How to Check and Manage Running Processes on a Linux VPS

When you’re managing a Linux VPS, knowing what’s running on your server isn’t just helpful – it’s essential. Whether you’re tracking down performance issues, investigating security concerns, or just keeping tabs on resource usage, you need a reliable way to list processes on Linux. This is a fundamental skill for any system administrator, as it gives you the visibility needed to keep your applications running smoothly. This guide walks you through the core tools and safe practices for monitoring processes across common Linux distributions like Ubuntu, Debian, and CentOS.

You’ll learn how to use commands like top, ps, htop, atop, and pstree to get both real-time and snapshot views of what’s happening on your system. More importantly, we’ll cover how to act on what you find without accidentally disrupting critical services. By the end, you’ll have a reliable workflow for process monitoring and management that works whether you’re troubleshooting a sudden spike in CPU usage or conducting routine security checks.

What are Processes in Linux?

Linux processes are the fundamental units of execution on your server. Every program, command, or background service running on your system exists as one or more processes. Each process is assigned a unique Process ID (PID) by the kernel, which you’ll use to identify and manage it. Processes also run with specific user permissions, memory allocations, and CPU priority settings. Understanding this structure helps you make informed decisions about which tasks to investigate, modify, or terminate.

Processes are organized in parent-child relationships. The first process started by the kernel, with PID 1, is the ancestor of all other processes. On modern systems, this is usually systemd. When a service like Apache or Nginx starts, it typically spawns child processes to handle individual user requests. System processes, also known as daemons, are managed by systemd and are configured to restart automatically if they fail. User processes, in contrast, are tied to the session that created them. This distinction is critical when you decide how to manage a problematic process safely.

The tools you’ll use most often – ps, top, htop, pstree – each show different aspects of this process landscape. The ps command gives you detailed snapshots, top provides real-time monitoring, htop adds interactive controls, and pstree reveals the parent-child structure clearly. You’ll also use the systemctl command to manage services properly instead of just killing their PIDs directly.

To ensure safe operations, always connect to your server via SSH access with a non-root user account, then use sudo for administrative tasks. This approach reduces the risk of accidentally damaging critical system processes and provides a clear audit trail of the commands you’ve run.

Linux Top Command

The Linux top command is your go-to tool for real-time process monitoring directly from the terminal. When you run top, it presents a dashboard that updates every few seconds, showing system-wide statistics at the top and a list of the most resource-intensive processes below. Mastering the top command syntax and its interactive features turns it from a simple viewer into a powerful diagnostic tool.

The header provides a wealth of information. You’ll see the system’s uptime, the number of logged-in users, and the load average, which indicates CPU demand over the last 1, 5, and 15 minutes. The CPU line shows how the processor’s time is being spent – common states include us (user), sy (system), ni (niced processes), id (idle), and wa (iowait). High wa time, for example, suggests your processes are waiting on slow disk I/O, not just consuming CPU cycles.

The process list below can be sorted and filtered interactively.

Press Shift+P to sort by CPU usage (the default).
Press Shift+M to sort by memory consumption.
Press u and enter a username to see processes owned only by that user.
Press d or s to change the update interval.

When you need to act on a process, top provides interactive controls. Press k to kill a process – you’ll be prompted for the PID and the signal to send. Always start with signal 15 (SIGTERM) for a graceful shutdown, or signal 2 (SIGINT) to interrupt it cleanly. Only use signal 9 (SIGKILL) as a last resort, as it forces termination without allowing the process to clean up files or connections properly. Always verify the PID before sending any signal to prevent costly mistakes that could bring down critical services.

Linux `ps` Command

The Linux ps command captures a static snapshot of running processes, giving you detailed information that doesn’t change while you’re analyzing it. Unlike the real-time view of top, ps shows you exactly what was running at the moment you executed the command. This makes it ideal for scripting, logging, or when you need to examine process details carefully without the screen constantly refreshing.

A common and powerful invocation is ps aux.

The a flag shows processes from all users.
The u flag provides a user-oriented output format with detailed columns.
The x flag includes processes not attached to a terminal, such as background daemons.

