What Is a Process in Linux?
Learn what a Linux process is, how programs become processes, how PIDs and ownership work, and how multitasking uses CPU and memory.
A process is a running execution of a program. Whenever Linux starts software, it creates an active process to carry out that software's instructions. Processes are the basic running units that the kernel schedules, monitors, and manages.
Understanding processes helps explain what happens after you enter a command, why a computer can run several applications at once, and how administrators investigate slow or malfunctioning systems.
Program Versus Process
A program is stored software: executable instructions that can be started. A process is an active instance of those instructions while they are running.
The program file is not itself a running activity. When Linux loads that program and begins executing it, the running activity becomes a process. The process has its own identity and resource usage.
Launching the same program more than once normally creates separate processes. For example, two active copies of a text editor are two processes, even though both came from the same program. Each process receives a different process ID and may use CPU time and memory independently.
How Commands Create Processes
A shell is a command interpreter through which a user commonly starts programs. When you enter an external command, the shell asks Linux to start that program. Linux then creates an executing process for it.
some-programConceptually, this command causes the following sequence:
- The shell reads the command line.
- The shell locates the requested program.
- Linux starts an executing instance of that program.
- The new process receives a process ID, or PID.
- The process runs with an associated user and group identity and uses system resources.
Not every command name represents an external program. Some commands are shell built-ins, which the shell performs internally. The introductory process model is most straightforward for external programs, because starting one creates a separate executing process. Either way, the shell is the user's usual starting point for requesting work from Linux.
For information about how the shell locates executable commands, see showing the full path of shell commands. Bash is one commonly used Linux shell; learn more in Bourne Again Shell (Bash).
Process Identity: The PID
Linux assigns each process a numeric process ID, commonly called a PID. The PID identifies a particular running process during its lifetime.
A PID is needed because a system may have many processes running the same program or many different programs with similar names. A process-listing tool can show details for a PID, and later process-control tools can use the PID to target one specific process.
PIDs are valid for the lifetime of their associated processes. After a process exits, Linux may eventually reuse that number for another process. Therefore, a PID identifies a current process, not a permanent identity for a program or a person.
User and Group Ownership
Each process runs with an associated user identity and group identity. The user account associated with the process is often called the process owner. The group association is also relevant to Linux access control.
Ownership matters for three main reasons:
- Permissions: Linux uses identities when deciding which actions are allowed.
- Accountability: Ownership helps administrators determine which account started or controls a process.
- Administrative control: A user can generally manage their own processes, while controlling another user's process may require additional privileges.
Process ownership is related to, but distinct from, file ownership. A program file can have one set of file permissions, while the process running it has an associated user and group identity. For background on these identities, see UID, user identifier, and GID, group identifier. File ownership is covered in managing file ownership.
Processes and Multitasking
Multitasking is the operating system's ability to manage and advance multiple running tasks. Linux can keep a terminal command, a text editor, a browser, and many system services active at the same time.
The kernel schedules process work on the available CPU resources. On a computer with multiple CPU cores, several processes may execute simultaneously. Even on a single-core system, the kernel rapidly gives different processes opportunities to run, so they appear to operate independently.
Processes do not each own the entire computer. They share finite resources managed by Linux. The kernel coordinates access to those resources and keeps track of each process's activity.
Shared CPU and Memory Resources
Two important resources used by processes are CPU time and memory. The CPU executes process instructions. Memory holds active code and data needed while a process runs.
When many processes are active, they compete for available CPU time and memory. A process that performs heavy computation may consume substantial CPU time. A process that opens large files or maintains large data structures may use substantial memory. If demand becomes high, the system can become less responsive.
These attributes are among the details displayed by process-listing and monitoring tools. A later lesson can use ps to display process information without needing to treat the command as part of this introductory definition.
Why Process Knowledge Matters to Administrators
Linux administrators regularly need to find, identify, monitor, and sometimes stop processes. For example, an administrator may investigate a slow system, determine which process belongs to a particular user, or check whether a service is still running.
A typical investigation begins by identifying the relevant process by name, owner, and PID. The PID then provides a precise target for later monitoring or process-control actions. Ownership should be checked before attempting to manage a process, because permissions affect which operations are allowed.
Useful follow-up topics include:
- Listing processes with
ps - Interactive monitoring with
toporhtop - Finding processes by name or PID
- Using foreground and background jobs
- Stopping processes with signals
- Understanding process states and lifecycles
- Studying parent and child processes
- Diagnosing resource usage and performance problems
Practical Examples
Starting a command
You launch an external command from a shell. Linux starts an executing instance of the program, assigns it a PID, and runs it under your user and group identities. While it runs, it consumes some amount of CPU time and memory.
Launching the same application twice
Suppose you start an application, then start it again. The two active copies are normally separate processes. They have different PIDs and can consume CPU and memory independently, even though they originated from the same program.
Using several applications
A terminal command, text editor, and browser can all be active at once. Linux allocates processor time and memory among their processes. If one process uses an unusually large amount of CPU or memory, the other applications may respond more slowly.
Investigating a process
An administrator first identifies a process by its name, user owner, and PID. The PID distinguishes the exact running task from other processes that may have the same program name. The administrator also checks ownership before attempting any management action.
Common Misunderstandings
A program file is a process
A program is stored software. A process exists only while that software is executing. The same program can be stored once and produce multiple processes over time or multiple processes at the same time.
Repeated launches share one PID
Separate executions normally create separate processes. Each process receives its own PID, so two copies of one application are not identified by one shared process ID.
Each process owns the whole computer
Processes share CPU, memory, and other system resources. Linux schedules and manages them so that many tasks can make progress, but heavy resource use by one process can affect others.
Any user can manage any process
User and group identities influence process-control permissions. A user can usually manage processes they own, while actions involving another user's process may require administrative privileges.
Key Points
- A process is a running execution of a program.
- A stored program and an active process are different concepts.
- Launching one program multiple times can create multiple separate processes.
- The PID is the numeric identifier for a running process and may be reused after that process exits.
- Processes have associated user and group identities that affect permissions and accountability.
- Linux multitasks by scheduling process work across available CPU resources.
- Processes share finite CPU time and memory rather than owning the entire machine.
- Administrators use process identity and resource information to inspect, monitor, and control running work.