ps, pgrep, pkill, top, htop — the production toolkit · Linux

The five commands in this lesson cover 95% of production process diagnostics. The discipline is knowing the right one for the question.

ps — snapshot

ps reads /proc and prints a snapshot of running processes. The flags determine what to show:

Read-only / Safeps auxf— ps auxf shows every process (a), with user-oriented columns (u), no terminal restriction (x), in forest view (f) — children are indented under parents. The classic 'what is running on this host?' view.

$ ps auxf

USER  PID %CPU %MEM   VSZ   RSS TTY   STAT START   TIME COMMAND
root    1  0.0  0.1  16892 12096 ?    Ss   Jul19   0:05 /sbin/init
root  567  0.0  0.1  23456  4096 ?    Ss   Jul19   0:01 /usr/sbin/cron -f
www-d 1234  2.0  1.1 1234567 45678 ?    S    Jul19   5:23 nginx: master process /etc/nginx/nginx.conf
www-d 1235  0.5  1.1 1234567 45678 ?    S    Jul19   1:23 nginx: worker process
...

Illustrative output

The flag conventions are confusing because they predate each other:

Convention	Meaning	Standard
`ps aux`	All processes, user-oriented columns	BSD
`ps -ef`	All processes, full-format	System V
`ps -eo ...`	Selected columns, every process	Modern

Pick one and stick to it. ps auxf for the human-readable view, ps -eo pid,ppid,comm for scripting.

pgrep — search by pattern

Read-only / Safepgrep— pgrep matches against the process name (comm). pgrep -f matches against the full command line. pgrep -u USER filters by user. pgrep -l prints both PID and name. Without -f, pgrep does NOT match against arguments.

$ pgrep nginx; pgrep -u www-data nginx; pgrep -f 'nginx: worker'; pgrep -l nginx

1234
1235
1235
1235 nginx: worker process

Illustrative output

pkill — kill by pattern

Service impact possiblepkill— pkill sends a signal (default SIGTERM) to every process matching the pattern. The same flags as pgrep apply (-f for full command line, -u for user). Always confirm the match set with pgrep before running pkill — pkill does not ask for confirmation.

$ pkill -TERM nginx; pkill -HUP -f 'nginx: master'; pkill -KILL -u baduser

Illustrative output

top — live snapshot

Read-only / Safetop— top shows live CPU/memory/process state. -bn1 runs one iteration in batch mode (suitable for logging). Load average shows system load over 1/5/15 minutes. %Cpu breaks down user/system/nice/iowait/hirq/sirq/steal/idle. The idle percentage (id) is the headroom.

$ top -bn1 | head -15

top - 12:00:00 up 30 days,  3:45,  1 user,  load average: 4.20, 3.10, 2.50
Tasks: 234 total,   3 running, 220 sleeping,   0 stopped,   0 zombie
%Cpu(s): 12.5 us,  0.0 sy,  0.0 ni, 87.5 id,  0.0 wa,  0.0 hi,  0.0 si,  0.0 st
MiB Mem :  16000.0 total,   1234.5 free,   8901.2 used,   5864.3 buff/cache

PID USER   PR  NI   VIRT   RES   SHR  S  %CPU  %MEM     TIME+  COMMAND
12345 root   20   0  1234m  456m  123m  R  95.0   1.1   0:42.15  nginx
12346 www-d  25   5  1234m  456m  123m  S   2.0   1.1   0:01.20  nginx
12347 www-d  25   5  1234m  456m  123m  S   1.5   1.1   0:01.05  nginx
12348 www-d  25   5  123m  45m  12m  S   0.5   0.1   0:00.30  nginx

Illustrative output

The CPU breakdown:

Field	Meaning
us	User CPU — time spent running userland code
sy	System CPU — time spent in kernel
ni	Nice — time spent on nice-priority tasks
id	Idle — CPU doing nothing
wa	I/O wait — CPU idle waiting for I/O
hi	Hardware interrupts
si	Software interrupts
st	Steal time — CPU taken by the hypervisor

htop — friendlier top

Read-only / Safehtop— htop is a more readable top with colour, mouse support, and easier filtering. The same data is in ps and top; htop is just nicer to read. -d 5 sets the refresh delay to 5 seconds instead of the default 1.5.

$ htop -d 5

CPU[|||||||||||||||||||||||||     70.0%]   Tasks: 234, 567 thr; 1 running
Mem[|||||||||||||             45.0%/16G]   Load average: 4.20 3.10 2.50
Swp[|                       0K/2G]         Uptime: 30 days, 03:45

PID USER   PRI  NI  VIRT   RES   SHR  S  CPU%  MEM%   TIME+  Command
12345 root    20   0  1234m  456m  123m R  95.0   1.1  0:42.15  nginx: master
12346 www-d   25   5  1234m  456m  123m S   2.0   1.1  0:01.20  nginx: worker
...

Illustrative output

Production discipline

**Use ps auxf** for the human-readable snapshot
**Use pgrep -f PATTERN** to confirm what pkill will match before running pkill
**Use pkill -TERM** first, then pkill -KILL after a timeout
**Use top -bn1** for logable snapshots in runbooks
**Use htop** for interactive debugging
**Combine with taskset -p PID and cat /proc/<pid>/status for deeper forensics.

ps — snapshot

pgrep — search by pattern

pkill — kill by pattern

top — live snapshot

htop — friendlier top

Production discipline

Knowledge check