Process in Linux is nothing more than a piece of code or program in execution. It's a running instance of a program. Except for the init process, every process is run by another process. A process running another one is called the parent process.

ps command

To show the processes that are running in the current session:

ps

To show more details:

ps -u

• A few more properties that we can't pass by:
  • USER - Username of the process owner.
  • TTY- terminal type
  • TIME+ - total time the process has been running
  • CMD - name of the command that launches the process
  • %CPU - Percentage of CPU used by the process
  • %MEM - Percentage of RAM used by the process
  • S - state of the process
    • D - uninterruptible sleep
    • R - running
    • S - sleeping
    • T - traced or stopped
    • Z - zombie

To display a list of all running processes:

ps aux

In the image above, you can see the PID, which stands for the process id, and PPID is the process's parent.

To find a process by PID:

ps -f 1

In this case, we're looking for the init process run by the Linux kernel.
The init process might have different names, for example, systems, launchd, init.
It has PID 1, and PPID is 0. As said in the beginning, the initial process doesn't have a parent process.

top command

There is another program that shows the processes. Its name is top. By default, it shows sorted by PID.

If you don't like the top command view, many alternatives exist. You can install them and play a little bit. Here are a few of them: htop, bpytop, vtop

What happens when we run the command in the terminal

Suppose we run sleep 1 command in the bash shell.
The command invocation will consist of the following steps:

1. It forks into two processes
2. The copy of itself is replaced with sleep 1 command execution
3. When the copy is done with execution, it returns control to the parent process

Here is a diagram:

Suspending the process

Until the copy of the command didn't finish, the execution control won't be returned to the parent process.
You can run sleep 300 and see that you can type, but no matter what you do, nothing happens.

From this point, we can try to suspend the process by pressing Ctrl+z to suspend the process.

Now if we run ps -u, we'll see it on the list:

Another way to suspend is to run command with &.
For example:

sleep 300 &

This will run sleep 300 command directly in the background.

jobs command

It display status of jobs in the current session.
We'll need this to display suspended processes.

jobs

To display additional information such as PID:

jobs -l

Foreground the process

To foreground the process:

fg %1

%1 is the job number, it is shown in the very beginning [1].

Killing the process

Before we understand how to interrupt or kill the processes, we must understand the signals.

Signals are event notifications that are sent to processes mainly to terminate, interrupt, kill, or suspend the processes.
To read more about the signals, you can visit Linux manual page.

To display a list of signals in your terminal run:

kill -l

kill command has the following structure kill {signal} {pid}

To terminate the process in the most common way, use -15, which is SIGNTERM:

kill -15 4664

4664 is the id of the process we want to kill.

• Here are a few more signals that you've probably used before:
  • Ctrl+z - sends SIGTSTP
  • Ctrl+c - sends SIGINT
  • Ctrl+<md-code> - sends SIGQUIT

Signals are a sort of contract to the process. Thus, it doesn't mean that if you send a SIGINT signal, it will interrupt the process. The process might ignore it. In this case, we can use SIGKILL, a notification for the kernel, to terminate the process.

kill -9 4664

-9 is SIGKILL signal.