Processes & Services — Linux Command Line | Sabaoon Academy

Every program running on a Linux system is a process. Understanding how to view, manage, and control processes is a critical skill for any developer or system administrator.

What Is a Process?

A process is a running instance of a program. When you run a command like ls, the system creates a process, executes the program, and then the process terminates. Long-running programs like web servers create processes that stay alive until explicitly stopped.

Every process has:

A unique PID (Process ID)
A parent process (PPID) that started it
An owner (the user who ran it)
A state (running, sleeping, stopped, zombie)

Viewing Processes

# Show your running processes
ps

# Show all processes with details
ps aux

# Show processes in a tree structure
ps auxf
# Or use pstree
pstree

The columns in ps aux output:

Column	Meaning
`USER`	Process owner
`PID`	Process ID
`%CPU`	CPU usage percentage
`%MEM`	Memory usage percentage
`VSZ`	Virtual memory size (KB)
`RSS`	Resident memory size (KB)
`STAT`	Process state
`START`	Start time
`COMMAND`	The command that started the process

Process states:

State	Meaning
`R`	Running
`S`	Sleeping (waiting for input)
`D`	Uninterruptible sleep (waiting for I/O)
`T`	Stopped
`Z`	Zombie (finished but not cleaned up)

Filtering Processes

# Find a specific process by name
ps aux | grep nginx

# A better alternative — pgrep
pgrep -a nginx

# Find the PID of a process
pidof nginx

# Count how many instances are running
pgrep -c node

Real-Time Monitoring with top and htop

The top command shows a live, updating view of system processes:

top

Inside top:

Key	Action
`q`	Quit
`M`	Sort by memory usage
`P`	Sort by CPU usage
`k`	Kill a process (enter PID)
`1`	Toggle individual CPU cores

For a more user-friendly experience, install htop:

sudo apt install htop
htop

htop provides color-coded output, mouse support, and easier process management.

Killing Processes

When a process is misbehaving or stuck, you need to terminate it:

# Send a polite termination signal (SIGTERM)
kill 12345

# Force kill (SIGKILL) — use when SIGTERM does not work
kill -9 12345

# Kill a process by name
killall nginx

# Kill processes matching a pattern
pkill -f "node server.js"

Common signals:

Signal	Number	Effect
`SIGTERM`	15	Graceful shutdown (default)
`SIGKILL`	9	Forced termination (cannot be caught)
`SIGHUP`	1	Reload configuration
`SIGSTOP`	19	Pause the process
`SIGCONT`	18	Resume a paused process

Always try SIGTERM first. It allows the process to clean up resources. Use SIGKILL only as a last resort.

Background and Foreground Jobs

You can run processes in the background so they do not block your terminal:

# Run a command in the background
long-task &

# List background jobs
jobs

# Bring a background job to the foreground
fg %1

# Send a running process to the background
# First press Ctrl+Z to suspend it, then:
bg %1

The nohup command lets a process continue running even after you close the terminal:

# Run a process that survives terminal close
nohup python3 server.py &

# Output goes to nohup.out by default
# Redirect to a specific log file
nohup python3 server.py > server.log 2>&1 &

System Resource Monitoring

# Show memory usage
free -h

# Show disk I/O statistics
iostat

# Show network connections
ss -tuln

# Show system uptime and load averages
uptime

# Show detailed system information
uname -a

# Show CPU information
lscpu

# Show disk usage
df -h

The load average numbers from uptime show system load over 1, 5, and 15 minutes. A load average equal to the number of CPU cores means the system is fully utilized.

Systemd and Services

Modern Linux distributions use systemd to manage services (background programs that start at boot, like web servers, databases, and SSH).

# Check the status of a service
sudo systemctl status nginx

# Start a service
sudo systemctl start nginx

# Stop a service
sudo systemctl stop nginx

# Restart a service
sudo systemctl restart nginx

# Reload configuration without full restart
sudo systemctl reload nginx

# Enable a service to start at boot
sudo systemctl enable nginx

# Disable a service from starting at boot
sudo systemctl disable nginx

Viewing Service Logs with journalctl

Systemd logs everything through journalctl:

# View logs for a specific service
sudo journalctl -u nginx

# Follow logs in real time
sudo journalctl -u nginx -f

# Show logs from the last hour
sudo journalctl -u nginx --since "1 hour ago"

# Show logs from today
sudo journalctl -u nginx --since today

# Show only error-level messages
sudo journalctl -u nginx -p err

# Show kernel messages
sudo journalctl -k

Scheduling Tasks with cron

Cron lets you schedule commands to run automatically at specific times:

# Edit your crontab
crontab -e

# List your scheduled tasks
crontab -l

Cron syntax:

┌───────────── minute (0-59)
│ ┌───────────── hour (0-23)
│ │ ┌───────────── day of month (1-31)
│ │ │ ┌───────────── month (1-12)
│ │ │ │ ┌───────────── day of week (0-7, 0 and 7 = Sunday)
│ │ │ │ │
* * * * * command

Examples:

# Run a backup every day at 2:00 AM
0 2 * * * /home/sabaoon/backup.sh

# Run a script every 15 minutes
*/15 * * * * /home/sabaoon/check-health.sh

# Run on Monday at 9:00 AM
0 9 * * 1 /home/sabaoon/weekly-report.sh

# Run on the first day of every month
0 0 1 * * /home/sabaoon/monthly-cleanup.sh

Practical Example: Monitoring a Node.js App

Here is a workflow for managing a Node.js application:

# Start the app in the background
nohup node app.js > app.log 2>&1 &

# Check if it is running
pgrep -a node

# Monitor the log
tail -f app.log

# Check resource usage
ps aux | grep node

# If it is consuming too much memory, restart it
pkill -f "node app.js"
nohup node app.js > app.log 2>&1 &

Summary

You can now view and manage processes, use signals to control them, run tasks in the background, monitor system resources, manage systemd services, and schedule automated tasks with cron. In the next lesson, you will learn shell scripting to automate these workflows.