust process scheduling priority.

Key Commands

ps
top
jobs
fg
bg
kill
killall
nice
renice

What Is a Process?

Every running program on Linux is a process, identified by a unique PID (process ID). Processes form a tree: every process (except the very first) has a parent process that started it, identified by its PPID.

Term	Meaning
PID	Process ID — a unique number identifying a running process
PPID	Parent Process ID — the PID of the process that started this one
Foreground process	Runs attached to the terminal; the shell waits for it to finish
Background process	Runs without holding the terminal, letting you continue working

Why It Matters — When something is misbehaving — consuming too much CPU, hung, or unresponsive — process management tools are how you identify exactly what's running, how it's behaving, and how to intervene.

Viewing Processes with ps

# Show processes running in your current terminal
ps

# Show every process on the system, in a readable full-screen format
ps aux

# Show processes in a hierarchy (tree), revealing parent/child relationships
ps -ef --forest

# Filter for a specific process by name
ps aux | grep sshd

Tip — ps Is a Snapshot — ps shows a single moment in time. If you need to watch behavior change live, that's exactly what top is for.

Reading ps aux Output

ps aux Column	Meaning
USER	Owner of the process
PID	Process ID
%CPU / %MEM	Current CPU and memory usage
STAT	Process state (e.g. `R` running, `S` sleeping, `Z` zombie)
COMMAND	The command that launched the process

Monitoring Live with top

# Launch the interactive live process monitor
top

Key (inside top)	Action
`P`	Sort by CPU usage (default)
`M`	Sort by memory usage
`k`	Kill a process by PID, prompted interactively
`r`	Renice (change priority of) a process
`q`	Quit top

Note — The load average shown at the top of the display reflects system demand over the last 1, 5, and 15 minutes — a rising trend across all three often signals a developing problem worth investigating before it gets worse.

Job Control

The shell can run multiple jobs — commands you started from that shell session — simultaneously, moving them between the foreground and background.

# Start a command in the background immediately
sleep 300 &

# Suspend the current foreground job (pause it, don't kill it)
# Press Ctrl+Z

# List jobs running in this shell session
jobs

# Resume the most recent job in the background
bg

# Bring the most recent job back to the foreground
fg

# Bring a specific job (by job number) to the foreground
fg %2

Tip — Ctrl+Z Suspends, It Doesn't Stop — Pressing Ctrl+Z pauses a job without terminating it. It's easy to forget a suspended job is still sitting there consuming memory — check jobs before closing the terminal.

Signals and kill

Despite the name, kill sends any signal to a process — not necessarily a termination request. The process decides how to respond, unless the signal type forces the issue.

Signal	Number	Effect
`SIGHUP`	1	Hang up — often used to make a daemon reload its configuration
`SIGINT`	2	Interrupt — what `Ctrl+C` sends
`SIGKILL`	9	Force-terminate immediately; cannot be caught or ignored
`SIGTERM`	15	Politely ask a process to terminate; the default signal `kill` sends
`SIGSTOP`	19	Suspend the process; cannot be caught or ignored

Sending Signals

# Politely ask a process to terminate (SIGTERM, the default)
kill 4821

# Force-kill a process that isn't responding to SIGTERM
kill -9 4821
kill -SIGKILL 4821

# Kill every process matching a name
killall firefox

# List all signal names and numbers
kill -l

Warning — Try SIGTERM Before SIGKILL — SIGKILL gives a process no chance to clean up open files or save state before dying, which can lead to corrupted data. Reach for plain kill (SIGTERM) first, and only escalate to -9 if the process truly won't respond.

Process Priority: nice and renice

Every process has a niceness value from -20 (highest scheduling priority) to 19 (lowest), influencing how much CPU time the scheduler gives it relative to other processes.

# Start a command with a lower priority (higher niceness = friendlier to others)
nice -n 10 ./long-running-script.sh

# Change the priority of an already-running process
renice 5 -p 4821

# Only root can set a NEGATIVE niceness (higher priority than default)
sudo renice -5 -p 4821

Exam Note — Remember the counterintuitive direction: a lower niceness number means higher priority. A process with niceness -20 is the least "nice" to its neighbors — it hogs the CPU. A process at 19 is the most accommodating.

Key Terms for Chapter 15

process: A running instance of a program, identified by a unique PID
PID / PPID: Process ID and Parent Process ID, identifying a process and the process that started it
foreground / background job: A shell job holding the terminal versus one running without blocking it
signal: A notification sent to a process, such as a request to terminate, reload, or pause
SIGTERM: The default, polite termination signal sent by kill
SIGKILL: A forceful termination signal that cannot be caught, ignored, or handled gracefully
niceness: A value from -20 to 19 controlling a process's scheduling priority
top: Interactive tool for monitoring live process activity and resource usage

Review Questions

What is the difference between a process's PID and its PPID?
You press Ctrl+Z on a running command. What happens to it, and how would you resume it in the background?
What signal does plain kill send by default, and why should you generally try it before kill -9?
What does killall firefox do differently from kill with a single PID?
What niceness value represents the HIGHEST scheduling priority, and who is allowed to set a process to it?
Write a command that starts backup.sh with a niceness of 15, so it doesn't compete heavily for CPU.
Inside top, what key sorts processes by memory usage instead of CPU usage?

1 / 12