ps, top, htop: See What’s Running

Every running program on Linux is a process. Three tools cover almost every “what’s running and how heavy is it?” question. Pick based on whether you want a snapshot (ps), a live view (top), or a friendly interactive view (htop).

ps — snapshot of running processes

ps                       # YOUR processes in this terminal only
ps -e                    # ALL processes
ps -ef                   # all + full command line + parent PID
ps aux                   # all + user + memory + CPU (BSD style)
ps -ef --forest          # show parent/child tree

The two most common:

ps -ef | grep nginx      # find nginx processes
ps aux | grep python     # all python processes with memory

Useful columns in ps aux

Column	Meaning
USER	Owner of the process
PID	Process ID
%CPU	CPU usage %
%MEM	Resident memory %
VSZ	Virtual memory size
RSS	Resident memory in KB (the real RAM)
STAT	State (R=running, S=sleeping, Z=zombie, …)
START	When it started
TIME	CPU time used
COMMAND	The command line

Sort with ps

ps aux --sort=-%mem | head        # heaviest by memory
ps aux --sort=-%cpu | head        # heaviest by CPU
ps -ef --sort=start_time          # by start time

top — live monitoring

top                  # live view, refreshes every 3 seconds

Useful keys inside top:

q          quit
P          sort by CPU
M          sort by memory
N          sort by PID
T          sort by time
1          show per-CPU stats
k          kill a process (asks for PID)
r          renice a process (change priority)
u          filter by user
W          save current settings to ~/.toprc

htop — better top

If your system doesn’t have htop, install it:

sudo apt install htop
sudo dnf install htop

Then just run htop. It gives you:

• Color-coded CPU and memory bars
• Mouse support — click columns to sort
• F-key shortcuts (F2 setup, F3 search, F4 filter, F9 kill, F10 quit)
• Tree view (F5)

Once you use htop, you don’t go back to top.

Other process tools

pgrep / pkill — find or kill by name

pgrep nginx              # show PIDs of nginx processes
pgrep -u alice           # all PIDs owned by alice
pgrep -l ssh             # show PIDs + names

pkill firefox            # kill all firefox processes
pkill -9 firefox         # SIGKILL them
pkill -u alice           # kill all of alice's processes

pidof — get PID by exact name

pidof nginx              # 1234 5678 9012

lsof — what files/sockets does a process have open?

lsof -p 1234             # all open files for PID 1234
lsof -i :80              # what's using port 80
lsof -i tcp              # all TCP connections
lsof -u alice            # everything alice has open

fuser — what process is using this file/port?

fuser /var/log/syslog    # who has this file open
fuser -v 80/tcp          # what's listening on port 80

Real one-liners

# Top 5 memory hogs
ps aux --sort=-%mem | awk 'NR<=6 {print $2, $4, $11}'

# Total memory used by all chrome processes
ps aux | grep chrome | grep -v grep | awk '{sum+=$6} END {print sum/1024 "MB"}'

# Watch processes for a specific user every 2 seconds
watch -n2 'ps -u alice'

# Find which processes are zombies
ps aux | awk '$8 == "Z"'

Common mistakes

• ps with no args shows almost nothing — it shows YOUR processes in THIS terminal. Use -ef or aux.
• Confusing VSZ (virtual memory) with RSS (real memory). RSS is what matters for actual RAM usage.
• Killing parent processes by accident. Look at the PPID column or use --forest.

What to learn next

Now that you can see processes, the next steps are running them in the background (so they survive after you close the terminal) and signaling them (kill, pause, resume).