PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Use ps when you need a reliable snapshot, top when you need to watch processes change, kill when you need to send a signal to a specific process, and systemctl when that process belongs to a systemd-managed service. Choosing the right tool prevents accidental termination and preserves the service manager’s restart, dependency and logging context.
This guide explains what each command does, how to combine them into a safe workflow, and how to recover when a process will not stop or a service immediately comes back.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →
How Linux processes are managed
A Linux process is a running instance of a program. The kernel assigns it a process ID (PID), tracks its parent process, user, resource use and state, and schedules it for CPU time. Processes may be launched from a shell, by another process, or by a service manager.
Linux process management has two separate concerns:
#1 Best Overall
- Observation: finding processes and understanding what they are doing.
- Control: asking a process to exit, forcing it to stop when necessary, or changing the lifecycle of the service that owns it.
ps, top, kill and systemctl overlap only slightly. The table below shows the practical distinction.
| Tool | View | Primary target | Action | Best use |
|---|---|---|---|---|
ps |
Point-in-time snapshot | Selected PIDs, users, terminals or commands | Reports information only | Repeatable listings, filtering and recording evidence |
top |
Dynamic real-time display | Changing task activity | Interactive monitoring, with optional signals | Watching CPU, memory, load and process state |
kill |
No process view by itself | A PID or process group | Sends a signal | Graceful termination or carefully chosen escalation |
systemctl |
Unit and manager state | Systemd units and their processes | Service lifecycle operations or unit-scoped signals | Stopping, restarting and diagnosing managed services |
See a stable process list with ps
The Linux man-pages project defines ps as reporting “a snapshot of the current processes.” Because the output does not continuously refresh, it is suitable for scripts, incident notes and before-and-after checks.
List the processes you can see
Run:
psThis normally shows processes associated with the current terminal. To display every process in a full, conventional listing, use:
ps -efThe exact columns depend on the implementation and options, but a full listing commonly includes the user, PID, parent PID, start information, terminal, CPU time and command. The command shown may be truncated or may omit arguments, so use a custom format when you need an unambiguous record.
Inspect one PID with useful columns
Replace PID with the number you are investigating:
ps -p PID -o pid,ppid,user,stat,pcpu,pmem,cmdThis asks for the process ID, parent process ID, account, state, CPU percentage, memory percentage and command line. Recording the parent PID is important: stopping a child while leaving its supervisor alive may result in an immediate restart.
Find a command or owner
Use a broad listing and filter it with a pager or text-search utility:
Free tools Windows power users keep installed
One-click scans. No signup required.
ps -ef | grep '[n]ame'The bracket pattern prevents the search command itself from appearing as a match. For a user-focused view, use:
ps -u username -fFor repeatable automation, prefer ps with explicit selection and output options rather than parsing a hand-formatted interactive display.
Understand common state indicators
The STAT field can contain a primary state and modifiers. A running or runnable process is commonly shown with R; sleeping processes often show S; stopped processes can show T; and a zombie can show Z. A zombie has already terminated but still has an exit record waiting for its parent to collect. Sending another termination signal to a zombie does not make it disappear; the parent must reap it, or the parent itself must be corrected.
Watch changing behavior with top
The top manual describes a “dynamic real-time view” of running tasks. It repeatedly refreshes summary information and a task list, making it the right choice when a process spikes, leaks memory or changes state over time.
Start and navigate top
topThe upper area summarizes load, CPU activity, memory and (on systems that expose it) swap. The lower area lists tasks and their resource use. Press h inside top to display the help screen; press q to quit.
Common interactive actions include:
Psorts by CPU use.Msorts by resident memory use.1expands CPU information to individual logical CPUs on implementations that support it.kprompts for a PID and signal, allowing a signal to be sent from the display. Treat this as an administrative action, not merely a viewing shortcut.
Key bindings and available fields vary by version, so use the built-in help on the host you are administering.
Narrow monitoring to a PID
When you already know the process, request a focused display:
top -p PIDThis removes unrelated tasks and makes changes in CPU, memory or state easier to correlate. You can start with ps to identify the PID, then use top -p to observe it before taking action.
Read top without misdiagnosing load
High CPU percentage identifies a consumer, not necessarily a fault. A short-lived compilation, backup or batch job may be expected. Check whether usage is sustained, whether memory is approaching exhaustion, and whether the process belongs to a service with an established maintenance window. A process in uninterruptible sleep may be waiting on kernel or device I/O; repeatedly sending signals will not resolve a blocked device operation.
Stop a standalone process safely with kill
kill is a signal interface, not an unconditional delete operation. Its manual states: “The command kill sends the specified signal to the specified processes or process groups.” If no signal is specified, TERM is sent.
Send the normal termination request
After confirming the PID and owner, run:
kill PIDTERM asks the program to terminate normally. A well-behaved program can close files, flush data, remove temporary state and perform its own shutdown work. Wait briefly, then verify the result:
ps -p PID -o pid,ppid,user,stat,cmdIf the command produces no process row, the process has exited. If it remains, determine whether it is handling cleanup, ignoring the signal, or blocked in the kernel.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Escalate only when normal termination fails
You can name a signal explicitly:
kill -HUP PID
kill -INT PID
kill -KILL PIDThe appropriate signal depends on the application. HUP is commonly used by daemons that document configuration reload behavior; it is not a universal restart command. INT resembles an interrupt from a terminal. KILL cannot be caught or cleaned up by the target. It ends the process immediately, so unsaved data, locks, temporary files and partially written output may remain. Use it only after checking that a normal request is ineffective and that the operational risk is acceptable.
