LFCS 54 🐧 Viewing Processes — ps, top, htop - KandZ

⏱️ Estimated read: 12 min | |

Process viewing is the first skill of system troubleshooting. Before you can diagnose a slow server, a runaway service, or a memory leak, you need to see what is running, who owns it, and how much of the system’s resources it is consuming. Linux provides three tools that cover this need at different levels of interactivity: ps for a snapshot, top for a live view, and htop for an interactive, scrollable, and colorized live view. The LFCS exam places process management under the “Operations Deployment” domain, which carries 25% of the exam weight and explicitly requires you to “diagnose, identify, manage, and troubleshoot processes and services” .

The distinction between these tools is not cosmetic. ps produces a one-time snapshot of the process table, formatted according to the options you provide. It is the tool for scripts, for piping into grep, and for capturing the state of the system at a precise moment. top produces a continuously updating view, sorted by CPU usage by default, with a summary header that shows load average, memory usage, and CPU distribution. htop is a separate package that provides the same live view but with color, mouse support, vertical and horizontal scrolling, and the ability to kill processes without leaving the interface . Knowing when to use each is the difference between a command that answers your question and a command that floods your terminal.

Key point: ps is a snapshot, top is a live view, and htop is an enhanced live view with interactivity. ps aux and ps -ef are the two most common invocations for listing all processes. top sorts by CPU by default and provides a summary of load, memory, and CPU. htop is not installed by default on minimal systems and must be installed from the distribution’s repositories.

Why three tools exist for the same task

The scriptability problem. ps is designed to be scripted. Its output is deterministic, it does not require a terminal, and its options allow you to select exactly the columns you need. The -o flag allows a custom format, so a script can extract the PID, the CPU percentage, and the command name in a machine-readable layout . A monitoring script that runs every minute and logs the top CPU consumers cannot use top, because top is designed for interactive viewing and its output format is not stable across versions.

The real-time problem. ps shows the state of the process table at the moment it runs. It does not update. If a process spikes to 100% CPU for two seconds and then returns to idle, ps may miss it entirely. top updates every few seconds by default, and it shows the current CPU and memory usage of every process. It is the tool for watching a system in motion, for identifying which process is consuming resources right now .

The usability problem. top is functional but austere. It does not scroll with the mouse, it does not highlight the selected process, and its key bindings are not discoverable without reading the manual. htop addresses these usability gaps. It shows CPU usage as per-core bars, memory and swap as colored bars, and the process list with color-coded states. It allows scrolling, searching, filtering, and killing processes from within the interface . The cost is that htop is not installed by default on many minimal distributions, so a system administrator must know how to install it before relying on it.

a. `ps`: the snapshot

The ps command displays information about a selection of the active processes . Without options, it shows only the processes associated with the current user and the current terminal. The two most common invocations for a full system view are ps aux (BSD syntax) and ps -ef (Unix syntax). Both show every process on the system, but they use different column layouts.

# BSD syntax: shows USER, PID, %CPU, %MEM, VSZ, RSS, TTY, STAT, START, TIME, COMMAND
ps aux

# Unix syntax: shows UID, PID, PPID, C, STIME, TTY, TIME, CMD
ps -ef

The ps aux output includes the %CPU and %MEM columns, which are the percentage of CPU and memory the process is using. The STAT column shows the process state: R for running, S for sleeping, D for uninterruptible sleep, Z for zombie, and T for stopped. The RSS column shows the resident set size—the non-swapped physical memory the process is using, in kilobytes .

The ps -ef output includes the PPID column, which is the parent process ID. This is the column that allows you to trace a process back to the service or shell that started it. The STIME column shows the start time, and the CMD column shows the full command line, including arguments.

The -o flag allows a custom format. This is how a script extracts exactly the columns it needs, without parsing the default layout:

# Show only PID, user, CPU percentage, and command
ps -eo pid,user,pcpu,comm

# Sort by CPU percentage, descending
ps -eo pid,pcpu,comm --sort=-pcpu | head -10

The --sort flag is the tool for finding the top CPU or memory consumers in a script. --sort=-pcpu sorts by CPU percentage in descending order, and head -10 limits the output to the top ten. This is the ps equivalent of what top shows by default, but it is a snapshot rather than a live view.

b. `top`: the live view

top opens a full-screen interface that updates every few seconds. The top section shows the system summary: the current time, uptime, load average, the number of tasks, the CPU usage breakdown (user, system, nice, idle, iowait), and the memory and swap usage. The bottom section shows the process list, sorted by CPU usage by default .

