VMware ESXi and vSphere Cluster Management

What Is a Process in Linux?

Learn what Linux processes are, how programs create them, how PIDs and ownership work, and how to inspect processes using ps, pgrep, and top.

A process is a running instance of a program. When Linux starts executable code, it creates a process to represent that active work. The process has its own identity, ownership information, resource usage, and current state.

This distinction is fundamental: a program is something that can be run, while a process is that program while it is running. Linux process management involves listing, identifying, inspecting, monitoring, and controlling these running instances.

Program vs. process

A program is executable code or an application stored on a filesystem, usually as a file. It is inactive until something starts it. A process is the active execution of that program, along with the information Linux needs to manage it.

One program can create many processes at the same time. For example, three users or scripts can start the same web server, editor, or sleep command. Each running instance is a separate process with its own process ID and possibly different owner, arguments, and resource usage.

How running a command creates a process

A shell is a command interpreter. Bash and other shells read commands, locate the requested program, and arrange for it to run. The shell is itself a process, and programs started from it normally become additional processes.

Try a command that stays active long enough to observe:

sleep 60

The shell starts the sleep program. While the command is waiting, Linux maintains a process for it. The shell normally waits for this foreground process to finish, so you do not receive another prompt until 60 seconds have passed. Press Ctrl+C if you want to stop it early.

You can also start commands in the background by adding &:

sleep 60 &
sleep 60 &
ps

The two sleep commands are separate process instances, even though they use the same program. The shell usually prints a job number and a PID for each background command. The final ps command lists processes associated with the current terminal session, including the shell and the commands that are still running.

Viewing the shell and a command it starts

The special shell variable $$ contains the PID of the current shell. This command displays information about that shell:

ps -o pid,ppid,user,group,comm -p $$

Here, pid is the process ID, ppid is the parent process ID, and comm is the command name. The shell can start another command, such as sleep, as a separate process. The shell and the command are therefore distinct processes, even though the shell initiated the command.

Process IDs: identifying individual processes

A PID, or process ID, is a number Linux assigns to a process. The PID lets users and system tools refer to one specific running process instead of relying only on a command name.

PIDs are unique among processes that are currently running. After a process exits, Linux may eventually reuse its old PID for another process. Therefore, a PID identifies a current process only while that process exists; an old PID should not be assumed to refer to the same command later.

PIDs are important when you need to inspect or control a process. For example, after confirming that PID 4281 belongs to the intended command, a user can send it a signal with:

kill 4281

kill PID is the standard mechanism for sending a signal to an identified process. The number must be replaced with the actual PID. Always identify and inspect the target first, especially when several processes have the same command name.

Process ownership: users and groups

Every process is associated with a user account and a group account. The user is commonly called the process owner. The group provides additional identity information used by Linux permissions and administration.

Ownership affects what a user can do. In general, an ordinary user can manage processes they own, while a privileged administrator can manage a wider range of processes. Permission checks help prevent one user from arbitrarily controlling another user's work or important system services.

Ownership does not mean that the process is a file with ordinary file ownership. It means that Linux records the account identities associated with the process and uses them when applying authorization rules.

Linux multitasking

Linux is a multitasking operating system: it can manage many running processes and switch CPU execution among them. In Linux discussions, a running process may also be called a task.

The operating system's scheduler decides which runnable work receives CPU time. On a computer with one CPU core, processes take turns over short intervals, so interactive applications appear to run independently even though only one can execute on that core at a time. On a computer with multiple cores, multiple processes can execute literally at the same time, up to the available processing capacity.

Multitasking does not guarantee equal speed for every process. Scheduling decisions, process priority, input and output activity, and the number of available CPU cores all affect how much progress each process makes.

Processes share CPU and memory

Running processes share finite system resources. Two important resources are:

• CPU: processor execution time used to perform calculations and run instructions.
• Memory: system RAM used for the process's code, data, and working state.

A process that performs heavy computation can consume substantial CPU time. A process that loads large data sets or has a memory leak can consume substantial RAM. Many moderately busy processes can also add up to a significant load.

When processes compete for limited resources, the system may become less responsive. Commands can take longer, applications may pause, and Linux may need to reclaim memory or use storage as a less efficient temporary extension. Process inspection helps you connect a symptom, such as a slow system, to the processes using resources.

Core process attributes

Process-listing tools display attributes that help you identify and assess running work.

Basic process administration tools

Administrators commonly need to list processes, identify a particular process, inspect its owner and resource use, and only then decide whether control is necessary.

List processes for the current terminal

ps

The plain ps command provides a snapshot of processes associated with the current terminal session. It is useful for a quick look at the current shell and commands launched from it.

List a broad set of processes

ps -ef

ps -ef displays a broad process listing. Typical output includes the process owner, PID, parent PID, start information, and the command. The exact output can vary by Linux distribution.

View processes with resource information

ps aux

ps aux is another commonly used format. It normally includes the user, PID, CPU percentage, memory percentage, and command. The ps -ef and ps aux forms use different option conventions, but both are useful for process inspection.

Find PIDs by process name

pgrep sleep

pgrep searches for processes by name and prints matching PIDs. If multiple sleep processes are running, it may print multiple numbers. Use the PID together with ownership and command details to confirm which instance is the intended target.

Watch processes interactively

top

top provides a continuously updating view of active processes, including CPU and memory consumption. It is useful when investigating a system that feels slow because it can reveal processes whose resource use changes over time. Press q to quit on most systems.

Troubleshooting common process situations

A command runs longer than expected

1. List processes with ps, ps -ef, or ps aux.
2. Search for a likely command name with pgrep.
3. Check the matching PID, owner, command details, and resource usage.
4. Confirm that it is the correct process before using kill PID.

A long-running command may be working normally, waiting for input, or stuck. A process name alone does not tell you which explanation is correct.

The system feels slow

Use top or ps aux to inspect CPU and memory usage. Look for one process consuming an unusually large amount of a resource, or for many processes collectively consuming most of the available capacity. Remember that processes share the system's finite CPU time and RAM, so heavy activity can affect unrelated work.

A user cannot manage another user's process

Check the process owner in the listing. Ordinary users generally have authority over their own processes but not over processes owned by other accounts. Privileged administrators have broader authority, subject to the system's security configuration.

Several entries have the same command name

Use the PID to distinguish instances, then compare the owner, arguments, start time, or parent process when available. Never select a process solely because its command name matches. Sending a signal to the wrong PID can interrupt an unrelated workload.

Key points to remember

• A process is a running instance of a program.
• A program can have multiple simultaneous process instances.
• The shell is itself a process and commonly starts other processes when you enter commands.
• A PID identifies a currently running process and can be reused after that process exits.
• Every process has associated user and group identities that affect administration and permissions.
• Linux multitasks by scheduling processes for CPU time; a single core does not execute every process at the same instant.
• Processes share finite CPU and memory resources.
• Process management should begin with listing and inspection before termination or other control actions.

For a concise reference, see What Is a Process in Linux?