Target a process group carefully
A negative PID can address a process group rather than one process:
kill -TERM -PGIDDo not substitute a random negative number. Confirm the process group ID first and understand which jobs share it. A group signal can terminate multiple related commands.
Rank #4
Handle permission errors
A user normally may signal processes it owns. Signaling another user’s process generally requires appropriate privileges. If you receive “Operation not permitted,” verify the account, PID and scope before using elevated privileges. Do not use a privileged signal merely to bypass uncertainty about the target.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteManage services with systemd and systemctl
On systems that use systemd, the systemd manual describes it as “a system and service manager for Linux operating systems.” When started as PID 1, it acts as the init system that brings up and maintains userspace services. Systemd represents services and other resources as units, with dependencies and states.
systemctl is the control surface: it “may be used to introspect and control the state of the systemd system and service manager.” Use it when the process is part of a managed unit, because a direct signal changes only the current process while a unit operation preserves service lifecycle context.
Identify the unit and inspect its state
Check a known service:
systemctl status unit.serviceThe status output commonly shows whether the unit is loaded, enabled, active, its main PID, recent log lines and the latest transition. If you know only the PID, inspect the process with ps and look for its cgroup or service ownership, then query the corresponding unit.
List currently active service units with:
systemctl list-units --type=serviceUse the exact unit name shown by the host. A service may have a different name from its executable, and aliases can point to the same unit.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Stop, restart or start the service
- Stop gracefully:
sudo systemctl stop unit.service. This asks systemd to stop the unit and its managed processes according to the unit configuration. - Restart after a change or fault:
sudo systemctl restart unit.service. This performs a stop followed by a start and may briefly interrupt clients. - Start a stopped service:
sudo systemctl start unit.service. - Prevent automatic boot start:
sudo systemctl disable unit.service. This changes enablement, not the immediate running state.
After any operation, run systemctl status unit.service and verify the result with ps or top if resource behavior matters.
Use systemctl kill when a unit needs a signal
Systemd can select the processes associated with a unit for a kill operation. The scope may be the unit’s main process, control processes, the unit’s cgroup, or all processes, depending on the options supported by the installed version. For example:
Best Value
sudo systemctl kill --kill-who=main --signal=TERM unit.serviceChoose the narrowest scope that solves the problem. Killing the entire cgroup can include worker processes that are not obvious from the main PID. Consult systemctl kill --help on the host for accepted option names and defaults.
Choosing between kill and systemctl
| Situation | Preferred command | Reason |
|---|---|---|
| One command launched from a shell is stuck | kill PID |
There is no service lifecycle to preserve. |
| A daemon is running as a service | systemctl stop unit |
Systemd can stop the unit and track its state. |
| A service must be restarted after configuration work | systemctl restart unit |
The operation expresses the intended lifecycle transition. |
| The service’s main process is unresponsive but the unit must remain identifiable | systemctl kill with an explicit scope and signal |
The signal is unit-scoped rather than an untracked PID action. |
A process keeps returning after kill |
Inspect the owning unit, parent and restart policy | A supervisor may be intentionally recreating it. |
A safe investigation and shutdown workflow
- Observe a snapshot. Run
ps -ef, or useps -p PID -o pid,ppid,user,stat,pcpu,pmem,cmdfor a focused record. - Watch behavior. Start
top, sort by CPU or memory, and narrow to the PID withtop -p PIDwhen necessary. - Confirm identity. Check the command line, account, parent PID and whether the process is part of a systemd unit. Never act on a PID copied without rechecking it; PIDs can be reused.
- Choose the control layer. Use
kill PIDfor a standalone process. Usesystemctl statusand a unit operation for a managed service. - Request normal termination first. Send
TERMand allow the program to clean up. - Escalate deliberately. If it remains and the impact is understood, select a stronger signal or a unit-scoped operation. Avoid
KILLas a first response. - Verify and document. Re-run
ps,toporsystemctl status. Record the command, time, PID or unit and observed result.
Troubleshooting common outcomes
The process appears to ignore kill
Check its state with ps. A program may be handling TERM, or it may be blocked in uninterruptible I/O. Confirm that you signaled the correct PID and have permission. If it is a service, use the unit rather than repeatedly signaling a child process.
The process exits and immediately returns
A parent supervisor, including systemd, may restart it. Find the parent PID and inspect the unit with systemctl status. Stop or restart the unit, and review its configured restart behavior, instead of fighting each newly created PID.
Systemctl says the unit is inactive but a process remains
Recheck the PID and unit association. The process may be unrelated, left outside the unit’s cgroup, or in the middle of a transition. Use ps and the unit status together before sending a signal.
A zombie remains in the process list
A zombie is already dead; it cannot process another signal. Identify its parent with ps. The corrective action is to make the parent reap its child or, if appropriate, stop the faulty parent so a new supervisor can adopt and reap the child.
You stopped the wrong process
Stop further actions, record the PID and command used, and determine whether a service manager will recover it. If the process was a service, use its documented unit restart procedure. Review permissions and confirmation steps before repeating the operation.
Recommended Free Tools
Quick Recap
Key principles to remember
psanswers “what existed at this instant?”topanswers “what is changing right now?”killsends a selected signal to a PID or process group; it does not guarantee immediate deletion.systemctlchanges or inspects a systemd unit and keeps the service manager’s lifecycle model intact.- Always identify the owner, parent and management layer before escalating from a graceful request to a forceful action.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
