A process is a running instance of a program. Each has a unique process ID (PID), parent process ID (PPID), and runs as a specific user.

List all processes:

ps aux

Output: USER, PID, CPU%, MEM%, VSZ, RSS, TTY, STAT, START, TIME, COMMAND

Show process tree:

ps -ef
pstree          # tree view

Real-time monitoring:

top

Commands in top: - space — refresh now - q — quit - k — kill process - M — sort by memory - P — sort by CPU

Modern alternative:

htop

More user-friendly than top.

Send terminate signal (graceful shutdown):

kill PID

Force kill (no graceful shutdown):

kill -9 PID

Kill by name:

pkill name
pkill -f "pattern"      # match full command

Show in ps output (STAT column):

• R — running
• S — sleeping (waiting for event)
• D — disk sleep (uninterruptible)
• Z — zombie (finished, parent hasn't reaped)
• T — stopped
• + — foreground group
• l — multi-threaded
• s — session leader

Zombie processes hang around until parent collects exit status. Kill the parent to clean up:

kill PPID

Processes form a tree, rooted at PID 1 (systemd or init). Child processes are managed by their parent.

Orphaned processes are re-parented to PID 1. Background processes survive terminal closure if nohup'd:

nohup ./long-job &

Detailed process info:

```bash ps -p PID -o pid,ppid,user,cmd cat /proc/PID/status # kernel view lsof -p PID # open files