# Start top with the default settings
top

# Start top showing only the processes of a specific user
top -u www-data

# Start top showing only processes that are consuming CPU (hide idle)
top -i

The interactive keys are the part that makes top usable. Pressing k prompts for a PID and a signal to send to that process, which is how you kill a runaway process without leaving the interface. Pressing u filters the process list by username. Pressing i toggles the display of idle processes. Pressing F opens the field selection screen, where you can add or remove columns and save the layout for your user account .

The load average is the number that requires interpretation. It is the average number of processes that are runnable or in uninterruptible sleep over the last one, five, and fifteen minutes. A load average of 1.0 on a single-core system means the CPU is fully utilized. A load average of 4.0 on a quad-core system means the same. A load average that is consistently higher than the number of cores indicates that processes are waiting for CPU time, which is a sign of saturation .

c. `htop`: the interactive view

htop is not installed by default on minimal RHEL or Debian systems. On Debian and Ubuntu, it is available in the default repositories and can be installed with apt install htop . On RHEL-based systems, it is available from the EPEL repository, which must be enabled first .

# Debian/Ubuntu: install htop
sudo apt update && sudo apt install htop

# RHEL/CentOS: enable EPEL and install htop
sudo yum install epel-release && sudo yum install htop

The interface is the difference. htop shows per-core CPU bars, so you can see whether the load is spread across cores or concentrated on one. The memory and swap bars are color-coded, with green for used memory, blue for buffers, and yellow for cache. The process list is color-coded by state and user, and it can be scrolled vertically and horizontally with the arrow keys. The function keys at the bottom provide the common actions: F3 for search, F4 for filter, F5 for tree view, F6 for sort, F9 for kill, and F10 for quit .

The tree view (F5) is the feature that top lacks entirely. It shows the parent-child relationships between processes, which is how you trace a service to the processes it spawned. When a web server forks worker processes, the tree view shows the workers indented under the parent, and the parent’s PID is visible as the PPID of the workers. This is the visual equivalent of the ps -ef column, but it updates live and can be navigated with the arrow keys.

The htop kill interface is also more discoverable than top‘s. F9 opens a menu of signals, with SIGTERM and SIGKILL as the common choices. The selected process is highlighted, so there is no risk of killing the wrong PID because you typed it incorrectly .

Complete Example Session

The following session demonstrates ps, top, and htop in sequence: finding a process with ps, watching it with top, and killing it with htop.

# ============================================
# PART 1: FIND THE PROCESS WITH PS
# ============================================
# List all processes, sorted by CPU usage
# The top entry is the process consuming the most CPU
ps -eo pid,user,pcpu,pmem,comm --sort=-pcpu | head -5

# Output example:
#   PID USER     %CPU %MEM COMMAND
#  1234 www-data 85.0  2.1 nginx
#  5678 root      3.0  0.5 sshd
#  9012 root      1.2  0.3 systemd

# ============================================
# PART 2: WATCH THE PROCESS WITH TOP
# ============================================
# Start top, filtering to the www-data user
top -u www-data

# In the interface:
# - The summary shows the load average and memory usage
# - The process list shows the nginx process at the top
# - Press 'q' to quit

# ============================================
# PART 3: KILL THE PROCESS WITH TOP
# ============================================
# In top, press 'k'
# Enter the PID from the ps output (1234)
# Press Enter to send SIGTERM (signal 15)
# The process disappears from the list

# ============================================
# PART 4: INSTALL AND USE HTOP
# ============================================
# Install htop on Debian/Ubuntu
sudo apt update && sudo apt install htop

# Start htop
htop

# In the interface:
# - F5: tree view to see parent-child relationships
# - F6: sort by CPU or memory
# - F9: kill the selected process
# - F10: quit

The four parts cover finding the process with ps, watching it with top, killing it from within top, and using htop for the interactive view. What the session demonstrates is that ps is the tool for the precise snapshot, top is the tool for the live view, and htop is the tool for the interactive investigation.

Quick Reference

`ps` Common Invocations

Command	Effect
`ps aux`	All processes, BSD format
`ps -ef`	All processes, Unix format
`ps -eo pid,pcpu,comm`	Custom columns
`ps -eo pid,pcpu --sort=-pcpu`	Sorted by CPU
`ps -u username`	Processes of a user
`ps -p PID`	Specific PID

`top` Interactive Keys

Key	Effect
`k`	Kill a process
`u`	Filter by user
`i`	Toggle idle processes
`F`	Field selection
`q`	Quit

`htop` Function Keys

Key	Effect
F3	Search
F4	Filter
F5	Tree view
F6	Sort
F9	Kill
F10	Quit

Process States

State	Meaning
`R`	Running
`S`	Sleeping
`D`	Uninterruptible sleep
`Z`	Zombie
`T`	Stopped

