Processes, services & packages · Prasanta Kumar Behera

See what's running and stop what shouldn't be: processes and PIDs, ps and top, signals and kill, starting and enabling services with systemctl, and installing software with apt or dnf.

Programs vs processes

A program is a file on disk (/usr/sbin/nginx). A process is a running copy of it, with its own PID (process ID), memory, open files and owner. Every process has a parent. On modern systems the ancestor of everything is PID 1, systemd.

A recipe book is the program. Each time a cook actually cooks from it, that's a process, with a ticket number (the PID). The head chef (systemd, ticket number 1) hires cooks, notices when one walks out, and hires them again if told to.

Seeing processes

$ ps aux --sort=-%mem | head -5
USER       PID %CPU %MEM    VSZ   RSS TTY  STAT START   TIME COMMAND
mysql     1123  1.2 18.4 2519372 745820 ?  Ssl  08:01   2:13 /usr/sbin/mysqld
www-data  1488  0.3  2.1  215004  86212 ?  S    08:02   0:21 nginx: worker process
root         1  0.0  0.3  167740  13220 ?  Ss   08:00   0:03 /sbin/init

Column	Meaning
`PID`	Process ID
`%CPU`, `%MEM`	Share of CPU and RAM
`RSS`	Real memory in use (KiB)
`STAT`	State: `R` running, `S` sleeping, `D` waiting on I/O (can't be interrupted), `Z` zombie
`COMMAND`	What's running

top (or the friendlier htop) shows the same live. In top, press M to sort by memory, P by CPU, 1 for per-CPU usage, q to quit.

Signals: asking processes to stop

$ pgrep -a sleep
4821 sleep 1000
$ kill 4821          # SIGTERM (15): "please finish and exit"
$ kill -9 4821       # SIGKILL (9): immediate, no clean-up
$ kill -HUP 1488     # SIGHUP: many daemons reload their config on this

Always try SIGTERM first. It lets a database flush data or a web server finish requests. Kubernetes does exactly this: SIGTERM, a grace period, then SIGKILL.

Services with systemctl

Long-running background programs (services or daemons) are managed by systemd:

$ systemctl status nginx
● nginx.service - A high performance web server and a reverse proxy server
     Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; preset: enabled)
     Active: active (running) since Sat 2026-09-27 08:02:11 UTC; 1h 12min ago
   Main PID: 1487 (nginx)
...
$ sudo systemctl restart nginx
$ sudo systemctl enable --now nginx     # start now + at boot
$ sudo systemctl disable --now nginx    # stop now + not at boot

start/stop affect now; enable/disable affect boot. Lesson 07 goes deep on systemd and journald.

Installing software

Family	Refresh lists	Install	Remove	Search
Debian / Ubuntu	`sudo apt update`	`sudo apt install -y pkg`	`sudo apt remove pkg`	`apt search word`
RHEL / Rocky / Fedora	(automatic)	`sudo dnf install -y pkg`	`sudo dnf remove pkg`	`dnf search word`

$ sudo apt update && sudo apt install -y nginx
$ dpkg -L nginx | head     # which files did it install?
$ apt list --upgradable    # what could be upgraded?

Where did it put things?

Packages follow conventions: binaries in /usr/bin or /usr/sbin, config in /etc/<name>, logs in /var/log/<name>, data in /var/lib/<name>, and a systemd unit in /usr/lib/systemd/system/. Knowing this, you can find almost anything about a new service in a minute.

Try it: install, break and recover a service

Install nginx; check systemctl status nginx and curl -I http://localhost.
Find its processes with pgrep -a nginx. Which one is the parent (master)?
sudo kill -9 the master process. What does systemctl status say now? Does nginx come back by itself? (Look at Restart= in systemctl cat nginx.)
Start it again, then disable it and reboot (on a VM). Is it running? enable --now it again.
Start sleep 1000 &, find it with pgrep, and stop it politely with kill.

Going deeper: processes under the hood

/proc/<pid>/ exposes everything about a process: cmdline, environ, status, open files in fd/, limits in limits. ls -l /proc/1487/fd shows what nginx has open.
D state (uninterruptible I/O wait) can't be killed, even with -9, until the I/O completes. Lots of D-state processes usually mean storage or NFS trouble (lesson 10).
Zombies (Z) are finished processes whose parent hasn't collected their exit status. They use no memory, but many of them point at a buggy parent. In containers, a proper init process (tini, or shareProcessNamespace) reaps them.
nice/renice change CPU priority; ionice changes I/O priority. Useful for backups on busy servers.

Recap

A process is a running program with a PID and a parent; systemd is PID 1.
ps aux, top/htop, pgrep to see; kill (SIGTERM) before kill -9 (SIGKILL).
systemctl status/start/stop/restart; enable = at boot, --now = also right now.
apt on Debian/Ubuntu, dnf on the RHEL family; know where packages put binaries, config, logs and data.

This site is a public version of my personal engineering knowledge hub. It intentionally excludes confidential company information and internal operational details.