Linux processes cheat sheet

The chapter on one page: what to remember, the commands to have at your fingertips, and flashcards for quick revision.

The chapter in eight sentences

A process is a running program with a PID, a parent (PPID), an owner and a state; every process descends from systemd (PID 1).
A shell runs a command by forking a child and execing the program in it.
ps aux, ps -ef, pstree, pgrep and top show processes; STAT letters R, S, D, T and Z give their state.
A job belongs to one shell: & starts it in the background, Ctrl+Z pauses, bg and fg move it, and %N refers to it.
A closed terminal sends SIGHUP; nohup (or a service) keeps a job alive.
kill sends signals, 15 (TERM) by default; escalate to 9 (KILL) only after the polite request fails.
Preview with pgrep before using pkill; pkill -u USER ends everything a user runs.
Judge load by dividing the load average by the CPU count; change priority with nice and renice, and apply a tuned profile for workload-wide tuning.

Command	Does
`ps aux`, `ps -ef --forest`	All processes; with the tree
`ps -o pid,ppid,stat,ni,cmd -p PID`	Chosen columns for one process
`ps aux --sort=-%mem \| head`	Biggest memory users
`pstree -ps $`	Ancestors of your shell
`pgrep -a NAME`, `pgrep -u USER`	Find by name or owner
`top`, `uptime`, `free -h`, `nproc`	Live view, load, memory, CPUs

Command	Does
`cmd &`, `jobs`, `fg %N`, `bg %N`	Background, list, move
`Ctrl+Z`, `Ctrl+C`	Pause, interrupt
`nohup cmd &`	Survive a hangup
`kill PID`, `kill -9 PID`	Terminate, force
`kill -STOP PID`, `kill -CONT PID`	Pause, resume
`pkill NAME`, `pkill -u USER`, `killall NAME`	Many at once
`kill -l`	List signals (1 HUP · 2 INT · 9 KILL · 15 TERM · 18 CONT · 19 STOP)

Command	Does
`nice -n 10 cmd`	Start with lower priority (-20 to 19)
`renice -n 5 -p PID`	Change a running process
`tuned-adm list`, `active`, `recommend`	Inspect profiles
`tuned-adm profile NAME`	Switch profile

What are PID and PPID?: The process ID, and the ID of the process that started it (its parent).
How does a shell run an external command?: It forks a child copy, which execs the program; the shell waits and collects the exit status.
What do the ps STAT letters R, S, D, T, Z mean?: Running, sleeping, uninterruptible disk wait, stopped, zombie.
Two commands that list all processes?: ps aux and ps -ef (add --forest for the tree), or pstree.
Run a command in the background, list jobs, bring one back?: cmd & · jobs · fg %N
Pause the foreground job and continue it in the background?: Ctrl+Z, then bg
Which signal does kill send by default, and what is the last resort?: 15 (TERM). The last resort is kill -9 (KILL).
End all processes named foo, or owned by bob?: pkill foo · pkill -u bob
Preview what pkill would match?: pgrep -a PATTERN
How do you judge a load average?: Divide by the number of CPUs (nproc). About 1 per CPU is full.
Start a command with low priority, and change a running one?: nice -n 10 cmd · renice -n 15 -p PID
Show and set the performance profile?: tuned-adm active · tuned-adm profile NAME · tuned-adm recommend