Linux Process Management: Ps, Top, Htop, And Kill Explained

Every guide throughout this series involving troubleshooting eventually comes down to the same basic question: what’s actually running on this server right now, and is something misbehaving. Linux process management tools answer exactly that, and knowing them well turns vague “something feels wrong” moments into quick, confident diagnosis.

Viewing Running Processes with ps

ps provides a snapshot of currently running processes. The most commonly used invocation:

ps aux

This shows every process on the system, including the owning user, CPU and memory usage percentage, and the full command that started each one — useful as a comprehensive one-time snapshot, though it doesn’t update live.

Filtering ps Output

For a specific process you’re looking for:

ps aux | grep nginx

Real-Time Monitoring with top

top provides a continuously updating view of running processes, sorted by resource usage by default:

top

Key interactive commands while top is running:

q – quit
k – kill a process (prompts for PID)
M – sort by memory usage
P – sort by CPU usage (default)

A More Readable Alternative: htop

htop improves considerably on top‘s interface, adding color coding, mouse support, and a more intuitive layout:

sudo apt install htop -y
htop

Unlike top, htop shows per-core CPU usage bars and lets you scroll through the process list and interact with individual processes more directly, including easily killing a selected process with F9 rather than needing to remember its PID.

Understanding Process States

Both ps and top/htop show a process state column, with common values including:

R (Running) – actively executing or ready to run
S (Sleeping) – waiting for an event (very common, not a problem)
D (Uninterruptible sleep) – typically waiting on disk I/O; persistent D-state processes can indicate a storage problem worth investigating
Z (Zombie) – a process that’s finished but whose exit status hasn’t yet been collected by its parent process; occasional zombies are normal, but many persistent zombies can indicate a bug in the parent application

Finding a Process’s PID

Before you can act on a specific process, you often need its Process ID:

pgrep nginx

Or combine with ps for more context:

ps aux | grep nginx

Terminating Processes with kill

Once you have a PID, terminate it:

kill 1234

This sends a standard termination signal (SIGTERM), which well-behaved applications catch and use to shut down gracefully, cleaning up resources and finishing in-progress work before exiting.

Force-Killing an Unresponsive Process

If a process doesn’t respond to a normal kill:

kill -9 1234

The -9 flag sends SIGKILL, an immediate, unconditional termination signal the process cannot catch or ignore. Use this only after a normal kill fails to work, since it doesn’t allow the process any opportunity for graceful cleanup.

Killing Processes by Name

Rather than looking up a PID manually every time:

pkill nginx

This matches and terminates all processes matching the given name pattern — use carefully, since a too-broad pattern could match and terminate more processes than intended.

Checking What’s Using a Specific Port

Combined with the networking concepts covered elsewhere in this series, finding which process is bound to a specific port:

sudo ss -tulpn | grep :80

This shows exactly which process is listening on port 80, useful when troubleshooting why a service won’t start due to a port conflict.

Monitoring Resource Usage Over Time

For understanding trends rather than just a current snapshot, the monitoring tools covered in earlier guides (Netdata, in particular) provide historical process and resource data that ps, top, and htop — being point-in-time or live-only tools — don’t retain once you close them.

A Practical Troubleshooting Workflow

Run htop to get an immediate overview of what’s consuming resources right now
Identify the specific misbehaving process by name or unusually high resource usage
Check its state (running normally, stuck in D-state, zombied)
Attempt a graceful kill first, escalating to kill -9 only if genuinely unresponsive
Check application-specific logs to understand why the process misbehaved in the first place, rather than just treating the symptom

Final Thoughts

Mastering Linux process management with ps, top, htop, and kill turns troubleshooting from guesswork into a quick, confident diagnostic process — exactly the skill underlying much of the practical troubleshooting implied throughout every guide in this series. These tools are simple individually, but together form the foundation of understanding what’s actually happening on any Linux server at any given moment.

Linux Process Management: ps, top, htop, and kill Explained