Processes and resources: ps, top, htop and kill

top: the live view

top refreshes a list of processes every few seconds, busiest first. The flags below are for GNU procps top, the version on every mainstream distribution; guides written for macOS or BSD use different flags. Reference: top(1).

top                   # live view, refresh every 3 seconds
top -d 1              # refresh every second
top -u alice          # only alice's processes
top -p 1234           # only PID 1234 (comma-separate several)
top -o %MEM           # sort by memory from the start
top -b -n 1 | head -20   # one plain-text snapshot, for scripts or pasting

The columns that matter most: %CPU (100 is one full core, so values above 100 are normal on multi-core machines), RES (memory really in use), S (state: R running, S sleeping, D waiting for disk, Z zombie). For something friendlier, install htop or btop.

ps: a snapshot you can filter

ps aux --sort=-%mem | head                 # biggest memory users
ps aux --sort=-%cpu | head                 # biggest CPU users
ps -eo pid,user,%cpu,%mem,etime,comm --sort=-%cpu | head   # pick your own columns
ps -u alice                                # processes of one user
ps -ef --forest                            # who started whom, as a tree
pgrep -a nginx                             # PIDs and command lines by name
pgrep -u alice -a podman                   # by name and user

ps aux (BSD style, no dash) and ps -ef (standard style) both list everything; procps accepts both. etime is how long a process has been running. pgrep saves you the ps aux | grep dance, and it never lists itself. The option list is in ps(1).

A small tree to practise on: a shell that starts two background jobs. The job is a copy of sleep named demo-job, so pgrep and pkill match nothing else on the machine:

$ cp /usr/bin/sleep ./demo-job
$ bash -c './demo-job 300 & ./demo-job 300 & wait' >/dev/null 2>&1 &
$ ps -o pid,ppid,stat,etime,cmd --forest -p $! --ppid $!
    PID    PPID STAT     ELAPSED CMD
3109662 3109661 S          00:00 bash -c ./demo-job 300 & ./demo-job 300 & wait
3109664 3109662 S          00:00  \_ ./demo-job 300
3109665 3109662 S          00:00  \_ ./demo-job 300
$ pgrep -a demo-job
3109664 ./demo-job 300
3109665 ./demo-job 300
$ pkill demo-job; sleep 0.3; pgrep -a demo-job || echo 'no demo-job left'
no demo-job left

Why not pkill -f 'sleep 300'? -f matches the whole command line. In a script or a bash -c '...' line, the shell running it has that same text in its own command line, so pkill can kill the shell that called it. Match on the process name, or check with pgrep -af first.

Stopping processes: kill, pkill, systemctl

kill does not kill; it sends a signal. Which one you send decides whether the program gets to save its work.

kill 1234                    # ask politely
sleep 5; kill -0 1234 && kill -9 1234   # still there after 5 seconds? then force
pgrep -a -u alice rsync      # check what matches first
pkill -u alice rsync         # then stop them by name and user
sudo systemctl stop caddy    # a service: stop it through systemd, not kill

kill -0 sends no signal; it only answers whether the PID still exists. After a SIGTERM the shell reports the exit status as 128 plus the signal number:

$ sleep 300 & p=$!
$ kill -0 $p && echo "$p is running"
3108520 is running
$ kill $p; sleep 0.2; kill -0 $p; echo "exit=$?"
bash: line 1: kill: (3108520) - No such process
exit=1
$ wait $p; echo "sleep ended with $? (128 + 15 = SIGTERM)"
sleep ended with 143 (128 + 15 = SIGTERM)

A process in state D (waiting for disk or a dead network share) ignores even SIGKILL until the I/O returns; fix the share, not the process. Killing a service's main process makes systemd start it again if the unit has Restart=always, which is why systemctl stop is the right tool there.

Load average and priorities

uptime                         # load average: 0.52, 0.61, 0.70
nproc                          # number of CPU cores to compare with
nice -n 10 tar -caf backup.tar.zst /srv/data   # start with a lower priority
renice -n 10 -p 1234           # lower the priority of a running process
ionice -c 3 -p 1234            # disk access only when nothing else needs it

The three load numbers are 1-, 5- and 15-minute averages of processes that want CPU or wait for disk. Below the core count is fine; far above it means work is queueing. Nice values run from -20 (most favoured) to 19 (least); normal users may only make things nicer. For a service, set Nice= and IOSchedulingClass=idle in its unit.

uptime reads its numbers from /proc/loadavg. On this 8-core laptop a load around 2 means about a quarter busy. The fourth field is running and total processes, the fifth the last PID handed out:

$ nproc; cat /proc/loadavg
8
1.96 2.49 2.18 2/3545 3108541

Why services belong in systemd

nohup ./server & keeps a program alive after you log out, but nothing restarts it after a crash or a reboot, its output goes to a stray nohup.out, and nobody remembers it is there. A systemd service fixes all of that: it starts at boot, restarts on failure, logs to the journal and can be stopped by name.

systemd-run --user --unit=reindex ./reindex.sh   # one-off job as a transient user service
systemctl --user status reindex                   # watch it
journalctl --user -u reindex                      # read its output

A real run with a job that prints a line and fails on purpose (exit code 3). systemd records the failure, and the output is in the journal instead of a lost terminal:

$ systemd-run --user --unit=demo-hello --quiet sh -c 'echo hello from a transient service; exit 3'
$ systemctl --user status demo-hello --no-pager | head -8
× demo-hello.service - [systemd-run] /usr/bin/sh -c "echo hello from a transient service; exit 3"
     Loaded: loaded (/run/user/1000/systemd/transient/demo-hello.service; transient)
  Transient: yes
     Active: failed (Result: exit-code) since Mon 2026-09-28 06:35:46 CEST; 996ms ago
   Duration: 26ms
 Invocation: 81e8981caafc4273a4568b85058c3a3d
    Process: 3110022 ExecStart=/usr/bin/sh -c echo hello from a transient service; exit 3 (code=exited, status=3)
   Main PID: 3110022 (code=exited, status=3)

$ journalctl --user -u demo-hello --no-pager -o short-iso | tail -4
2026-09-28T06:35:46+02:00 laptop systemd[1774]: Started [systemd-run] /usr/bin/sh -c "echo hello from a transient service; exit 3".
2026-09-28T06:35:46+02:00 laptop sh[3110022]: hello from a transient service
2026-09-28T06:35:46+02:00 laptop systemd[1774]: demo-hello.service: Main process exited, code=exited, status=3/NOTIMPLEMENTED
2026-09-28T06:35:46+02:00 laptop systemd[1774]: demo-hello.service: Failed with result 'exit-code'.

For anything permanent, write a unit file or, for containers, a quadlet. The systemd unit explainer explains every line, and systemctl and journalctl for beginners covers starting, stopping and reading logs.

Common mistakes

Frequently asked questions