How to Use the ‘ps’ and ‘kill’ Commands for Process Management

The Invisible Engine

In a graphical operating system, if a web browser freezes, you hit Ctrl+Alt+Delete and open the Task Manager to forcefully close it.

A Linux server rarely has a graphical interface. It runs completely headless, relying entirely on invisible background services (daemons). If a database query enters an infinite loop and consumes 100% of the CPU, you cannot use a mouse to close it. You must identify the rogue process and cryptographically execute it using the terminal.

To master Linux process management, administrators rely on two fundamental commands: ps (Process Status) and kill.

1. Auditing Running Processes (ps)

If you type ps by itself, it only shows the basic processes running in your current, specific terminal window (usually just the bash shell itself). This is useless for debugging a server.

To see every process running across the entire system, regardless of which user started it, you use a specific combination of flags.

ps aux

Breaking down the legacy flags:

• a: Show processes for all users.
• u: Display the user-oriented format (shows the Username, CPU %, and Memory %).
• x: Show processes that are not attached to a physical terminal (like background web servers).

This command outputs a massive table. The most important column is the PID (Process ID)-the unique mathematical number assigned to the running application.

2. Finding the Rogue Application (grep)

Because ps aux outputs thousands of lines, you must filter it to find what you are looking for. If you know the Apache web server is causing problems, you pipe the output into grep.

ps aux | grep apache2

This will isolate the list, showing only the processes containing the word “apache2”, allowing you to easily identify the rogue PID.

3. Terminating the Process (kill)

Once you have the PID (for example, 4051), you use the kill command to send a signal to the application.

kill 4051

By default, kill sends a SIGTERM (Signal 15). This is a polite request. It tells the application, “Please finish what you are doing, save your data, and shut down gracefully.”

However, if a process is completely frozen in an infinite loop, it will ignore the polite request.

4. The Nuclear Option (kill -9)

If an application refuses to close, you must escalate from a polite request to a kernel-level execution.

kill -9 4051

The -9 flag sends a SIGKILL. This signal does not go to the application; it goes directly to the Linux Kernel. The Kernel instantly rips the application out of RAM, completely destroying it without giving it a chance to save any data.

Warning: Only use -9 as a last resort, especially on databases, as it can cause severe data corruption.

5. The Shortcut (killall)

If Chrome spawns 50 different processes, finding and killing 50 individual PIDs is tedious. You can use killall to target applications by their human-readable name, instantly terminating the entire tree.

killall chrome

Conclusion

The ps and kill commands form the core of Linux stability management. By allowing administrators to peer into the active RAM of a server, identify resource hogs, and surgically terminate frozen processes, they ensure maximum uptime without requiring a physical reboot.