# Debian processes

A process is a running instance of a program. Each has a unique process ID (PID), parent process ID (PPID), and runs as a specific user.

## Listing processes

List all processes:

```bash
ps aux
```

Output: USER, PID, CPU%, MEM%, VSZ, RSS, TTY, STAT, START, TIME, COMMAND

Show process tree:

```bash
ps -ef
pstree          # tree view
```

## Process monitor

Real-time monitoring:

```bash
top
```

Commands in top:
- `space`: refresh now
- `q`: quit
- `k`: kill process
- `M`: sort by memory
- `P`: sort by CPU

Modern alternative:

```bash
htop
```

More user-friendly than `top`.

## Killing processes

Send terminate signal (graceful shutdown):

```bash
kill PID
```

Force kill (no graceful shutdown):

```bash
kill -9 PID
```

Kill by name:

```bash
pkill name
pkill -f "pattern"      # match full command
```

## Process states

Show in `ps` output (STAT column):

- `R`: running
- `S`: sleeping (waiting for event)
- `D`: disk sleep (uninterruptible)
- `Z`: zombie (finished, parent hasn't reaped)
- `T`: stopped
- `+`: foreground group
- `l`: multi-threaded
- `s`: session leader

Zombie processes hang around until parent collects exit status. Kill the parent to clean up:

```bash
kill PPID
```

## Process hierarchy

Processes form a tree, rooted at PID 1 (`systemd` or `init`). Child processes are managed by their parent.

Orphaned processes are re-parented to PID 1. Background processes survive terminal closure if nohup'd:

```bash
nohup ./long-job &
```

## Process info

Detailed process info:

```bash
ps -p PID -o pid,ppid,user,cmd
cat /proc/PID/status        # kernel view
lsof -p PID                 # open files