Linux Process Management: ps, top, htop, pgrep, jobs, bg, fg, nohup, nice and renice

By Ravindra Bagale, trainer · LinkedIn · Last updated: 25 October 2026

1. An everyday example: a busy wada kitchen

Why do we need this?

In a Sadashiv Peth wada during Ganpati, the kitchen runs many tasks at once: rice on one stove, modak steaming, a pressure cooker, and someone chopping. Aaji keeps a token on each pot with a number and the cook's name. Some tasks wait for the cooker whistle. The modak can keep steaming while the cook steps out. When guests arrive, Aaji says 'rice first, sweets can wait'.

What is it?

Each pot = a process. Token number = PID. Cook's name = user. Who started it = parent (PPID). Waiting for the whistle = sleeping state. Steaming while the cook is out = a background job with nohup. 'Rice first' = nice/renice priority. Aaji watching everything = top.

How to do it (step by step)

2. ps aux: every process, BSD style

Why do we need this?

When a server is slow or an app is 'stuck', the first question is: what is running, as whom, and using how much?

What is it?

ps aux shows all processes with USER, PID, %CPU, %MEM, VSZ, RSS (real memory, KB), TTY, STAT, START, TIME and COMMAND. STAT letters: R running, S sleeping, D uninterruptible (disk), T stopped, Z zombie; + foreground, s session leader, < high priority, N low priority.

How to do it (step by step)

1. All processes, first lines.

ps aux | head -3

Output:

USER  PID %CPU %MEM    VSZ   RSS TTY STAT START TIME COMMAND
root    1  0.0  0.1 171820 13200 ?   Ss   09:01 0:02 /usr/lib/systemd/systemd
root    2  0.0  0.0      0     0 ?   S    09:01 0:00 [kthreadd]

What it means: PID 1 is systemd; [brackets] are kernel threads.

2. Top memory users.

ps aux --sort=-rss | head -4

Output:

USER   PID %CPU %MEM ... RSS ... COMMAND
mysql 1420  3.1 24.0 ... 1960000 ... /usr/sbin/mysqld
ravi  8812 40.2 12.5 ... 1020000 ... python train.py

What it means: mysqld uses about 1.9 GB.

3. Find one program.

ps aux | grep [n]ginx

Output:

root   980 0.0 0.0 ... nginx: master process
nginx  981 0.0 0.1 ... nginx: worker process

What it means: [n] stops grep matching itself.

3. ps -ef and ps -o: parents and custom columns

Why do we need this?

To know who started a process, or to print only the columns a script needs.

What is it?

ps -ef shows UID, PID, PPID, C, STIME, TTY, TIME, CMD. ps -o pid,ppid,user,stat,%cpu,%mem,etime,cmd picks columns. -p PID for one process, -u USER for a user, -C NAME by command name, --forest for a tree, --no-headers for scripts.

How to do it (step by step)

1. See the parent.

ps -ef | grep [g]unicorn

Output:

app  2201     1  0 09:05 ?  00:00:03 gunicorn master
app  2210  2201  1 09:05 ?  00:00:40 gunicorn worker

What it means: Workers' PPID is the master.

2. Custom columns for one PID.

ps -o pid,ppid,user,stat,etime,cmd -p 2201

Output:

  PID  PPID USER STAT     ELAPSED CMD
 2201     1 app  Ss    3-02:11:09 gunicorn master

What it means: Running for 3 days 2 hours.

3. Processes of one user.

ps -u postgres -o pid,%cpu,cmd --sort=-%cpu | head -3

Output:

  PID %CPU CMD
 3310 22.0 postgres: app shop 10.0.1.5 SELECT
 1500  0.3 postgres: checkpointer

What it means: One query is busy.

4. By name for scripts.

ps -C sshd -o pid= | wc -l

Output:

3

What it means: No header, easy to count.

4. pstree: the family tree

Why do we need this?

A tree shows which service owns which workers and helps find what spawned a strange process.

What is it?

pstree shows processes as a tree from systemd. -p adds PIDs, -u shows user changes, -a shows arguments. pstree -p PID shows one branch. pstree -s PID shows the parents up to PID 1.

How to do it (step by step)

1. One service branch.

pstree -p 980

Output:

nginx(980)─┬─nginx(981)
           └─nginx(982)

What it means: Master with two workers.

2. Who started this?

pstree -s -p 8812

Output:

systemd(1)───sshd(800)───sshd(8700)───bash(8701)───python(8812)

What it means: Started from an SSH session.

3. Show users too.

pstree -u | head -3

Output:

systemd─┬─NetworkManager───2*[{NetworkManager}]
        ├─chronyd(chrony)
        ├─mysqld(mysql)───38*[{mysqld}]

What it means: (name) shows a user change; {} are threads.

5. pgrep and pidof: find PIDs by name

Why do we need this?

