What's Actually Running

Seeing what's running

ps aux

USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root           1  2.5  0.6  21108 12356 ?        Ss   03:43   0:00 /sbin/init
root           2  0.0  0.0      0     0 ?        S    03:43   0:00 [kthreadd]
root           3  0.0  0.0      0     0 ?        I<   03:43   0:00 [rcu_gp]
root           7  0.0  0.0      0     0 ?        I    03:43   0:00 [kworker/0:0-rcu_gp]

Columns worth actually reading: PID is the process ID - the number you'll hand to kill. %CPU and %MEM are exactly what they say, and are the two columns to scan when something's misbehaving. COMMAND is what's actually running - names in [brackets], like [kthreadd], are kernel threads, not real userspace programs, so they're not something you'd ever kill while debugging an application. ps aux shows you one moment in time, like a photo. For something actively happening right now, top keeps updating, like a video - press q to quit it.

pgrep -af name

pgrep -af name has two separate flags in it: -a means "list every match, not just the first one," and -f means "search the whole command line, not just the short process name." Together they're the most useful way to find a process when you only remember roughly what it was called:

$ pgrep -af 'while true'
1020 bash -c while true; do :; done

The first column is the PID, 1020 - the number kill needs. Everything after it is the full command line -f matched against, which is exactly what lets you confirm you've found the right process before you touch it, instead of guessing from a bare PID alone.

Foreground, background, and stopping things

Start something and it owns your terminal until it exits - that's foreground. Add & and it runs in the background, handing your prompt straight back:

some-long-command &
jobs                    # list background jobs in this shell

To stop a process, you send it a signal - kill doesn't just mean terminate, it means "deliver this signal":

kill <pid>                # SIGTERM - "please shut down" - the default, and the one to try first
kill -9 <pid>              # SIGKILL - "die immediately, no cleanup" - the last resort

SIGTERM gives a well-behaved process the chance to close files and clean up. SIGKILL cannot be caught, ignored, or cleaned up after - the kernel ends it on the spot. Reach for -9 only after a plain kill has actually failed.

Priority

Every process has a nice value from -20 (highest priority) to 19 (lowest, "nicest" to everyone else). Higher numbers give other processes more of the CPU:

nice -n 10 some-command       # start something at lower priority
renice 10 -p <pid>              # change the priority of something already running

Something is eating the CPU

Something on this box is using 100% of a core and it isn't you. Find it and stop it - pgrep -af is faster than scrolling through top once you know roughly what you're looking for, but either works:

top

Look at the top line by CPU%. Note its PID, then:

kill <pid>