Linux Processes: Inspect What Is Running Before You Kill It
Identify the process and its owner before terminating it. Use a normal application or service stop path before escalating to a forceful signal.
Short answer
A Linux process is a running program instance with a process ID, state and resource usage. Troubleshooting a process means identifying the right PID or service, understanding whether it is actually stuck, and using the least forceful shutdown mechanism that solves the problem.
Useful process inspection tools
| Question | Tool | Use |
|---|---|---|
| What processes are running? | ps | Snapshot of selected processes and their attributes. |
| What is using CPU or memory now? | top or another installed monitor | Interactive view of process activity. |
| Which process owns a listening socket? | ss -lntup where permitted | Maps listening network sockets to process context when available. |
| Is this a systemd service? | systemctl status UNIT | Shows service state and its main process context. |
| What opened this file/socket? | lsof if installed | Lists open files for troubleshooting resource ownership. |
Terminate gracefully before forcing a process
The normal kill PID command sends SIGTERM by default on common implementations, giving a well-behaved program an opportunity to exit cleanly. SIGKILL, commonly requested with kill -9, cannot be handled by the process. Use it only when a normal stop path fails and you understand the consequence of abrupt termination.
A high number is not automatically a problem
CPU and memory readings need context. A compilation job can legitimately consume every CPU core. Linux also uses memory for filesystem cache. Diagnose user-visible symptoms, sustained pressure and the process’s expected role rather than treating resource use itself as evidence of a fault.
Service processes should usually be managed as services
If systemd owns the process, prefer the service’s normal stop/restart path over killing an arbitrary child PID. The service manager may immediately restart a killed process or interpret the failure differently from an intentional stop.
Useful gear for this task
Optional tools that fit the workflow above. Affiliate links may earn us a commission.
Frequently asked questions
What is a process in Linux?
A process is a running instance of a program with its own process ID, state, resources and security context. Processes can create child processes and receive signals from users or other processes.
Should I use kill -9 first?
No. SIGKILL forces immediate termination and does not let the process handle cleanup. Try the application’s normal shutdown or a regular termination signal first unless an emergency requires otherwise.
Technical references checked
Technical review: 9 September 2026. Distribution, hardware and training details can change; recheck first-party documentation before a risky system change or purchase.