5.8 Processes

By Ravindra Bagale Last updated: 27 September 2026

A process is a running program. Each has a PID (process ID).

Command	Purpose
`ps aux`	All processes with user, CPU, memory
`ps aux \| grep nginx`	Find a specific process
`pgrep -a node`	PIDs and command lines matching a name
`top`	Live view (press `q` to quit, `M` sort by memory, `P` by CPU)
`kill PID`	Politely ask process to stop (SIGTERM, 15)
`kill -9 PID`	Force kill (SIGKILL) — last resort
`pkill -f app.py`	Kill by name/pattern
`command &`	Run in background
`jobs`, `fg`, `bg`	Manage background jobs of the current shell
`nohup command &`	Keep running after you log out
`uptime`	Load average and how long the system has run
`free -h`	RAM and swap usage

ps aux --sort=-%cpu | head -5         # top CPU users
ps -ef --forest | less                # parent-child tree
sudo lsof -i :22                      # which process owns port 22?

Why this matters for security

Crypto-miners and reverse shells show up as strange processes: high CPU, odd names, running from /tmp, or a shell whose parent is the web server user. ps -ef --forest and lsof -i are standard first-response commands.

Ravindra Bagale's Tip

Process atakla ki khup students laghech kill -9 vaprtat. Aadhi sadha kill PID (SIGTERM) dya – process la cleanup karayla vel milto. -9 fakt shevatcha upay. Database var kill -9 kela tar data bighdu shakto.

Practice task

Start sleep 600 &, find it with pgrep -a sleep, view it in top, and stop it with kill. Then list the five processes using the most memory.