Viewing Processes
ps — Snapshot
# All processes with full details
ps aux
# Tree view showing parent-child relationships
ps auxf
# Filter by name
ps aux | grep nginx
htop — Interactive
htop
Key shortcuts in htop:
| Key | Action |
|---|---|
F5 |
Tree view |
F6 |
Sort by column |
F9 |
Send signal (kill) |
F4 |
Filter by name |
u |
Filter by user |
M |
Sort by memory |
P |
Sort by CPU |
Process States
| State | Code | Meaning |
|---|---|---|
| Running | R | Actively executing on CPU |
| Sleeping | S | Waiting for I/O or event |
| Disk Sleep | D | Uninterruptible I/O wait |
| Stopped | T | Suspended (Ctrl+Z) |
| Zombie | Z | Terminated but parent hasn't read exit status |
Warning
Dstate processes can't be killed — they're waiting for disk I/O. If you see many of these, your disk subsystem may be overloaded.
Signals
# Graceful shutdown (SIGTERM)
kill 1234
kill -15 1234
# Force kill (SIGKILL) — use as last resort
kill -9 1234
# Reload config (SIGHUP)
kill -HUP 1234
# Kill all processes by name
killall nginx
pkill -f "node server.js"
Background Jobs
# Run in background
long-command &
# Suspend foreground process
# Press Ctrl+Z
# Resume in background
bg
# Resume in foreground
fg
# List background jobs
jobs
# Keep running after logout
nohup long-command &
# Or better:
nohup long-command > /var/log/output.log 2>&1 &
Resource Limits with ulimit
# Check current limits
ulimit -a
# Increase open file limit for current session
ulimit -n 65536
# Permanent change in /etc/security/limits.conf
deploy soft nofile 65536
deploy hard nofile 65536
Finding Resource Hogs
# Top 10 by CPU
ps aux --sort=-%cpu | head -11
# Top 10 by memory
ps aux --sort=-%mem | head -11
# Total memory by process name
ps -eo rss,comm | awk '{arr[$2]+=$1} END {for (i in arr) print arr[i]/1024, "MB", i}' | sort -rn | head -10