You can pipe this output through grep to find specific processes, for example, ps aux | grep nginx will show all Nginx-related processes. However, be aware that the grep command itself will often appear in the results. A more precise way to find a process is with the pgrep command: pgrep -af nginx shows the PIDs and full command lines for all matching processes without including itself.

For more control over the output, use the -o or --format flags to specify exactly which columns you want to see. This is incredibly useful for targeted analysis. For instance, to find the top 10 processes by memory usage:

ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%mem | head

This command shows the Process ID (pid), Parent Process ID (ppid), the command (cmd), and memory/CPU percentages, sorted with the highest memory consumers first. Understanding the process status (STAT) column is also helpful. Common codes include R (running), S (interruptible sleep), D (uninterruptible sleep, often waiting on I/O), and Z (zombie, a terminated process whose parent hasn’t collected its exit status).

Linux `htop` Command

The Linux htop command is a significant upgrade over top, offering a colorful, interactive interface that makes process management more intuitive and efficient. If it’s not pre-installed on your system, you can easily add it with sudo apt install htop on Ubuntu/Debian or sudo yum install htop (or sudo dnf install htop) on CentOS/RHEL distributions.

From the moment you run htop, you’ll notice the difference. It displays individual usage bars for each CPU core, making it easy to spot an unbalanced workload. The color-coded bars for CPU, memory, and swap usage provide immediate visual feedback on your system’s health. You can navigate the process list with arrow keys and use your mouse to click on items.

Function keys provide shortcuts to powerful features:

F5: Toggles the tree view, showing parent-child process relationships in real time.
F3: Searches for processes by name.
F6: Sorts the process list by different columns like CPU, memory, or PID.
F9: Sends a signal to a highlighted process, presenting a user-friendly menu of common signals.
F2: Opens the setup screen, where you can customize the displayed columns, color schemes, and other options.

While htop makes it easy to manage processes, exercise caution with its features, especially when changing priority or CPU affinity. Pressing F7 and F8 adjusts a process’s priority (its “nice” value), which can help tune performance but may destabilize your system if you lower the priority of a critical service. Always test such changes on non-production systems first and have a clear rollback plan.

Linux `atop` Command

The Linux atop command goes beyond basic process monitoring to provide comprehensive, system-wide resource accounting. After installing it with your package manager (sudo apt install atop or sudo yum install atop), running atop reveals a detailed breakdown of CPU, memory, disk, and network usage alongside the familiar process list.

What truly sets atop apart is its ability to record and replay historical data. By enabling the atop logging service (sudo systemctl enable --now atop), you can capture system activity in snapshots, typically every 10 minutes. This allows you to investigate performance incidents long after they’ve occurred. To review a log file, you use a command like atop -r /var/log/atop/atop_YYYYMMDD.

Navigating atop is done with single-key commands:

p: Shows process-level details (the default view).
m: Displays memory usage information.
d: Shows disk I/O activity.
n: Presents network statistics for each process.
g: Returns to the generic, overall system stats view.

While historical logging is incredibly valuable for troubleshooting, be mindful of the overhead on a resource-constrained VPS. The atopacctd service consumes some CPU and disk I/O to record data. You may want to enable it selectively during problem investigations or configure it to record at longer intervals to minimize its impact.

Linux `pstree` Command

The Linux pstree command is a specialized tool that excels at one thing: visualizing parent-child process relationships in a clear, easy-to-read tree format. This helps you understand how processes are spawned and how they relate to each other, which is important for identifying the root cause of issues. Simply run pstree to see the complete process hierarchy starting from init or systemd (PID 1).

To make the output more useful, add flags to include more detail:

pstree -p: Shows the Process ID (PID) in parentheses next to each process name.
pstree -a: Displays the full command-line arguments for each process.
pstree -u: Shows username transitions, highlighting where a process drops privileges (e.g., httpd(root)-+-httpd(www-data)).

Combining these flags, pstree -pau, gives you a comprehensive view that is perfect for diagnostics. When you spot a runaway process spawning dozens of children, pstree helps you identify the original parent process. This ensures you terminate the source of the problem rather than wasting time killing individual child processes that will just be respawned.

