# Debian Processes

A process is a running instance of a program. Each has a unique process ID (PID), parent process ID (PPID), and runs as a specific user.

## Listing Processes

List all processes:

```bash
ps aux
```

Output: USER, PID, CPU%, MEM%, VSZ, RSS, TTY, STAT, START, TIME, COMMAND

Show process tree:

```bash
ps -ef
pstree          # tree view
```

## Process Monitor

Real-time monitoring:

```bash
top
```

Commands in top:
- `space` — refresh now
- `q` — quit
- `k` — kill process
- `M` — sort by memory
- `P` — sort by CPU

Modern alternative:

```bash
htop
```

More user-friendly than `top`.

## Killing Processes

Send terminate signal (graceful shutdown):

```bash
kill PID
```

Force kill (no graceful shutdown):

```bash
kill -9 PID
```

Kill by name:

```bash
pkill name
pkill -f "pattern"      # match full command
```

## Process States

Show in `ps` output (STAT column):

- `R` — running
- `S` — sleeping (waiting for event)
- `D` — disk sleep (uninterruptible)
- `Z` — zombie (finished, parent hasn't reaped)
- `T` — stopped
- `+` — foreground group
- `l` — multi-threaded
- `s` — session leader

Zombie processes hang around until parent collects exit status. Kill the parent to clean up:

```bash
kill PPID
```

## Process Hierarchy

Processes form a tree, rooted at PID 1 (`systemd` or `init`). Child processes are managed by their parent.

Orphaned processes are re-parented to PID 1. Background processes survive terminal closure if nohup'd:

```bash
nohup ./long-job &
```

## Process Info

Detailed process info:

```bash
ps -p PID -o pid,ppid,user,cmd
cat /proc/PID/status        # kernel view
lsof -p PID                 # open files