Best Practices

✅ Do This:

# Use ps for scripts and precise snapshots
ps -eo pid,pcpu,comm --sort=-pcpu | head -10

# Use top for real-time monitoring
top -u www-data

# Use htop for interactive investigation
htop

# Install htop on minimal systems
sudo apt install htop

❌ Don’t Do This:

# Parse top output in a script
top -b -n 1 | grep ... # format is not stable

# Use ps for real-time monitoring
ps aux # does not update

# Assume htop is installed
htop # command not found on minimal systems

Common Pitfalls

Pitfall	Why It Happens	Fix
`htop: command not found`	Not installed by default	`apt install htop` or EPEL
`ps` shows only own processes	Default selection	Use `aux` or `-ef`
`top` output not parseable	Designed for interactive use	Use `ps` for scripts
Zombie process visible	Parent has not reaped child	Investigate parent
Load average high but CPU idle	I/O wait or uninterruptible sleep	Check `%wa` in `top`

Real-World Examples

1. List all processes

ps aux

2. Find top CPU consumer

ps -eo pid,pcpu,comm --sort=-pcpu | head -5

3. Watch a specific user

top -u www-data

4. Hide idle processes

top -i

5. Kill from top

# Press k, enter PID, press Enter

6. Install htop

sudo apt install htop

7. Tree view in htop

# Press F5 in htop

8. Sort by memory in htop

# Press F6, select MEM%

9. Find parent PID

ps -ef | grep process_name

10. Check process state

ps -o pid,stat,comm -p PID

Visual

ps vs top vs htop

┌──────────────────────────────────────────────┐
│  PS                                          │
│  snapshot, scriptable, deterministic output  │
│         │                                    │
│         ▼                                    │
│  TOP                                         │
│  live view, summary header, sortable         │
│         │                                    │
│         ▼                                    │
│  HTOP                                        │
│  live view, color, mouse, tree, scrollable   │
└──────────────────────────────────────────────┘

top Header

┌──────────────────────────────────────────────┐
│  top - 12:00:00 up 10 days,  2:30,  3 users  │
│  Load average: 0.50, 0.75, 1.00              │
│  Tasks: 120 total,   2 running, 118 sleeping │
│  %Cpu(s):  5.0 us,  2.0 sy,  0.0 ni, 93.0 id │
│  MiB Mem :   8000 total,   2000 free         │
│  MiB Swap:   2000 total,   2000 free         │
└──────────────────────────────────────────────┘

htop Tree View

┌──────────────────────────────────────────────┐
│  PID  USER     CPU%  COMMAND                 │
│  1    root      0.0  /sbin/init              │
│  ├─ 500 root    0.0  /usr/sbin/sshd          │
│  │  └─ 1200 user 0.0  sshd: user             │
│  └─ 800 www-data 2.0 nginx: master           │
│     ├─ 801 www-data 0.0 nginx: worker        │
│     └─ 802 www-data 0.0 nginx: worker        │
└──────────────────────────────────────────────┘

Summary

Item	Value
Snapshot tool	`ps`
Live tool	`top`
Interactive tool	`htop`
All processes (BSD)	`ps aux`
All processes (Unix)	`ps -ef`
Sort by CPU	`ps -eo ... --sort=-pcpu`
top kill key	`k`
htop tree key	`F5`
htop install	`apt install htop`

Key takeaways:

ps is a snapshot. It shows the process table at the moment it runs, in a format that is stable and scriptable. ps aux and ps -ef are the two common full-system views .
top is a live view. It updates every few seconds, shows the system summary at the top, and sorts by CPU by default. It is the tool for watching resource consumption in real time .
htop is an enhanced live view. It adds color, per-core CPU bars, mouse support, scrolling, tree view, and a discoverable kill interface. It is not installed by default on minimal systems .
The ps -eo flag is for scripts. Custom columns and --sort allow a script to extract exactly the data it needs without parsing the default layout.
The load average is relative to core count. A load of 4.0 on a quad-core system is fully utilized; on a single-core system, it is four times oversubscribed .
htop tree view traces parent-child relationships. It is the live equivalent of the PPID column in ps -ef, and it is the fastest way to see which service spawned a set of worker processes.

Remember: ps, top, and htop are not alternatives to each other. They are different views of the same process table, designed for different tasks. Use ps when you need a precise snapshot for a script or a single command. Use top when you need a live view on a system where htop is not installed. Use htop when you need to investigate interactively, scroll through a long process list, or trace a process tree. The LFCS exam expects you to know all three, because the objective is to “diagnose, identify, manage, and troubleshoot processes and services” , and no single tool covers every part of that task.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!