For real-time monitoring of process trees, you can combine pstree with the watch command. For example, watch pstree -p will refresh the process tree every two seconds, allowing you to observe how services start up or shut down in real time. This is a great way to verify that a service restart command behaved as you expected.

How to Manage Processes on a Linux VPS

To manage Linux processes safely and effectively, follow a structured workflow: observe the system, decide on a course of action, act with caution, and verify the result. This methodical approach prevents most accidents and ensures you can recover quickly if something goes wrong.

Observe: Start by gathering information. Use top or htop to identify resource-intensive processes. Once you spot a potential issue, use ps aux | grep processname or pgrep -af processname to get detailed information about it. Determine if the process is part of a managed service with systemctl status PID.
Decide: Before acting, determine the best course of action. If the process belongs to a service like Nginx or MySQL, you should use the systemctl command to manage it. This ensures a graceful shutdown and proper restart. If it’s a standalone script or a runaway user process, direct termination with kill might be appropriate.
Act: For system services, use commands like sudo systemctl stop servicename, sudo systemctl start servicename, or sudo systemctl restart servicename. When you must use the kill command, always start with gentle signals. kill -15 PID (SIGTERM) requests a graceful shutdown. If that doesn’t work after a few moments, use kill -9 PID (SIGKILL) as a last resort.
Verify: After taking action, confirm the result. Check that the process has actually terminated with ps aux | grep PID. Use systemctl status servicename to ensure a service restarted correctly. Review logs with journalctl -u servicename -f to check for any errors during startup or shutdown.

Always schedule disruptive process management during maintenance windows when possible. Keep configuration backups current and test your procedures on staging systems before running them in production. For persistent resource issues, investigate using nice to lower a process’s CPU priority or cgroups to set hard limits on its resource consumption. All these actions should be performed over a secure SSH access connection.

Linux Processes FAQ

How do I check running processes on Linux via SSH?

After you check running processes via SSH by connecting with ssh username@your-server-ip, you can immediately use commands like ps aux for a complete snapshot or top for a real-time view. These are standard tools available on virtually every Linux system.

What’s the difference between `top`, `htop`, and `atop`?

top is the classic, universally available real-time monitor. htop is a more user-friendly alternative with color-coding, mouse support, and easier navigation. atop is a more advanced tool focused on system-wide resource accounting and historical logging, making it ideal for in-depth performance analysis.

How do I find which process is using a port?

Use the ss command: sudo ss -ltnp | grep :PORT (e.g., :80 or :443). This will show you which process is listening on that specific port, including its PID and name.

What is a zombie process and how do I fix it?

A zombie process (Z state in ps) is a terminated process whose entry remains in the process table because its parent has not yet “reaped” it by reading its exit status. Zombies consume almost no resources, but a large number can indicate a problem with the parent application. You can’t kill a zombie directly; you must kill or restart its parent process.

What if `ps`/`top` show high CPU but the server feels idle?

Look closely at the CPU states in top. High iowait (wa) means the CPU is waiting for disk I/O, indicating a storage bottleneck. On a Linux VPS, you should also check for “steal time” (st). High steal time means the hypervisor is allocating CPU cycles that belong to your VPS to other virtual machines on the same host.

Conclusion

Effective process management comes down to building consistent habits around observation, careful decision-making, and safe execution. Start every investigation by gathering information with ps, top, or htop before you intervene. When you must act, always prefer graceful methods like using systemctl for managed services or sending the SIGTERM signal before resorting to SIGKILL.

The tools covered here – top, ps, htop, atop, and pstree – each provide a unique window into your system’s operations. By using them together, you gain complete visibility into what’s running, why it’s consuming resources, and how different processes relate to each other. Regular monitoring helps you establish a baseline for normal operation, allowing you to catch problems earlier and resolve them faster.

Ultimately, mastering process management is a key part of maintaining a healthy and reliable Linux VPS. By combining good process hygiene with regular system updates and security monitoring, you can ensure your applications run smoothly and efficiently, giving you the peace of mind to focus on your core business.