What is a process

A process is a running program. Every command you type spawns one. Every service on the machine is one. Some are short (ls starts, prints, exits, gone), some run for weeks (nginx, sshd, a database).

Listing processes

ps aux

Prints every process on the machine. The columns that matter to a DevOps engineer:

• USER - who owns the process
• PID - process ID, unique per process
• %CPU and %MEM - resources it's using
• COMMAND - the command line that launched it

Everything is referred to by PID

Every process has a PID. When you want to stop, inspect, or signal a process, you refer to it by PID:

ps aux | grep nginx           # find the nginx PID
kill 1234                     # stop process 1234

Your own shell has a PID too. Run echo $$ to see it.

Parent processes

Every process was started by another process, called its parent. ps -ef shows a PPID (parent PID) column:

ps -ef | head

When you run a command in bash, bash is the parent, your command is the child. This matters when you're chasing which service started which helper, or when a process seems to keep coming back (its parent is respawning it).