📊
Processes & performance cheat sheet
Find what is using CPU and memory, and control running processes. Use signals gently: SIGTERM (15) first, SIGKILL (9) only as a last resort.
Click any command to copy it.
Inspect
| Command | What it does |
|---|---|
ps aux | All processes with user, CPU and memory. |
ps -ef --forest | Processes as a parent/child tree. |
ps aux --sort=-%mem | head | Top memory users. |
ps aux --sort=-%cpu | head | Top CPU users. |
pgrep -a name | Find processes by name, showing the command line. |
top | Live view of processes (press q to quit). |
htop | Friendlier live view (install htop). |
uptime | Load averages for 1, 5 and 15 minutes. |
Signal and stop
| Command | What it does |
|---|---|
kill PID | Ask a process to terminate (SIGTERM). |
kill -9 PID | Destructive: Force-kill a process immediately; it cannot clean up. |
kill -HUP PID | Ask a daemon to reload its configuration. |
pkill name | Terminate processes by name. |
killall name | Terminate all processes with an exact name. |
kill -l | List available signals. |
Priority and limits
| Command | What it does |
|---|---|
nice -n 10 command | Start a command with lower priority. |
renice -n 5 -p PID | Change the priority of a running process. |
ulimit -n | Show the open file limit for the shell. |
ulimit -a | Show all limits. |
Memory and system load
| Command | What it does |
|---|---|
free -h | Memory and swap usage. |
vmstat 1 | Memory, swap, I/O and CPU every second. |
watch -n 2 'command' | Repeat a command every 2 seconds. |
dmesg -T | tail | Recent kernel messages with readable timestamps, such as OOM kills. |
sudo dmesg -T | grep -i 'out of memory' | Check whether the OOM killer terminated something. |
Debug a process
| Command | What it does |
|---|---|
sudo lsof -p PID | Files and sockets a process has open. |
sudo strace -p PID | Trace the system calls of a running process. |
sudo ss -tp | grep PID | Network connections owned by a process. |
ls -l /proc/PID/exe | Which binary a process is running. |
Frequently asked questions
What is the difference between kill and kill -9?
kill sends SIGTERM, which lets the process shut down cleanly. kill -9 sends SIGKILL, which cannot be caught, so open files and locks may be left in a bad state.
What does load average mean?
The average number of processes running or waiting. A load roughly equal to the number of CPU cores means the system is fully busy.