Scripts need the PID to send signals or check if something runs, without parsing ps output.

What is it?

pgrep NAME prints matching PIDs. -l adds names, -a full command, -u USER filters, -f matches the full command line, -x exact name, -c counts, -n newest, -o oldest. pidof PROGRAM prints PIDs of an exact program name. Exit code 1 means none found.

How to do it (step by step)

1. PIDs with names.

pgrep -l nginx

Output:

980 nginx
981 nginx

What it means: Quick and clean.

2. Match the full command line.

pgrep -af 'python.*train'

Output:

8812 python train.py --epochs 50

What it means: -f looks at arguments too.

3. Count a user's processes.

pgrep -c -u deploy

Output:

27

What it means: Simple monitoring.

4. pidof for an exact binary.

pidof sshd

Output:

8700 800

What it means: Used in many init scripts.

5. Use the exit code.

pgrep -x redis-server >/dev/null || echo 'redis is down'

Output:

redis is down

What it means: Good for health checks.

6. top: live view

Why do we need this?

To see what is using CPU and memory right now, and how loaded the system is.

What is it?

The header shows uptime, users, load average (1, 5, 15 min), task states, CPU (us user, sy system, wa IO wait, st steal), and memory. Keys: P sort by CPU, M by memory, 1 per-CPU, c full command, u user filter, k kill, r renice, q quit. top -b -n 1 prints once for scripts.

How to do it (step by step)

1. The header.

top -b -n 1 | head -5

Output:

top - 11:20:01 up 3 days,  2 users,  load average: 3.92, 2.10, 1.05
Tasks: 212 total,   3 running, 209 sleeping,   0 stopped,   0 zombie
%Cpu(s): 88.0 us,  6.0 sy,  0.0 ni,  5.0 id,  0.5 wa,  0.0 hi,  0.5 si,  0.0 st
MiB Mem :   7820.0 total,    410.2 free,   5200.1 used,   2209.7 buff/cache
MiB Swap:   2048.0 total,   2048.0 free,      0.0 used.   2310.5 avail Mem

What it means: 4 CPUs at load 3.9: nearly full, CPU bound.

2. Top 3 by CPU in batch mode.

top -b -n 1 -o %CPU | sed -n '8,10p'

Output:

8812 ravi  20 0 2.1g 1.0g  9m R 380.0 12.5 python
1420 mysql 20 0 3.0g 1.9g 20m S  12.0 24.0 mysqld
 980 root  20 0  12m  4m  3m S   0.3  0.1 nginx

What it means: 380% = nearly 4 cores.

3. Watch one user.

top -u postgres

Output:

(interactive view)

What it means: Press q to quit.

7. htop: friendlier top

Why do we need this?

Colours, bars per CPU, mouse, tree view and easy kill make quick triage faster.

What is it?

Install with dnf/apt install htop. F2 setup, F3 search, F4 filter, F5 tree, F6 sort, F7/F8 nice down/up, F9 kill, F10 quit, Space tags. htop -u USER, htop -p PID1,PID2.

How to do it (step by step)

1. Install and run.

sudo dnf install -y htop && htop

Output:

(full-screen view with CPU bars)

What it means: Green = user, red = kernel time.

2. Only some PIDs.

htop -p 980,981,982

Output:

(only nginx processes)

What it means: Focus on one service.

3. Tree view.

htop  # then press F5

Output:

(processes shown as a tree)

What it means: Like pstree, but live.

8. & and jobs: run in the background

Why do we need this?

Long tasks (a backup, a download) should not block your terminal.

What is it?

CMD & starts it in the background and prints [job] PID. jobs lists jobs of this shell (-l adds PIDs). $! is the PID of the last background job. wait waits for background jobs. Jobs belong to the shell: they get SIGHUP when you log out.

How to do it (step by step)

1. Start a backup in the background.

tar czf /tmp/etc.tgz /etc 2>/dev/null &

Output:

[1] 9120

What it means: Job 1, PID 9120. The prompt is free.

2. List jobs.

jobs -l

Output:

[1]+  9120 Running    tar czf /tmp/etc.tgz /etc 2> /dev/null &

What it means: + is the current job.

3. Run two and wait.

sleep 3 & sleep 5 & wait; echo all done

Output:

[1] 9201
[2] 9202
all done

What it means: wait blocks until both finish.

4. Save the PID.

./server.sh & echo $! > server.pid; cat server.pid

Output:

9310

What it means: Use it later to stop it.

9. Ctrl+Z, bg and fg: pause and move jobs

Why do we need this?

You started a long command in the foreground and need the prompt back without killing it.

What is it?

Ctrl+Z stops (pauses) the foreground job (SIGTSTP). bg resumes it in the background. fg brings it to the foreground. Use %N for job N: fg %2, bg %1. A stopped job does not run until bg or fg.

