In Linux, inspecting active processes helps maintain system stability, identify runaway tasks, and understand how CPU and memory are being used. Regularly checking what is running makes it easier to detect misbehaving applications, background services, or unexpected workloads on a host.
Command-line tools such as ps and top read process information maintained by the kernel and exposed through the process table and the /proc filesystem. ps provides a point-in-time snapshot, while top presents an updating view that highlights the busiest tasks and overall resource usage.
Different Linux distributions ship the same core utilities but may format some columns or default options slightly differently. Running process listing commands as a regular user only shows information that account is allowed to see, while root can usually inspect every process on the system, so elevated access may be needed for full visibility on multi-user machines.
Steps to list and manage active processes in Linux:
- Run ps with no options to display processes attached to the current terminal.
$ ps PID TTY TIME CMD 3770 pts/0 00:00:00 psBy default, ps shows only processes associated with the current terminal and user.
- Use ps aux to list all processes with detailed information.
$ ps aux USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.3 0.3 22416 12660 ? Ss 12:09 0:01 /sbin/init root 2 0.0 0.0 0 0 ? S 12:09 0:00 [kthreadd] root 3 0.0 0.0 0 0 ? S 12:09 0:00 [pool_workqueue_release] root 4 0.0 0.0 0 0 ? I< 12:09 0:00 [kworker/R-rcu_g] root 5 0.0 0.0 0 0 ? I< 12:09 0:00 [kworker/R-rcu_p] root 6 0.0 0.0 0 0 ? I< 12:09 0:00 [kworker/R-slub_] root 7 0.0 0.0 0 0 ? I< 12:09 0:00 [kworker/R-netns] root 8 0.0 0.0 0 0 ? I 12:09 0:00 [kworker/0:0-cgroup_destroy] root 11 0.0 0.0 0 0 ? I 12:09 0:00 [kworker/u4:0-events_unbound] root 12 0.0 0.0 0 0 ? I< 12:09 0:00 [kworker/R-mm_pe] root 13 0.0 0.0 0 0 ? I 12:09 0:00 [rcu_tasks_kthread] ##### snipped #####
The output lists each process with PID, CPU and memory usage, controlling terminal, state, start time, and the command that started it.
More options for ps:
Usage: ps [options] Basic options: -A, -e all processes -a all with tty, except session leaders a all with tty, including other users -d all except session leaders -N, --deselect negate selection r only running processes T all processes on this terminal x processes without controlling ttys Selection by list: -C <command> command name -G, --Group <GID> real group id or name -g, --group <group> session or effective group name -p, p, --pid <PID> process id --ppid <PID> parent process id -q, q, --quick-pid <PID> process id (quick mode) -s, --sid <session> session id -t, t, --tty <tty> terminal -u, U, --user <UID> effective user id or name -U, --User <UID> real user id or name The selection options take as their argument either: a comma-separated list e.g. '-u root,nobody' or a blank-separated list e.g. '-p 123 4567' Output formats: -D <format> date format for lstart -F extra full -f full-format, including command lines f, --forest ascii art process tree -H show process hierarchy -j jobs format j BSD job control format -l long format l BSD long format -M, Z add security data (for SELinux) -O <format> preloaded with default columns O <format> as -O, with BSD personality -o, o, --format <format> user-defined format -P add psr column s signal format u user-oriented format v virtual memory format X register format -y do not show flags, show rss vs. addr (used with -l) --context display security context (for SELinux) --headers repeat header lines, one per page --no-headers do not print header at all --cols, --columns, --width <num> set screen width --rows, --lines <num> set screen height --signames display signal masks using signal names Show threads: H as if they were processes -L possibly with LWP and NLWP columns -m, m after processes -T possibly with SPID column Miscellaneous options: -c show scheduling class with -l option c show true command name e show the environment after command k, --sort specify sort order as: [+|-]key[,[+|-]key[,...]] L show format specifiers n display numeric uid and wchan S, --cumulative include some dead child process data -y do not show flags, show rss (only with -l) -V, V, --version display version information and exit -w, w unlimited output width --help <simple|list|output|threads|misc|all> display help and exit For more details see ps(1).Manual page for ps:
ps - report a snapshot of the current processes. - Filter the full process list with grep to search for specific processes.
$ ps aux | grep cpu ##### snipped ##### root 3780 0.0 0.0 5256 1792 ? S 12:15 0:00 cpu-worker 60 root 3783 0.0 0.0 6140 2048 ? S 12:15 0:00 grep cpu
Combining ps aux with grep narrows the output to lines that match a pattern such as a command name or PID.
- Use top for real-time monitoring of active processes and resource usage.
$ top top - 12:15:50 up 6 min, 2 users, load average: 0.38, 0.15, 0.06 Tasks: 122 total, 1 running, 120 sleeping, 0 stopped, 1 zombie %Cpu(s): 4.5 us, 0.0 sy, 0.0 ni, 95.5 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st MiB Mem : 3901.5 total, 2923.6 free, 326.3 used, 809.3 buff/cache MiB Swap: 2048.0 total, 2048.0 free, 0.0 used. 3575.2 avail Mem PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 1 root 20 0 22416 12660 8564 S 0.0 0.3 0:01.44 systemd 2 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kthreadd 3 root 20 0 0 0 0 S 0.0 0.0 0:00.00 pool_wo+ 4 root 0 -20 0 0 0 I 0.0 0.0 0:00.00 kworker+ 5 root 0 -20 0 0 0 I 0.0 0.0 0:00.00 kworker+ 6 root 0 -20 0 0 0 I 0.0 0.0 0:00.00 kworker+ 7 root 0 -20 0 0 0 I 0.0 0.0 0:00.00 kworker+ 8 root 20 0 0 0 0 I 0.0 0.0 0:00.16 kworker+ 11 root 20 0 0 0 0 I 0.0 0.0 0:00.24 kworker+ ##### snipped #####Press q to exit top; interactive help is available with h, and sorting can be adjusted with keys such as P for CPU and M for memory.
More options for top:
Usage: top -hv | -bcEHiOSs1 -d secs -n max -u|U user -p pid(s) -o field -w [cols]
Manual page for top:
top - display Linux processes
Mohd Shakir Zakaria is a cloud architect with deep roots in software development and open-source advocacy. Certified in AWS, Red Hat, VMware, ITIL, and Linux, he specializes in designing and managing robust cloud and on-premises infrastructures.
