A process is a running instance of a program. Each has a unique process ID (PID), parent process ID (PPID), and runs as a specific user.

List all processes:

ps aux

Output: USER, PID, CPU%, MEM%, VSZ, RSS, TTY, STAT, START, TIME, COMMAND

Show process tree:

ps -ef
pstree          # tree view

Real-time monitoring:

top

Commands in top:

• space: refresh now
• q: quit
• k: kill process
• M: sort by memory
• P: sort by CPU

Modern alternative:

htop

More user-friendly than top.

Send terminate signal (graceful shutdown):

kill PID

Force kill (no graceful shutdown):

kill -9 PID

Kill by name:

pkill name
pkill -f "pattern"      # match full command

Show in ps output (STAT column):

• R: running
• S: sleeping (waiting for event)
• D: disk sleep (uninterruptible)
• Z: zombie (finished, parent hasn't reaped)
• T: stopped
• +: foreground group
• l: multi-threaded
• s: session leader

Zombie processes hang around until parent collects exit status. Kill the parent to clean up:

kill PPID

Processes form a tree, rooted at PID 1 (systemd or init). Child processes are managed by their parent.

Orphaned processes are re-parented to PID 1. Background processes survive terminal closure if nohup'd:

nohup ./long-job &

Detailed process info:

```bash ps -p PID -o pid,ppid,user,cmd cat /proc/PID/status # kernel view lsof -p PID # open files