How to do it (step by step)

1. Pause a running copy.

rsync -a /data/ /backup/   # press Ctrl+Z

Output:

^Z
[1]+  Stopped    rsync -a /data/ /backup/

What it means: It is paused, not dead.

2. Continue in the background.

bg %1

Output:

[1]+ rsync -a /data/ /backup/ &

What it means: Now running behind the prompt.

3. Bring it back.

fg %1

Output:

rsync -a /data/ /backup/

What it means: Now you can press Ctrl+C if needed.

10. nohup and disown: survive logout

Why do we need this?

If SSH drops, background jobs get SIGHUP and die. A 3-hour import must survive.

What is it?

nohup CMD & ignores SIGHUP and writes output to nohup.out (redirect it yourself). disown -h %1 tells the shell not to send SIGHUP to an already-running job. For long or important work prefer tmux/screen or a systemd service (systemd-run).

How to do it (step by step)

1. Start an import that survives logout.

nohup ./import.sh > import.log 2>&1 &

Output:

[1] 9400

What it means: Safe to close the terminal.

2. Save a job you forgot to nohup.

jobs; disown -h %1

Output:

[1]+ Running  ./reindex.sh &

What it means: It will not get SIGHUP now.

3. Better: a transient systemd unit.

sudo systemd-run --unit=reindex /usr/local/bin/reindex.sh && systemctl status reindex --no-pager | head -3

Output:

Running as unit: reindex.service
● reindex.service - /usr/local/bin/reindex.sh
     Active: active (running)

What it means: Logs go to journalctl -u reindex.

11. nice: start with a lower or higher priority

Why do we need this?

A backup or a compile should not slow down the web app on the same server.

What is it?

Nice values go from -20 (most CPU priority) to 19 (least). Default is 0. nice -n 10 CMD starts lower. Only root can set negative values. Shows as NI in top and ps -o ni. For disk priority use ionice -c3.

How to do it (step by step)

1. Run a backup gently.

nice -n 19 tar czf /backup/www.tgz /srv/www &

Output:

[1] 9500

What it means: It uses CPU only when others do not need it.

2. Check the value.

ps -o pid,ni,cmd -p 9500

Output:

  PID  NI CMD
 9500  19 tar czf /backup/www.tgz /srv/www

What it means: NI is 19.

3. Normal user cannot go negative.

nice -n -5 ./job.sh

Output:

nice: cannot set niceness: Permission denied

What it means: Needs sudo.

4. CPU and disk both gentle.

nice -n 15 ionice -c3 rsync -a /data/ /backup/

Output:

(no output)

What it means: ionice class 3 = idle IO.

12. renice: change priority of a running process

Why do we need this?

A report job is already eating CPU and users complain. Lower it without stopping it.

What is it?

renice -n 10 -p PID changes one process. -u USER changes all of a user's processes. -g PGID a process group. Normal users can only increase (make nicer) their own processes; root can do anything.

How to do it (step by step)

1. Lower a busy job.

renice -n 15 -p 8812

Output:

8812 (process ID) old priority 0, new priority 15

What it means: The web app gets CPU first now.

2. Raise a critical one.

sudo renice -n -5 -p 1420

Output:

1420 (process ID) old priority 0, new priority -5

What it means: Only root can do this.

3. All jobs of a user.

sudo renice -n 10 -u batch

Output:

1003 (user ID) old priority 0, new priority 10

What it means: Every process of batch.

13. /proc/PID: look inside a process

Why do we need this?

When tools are missing (containers) or you need exact details: command line, environment, limits, open files, memory.

What is it?

Each process has a folder /proc/PID: cmdline (arguments, NUL-separated), status (state, memory, threads), environ, cwd and exe (links), fd/ (open files), limits, io. /proc/loadavg, /proc/meminfo and /proc/cpuinfo show system-wide numbers.

How to do it (step by step)

1. Full command line.

tr '\0' ' ' < /proc/2201/cmdline; echo

Output:

/usr/bin/python3 /srv/app/venv/bin/gunicorn -w 4 app:server

What it means: Exact arguments used.

2. State and memory.

grep -E 'State|VmRSS|Threads' /proc/2201/status

Output:

State:	S (sleeping)
VmRSS:	  182340 kB
Threads:	5

What it means: About 178 MB of real memory.

3. Where is it running from?

sudo ls -l /proc/2201/cwd /proc/2201/exe

Output:

/proc/2201/cwd -> /srv/app
/proc/2201/exe -> /usr/bin/python3.11

What it means: Folder and binary.

4. How many open files?

sudo ls /proc/2201/fd | wc -l; grep 'open files' /proc/2201/limits

Output:

812
Max open files            1024                 1024                 files

What it means: Close to the limit: risk of 'Too many open files'.

14. lsof: open files, ports and deleted files

Why do we need this?

'Port already in use', 'disk full but du shows less', 'cannot unmount: busy': lsof finds the process behind it.

What is it?

lsof -p PID lists one process's files. lsof -i :PORT shows who uses a port. lsof -u USER by user. lsof +D DIR files open under a folder. lsof +L1 finds deleted but still open files (space not freed). -n -P skip DNS and port names (faster). ss -ltnp and fuser are alternatives.

How to do it (step by step)

1. Who holds port 8080?

sudo lsof -nP -i :8080

Output:

COMMAND  PID USER FD TYPE DEVICE NODE NAME
java    7710 app  45u IPv6  9921  TCP *:8080 (LISTEN)

What it means: An old java is still running.

2. Deleted files still using disk.

sudo lsof -nP +L1 | head -3

Output:

COMMAND  PID USER FD TYPE SIZE/OFF NLINK NAME
java    7710 app   3w REG  9.8G       0 /var/log/app.log (deleted)

What it means: 9.8 GB is freed only when java restarts or the fd is truncated.

3. Why cannot I unmount?

sudo lsof +D /mnt/usb | head -2

Output:

COMMAND PID USER FD TYPE NAME
bash   9020 ravi cwd DIR  /mnt/usb

What it means: A shell is inside the folder.

4. Same with fuser.

sudo fuser -vm /mnt/usb

Output:

USER PID ACCESS COMMAND
/mnt/usb: ravi 9020 ..c.. bash

What it means: c = current directory.

15. Real examples from many industries

Why do we need this?

The same Linux skill shows up in every kind of company. Seeing it in many places helps you remember it.

What is it?

Each row is a made-up team. It shows who uses this and how.

How to do it (step by step)

16. Common errors and how to fix them

Why do we need this?

Everyone hits these errors. Knowing the cause saves hours.

What is it?

Read the exact message first. Then match it to a row below.

How to do it (step by step)

17. Troubleshooting step by step

Why do we need this?

For a slow server: measure load, find the top process, see what it waits for, then act (renice, restart, or fix).

What is it?

Go top to bottom. Stop at the first step that shows the problem.

How to do it (step by step)

1. How loaded is it, and how many CPUs?

uptime; nproc

2. Top CPU and memory users.

ps aux --sort=-%cpu | head -5

3. Any D-state or zombies?

ps -eo pid,stat,cmd | awk '$2 ~ /^(D|Z)/'

4. Is it IO wait?

top -b -n 1 | sed -n 3p

5. What files and ports does it hold?

sudo lsof -p PID | head

6. Lower its priority or restart its service.

sudo renice -n 15 -p PID

18. Lab 1: Find and tame a CPU hog

Why do we need this?

Start a CPU-heavy job, find it three ways, lower its priority, then stop it.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

1. Start a fake hog.

yes > /dev/null & echo $!

Output:

[1] 9601
9601

2. Find it with ps.

ps -o pid,ni,%cpu,cmd -p 9601

Output:

  PID  NI %CPU CMD
 9601   0 99.5 yes

3. Find it with pgrep and top.

pgrep -l yes; top -b -n 1 -o %CPU | sed -n 8p

Output:

9601 yes
9601 ravi 20 0 8m 1m 1m R 99.7 0.0 yes

4. Lower its priority.

renice -n 19 -p 9601 && ps -o ni= -p 9601

Output:

9601 (process ID) old priority 0, new priority 19
 19

5. Stop it.

kill %1; jobs

Output:

[1]+  Terminated   yes > /dev/null

19. Lab 2: Jobs, logout survival and lsof

Why do we need this?

Move a job between foreground and background, keep one alive after logout, and find a deleted file holding space.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

1. Start in foreground and pause.

sleep 300   # press Ctrl+Z

Output:

^Z
[1]+  Stopped    sleep 300

2. Background, then foreground.

bg %1; jobs; fg %1   # then Ctrl+C

Output:

[1]+ sleep 300 &
[1]+  Running    sleep 300 &

3. Survive logout.

nohup sleep 600 > /dev/null 2>&1 & echo $!

Output:

9705

4. Hold a deleted file open.

python3 -c 'import time;f=open("/tmp/big","w");f.write("x"*50000000);f.flush();time.sleep(600)' & sleep 1; rm /tmp/big

Output:

[2] 9710

5. Find it and clean up.

sudo lsof -nP +L1 | grep /tmp/big; kill 9710 9705

Output:

python3 9710 ravi 3w REG 50000000 0 /tmp/big (deleted)

20. Frequently asked questions

21. Interview questions and answers

Beginner level

Mid level level

Senior level

22. Related chapters

• Linux Ops Refresh for DevOps
• Bash Scripting for Automation
• Linux grep and find Commands with Examples
• How to Set Up Passwordless SSH Between Linux Servers

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.