🐧
Linux Process Lab
Beginner-friendly • Visual • Hands-on

Linux Processes & the ps Command

Learn what a Linux process is, how parent/child processes work, how to read ps output, and how to investigate real-world CPU, memory, and stuck-process situations.

Start hands-on labs Try command simulator Open cheat sheet
Choose a topic and play. The coach will ask a checkpoint question after narration.
🎧
Trainer validation idea: first let learners explain the section in their own words, then play the voice-over to confirm what was correct and what they missed.
PIDProcess identity card
PPIDParent process ID
STATCurrent process state
Linux Process City Animated illustration showing kernel, scheduler, memory, and running processes. Kernel Scheduler CPU traffic cop Memory PID 2481 sleep zombie? Programs become processes when Linux starts running them.

Voice-over learning coach

Use these short narrated explanations after each concept. The goal is not just to listen, but to validate: “Can I explain this correctly without looking?”

🎙️ Listen + Validate
🧠 Concept

What is a process?

A simple explanation of running programs, PID, PPID, and why Linux tracks processes.

🔄 Lifecycle

Running, sleeping, zombie

Explains why processes move between states and why not every strange state is automatically a problem.

🧪 Labs

How to validate labs

Guides learners on checking expected output instead of blindly copying commands.

1. Predict
Before running a command, say what you expect to see.
2. Run
Execute the command and compare with the expected output.
3. Explain
Explain PID, PPID, STAT, CPU, memory, and command in plain English.

Interactive understanding checkpoint

After every voice-over, the coach asks a small question. Learners can mark “I understood,” ask for a repeat, or request a different analogy. This validates whether the concept landed instead of assuming listening means learning.

🎮 Creative idea 1

Add “process detective missions” where learners investigate slow CPU, high memory, zombie process, and wrong-user scenarios.

🧠 Creative idea 2

Add tiny memory hooks: PID = identity card, PPID = parent, STAT = mood, COMMAND = job description.

🧪 Creative idea 3

Add validation badges for learners who can predict, run, compare, and explain command output correctly.

1) What is a Linux process?

A process is a running program. When you open a terminal, run ls, start nginx, or launch Firefox, Linux creates one or more processes.

🧠 Core concept
🪪

The process identity card

Think of Linux as a busy office. Every running task gets an ID card called a PID. If one task starts another task, the starter is the parent and the new task is the child. That parent is tracked using PPID.

P

PID

Process ID. Unique number for a running process.

PP

PPID

Parent Process ID. Shows who started this process.

U

USER

The Linux user account that owns the process.

S

STAT

Short code showing whether the process is running, sleeping, stopped, or zombie.

2) Process lifecycle: from start to finish

A process does not always run continuously. It may run, wait, sleep, stop, or finish. This is normal.

✨ Animated map
🌱

New

A command or application starts.

🏃

Running

CPU is actively executing it.

😴

Sleeping

Waiting for input, network, disk, timer, or event.

✋

Stopped

Paused by signal or job control.

👻

Zombie

Finished, but parent has not collected exit status yet.

Beginner note: Sleeping processes are not automatically bad. Most healthy systems have many sleeping processes because services often wait for work.

3) Process state codes in ps

The STAT column gives a quick health clue. Learn these five first.

🔎 Read STAT
R

Running

Running now or ready to run.

S

Sleeping

Waiting normally. Very common.

D

Uninterruptible sleep

Usually waiting on disk or I/O. Investigate if stuck.

T

Stopped

Paused by signal or terminal job control.

Z

Zombie

Already exited, but parent has not cleaned it up.

4) Understanding the ps command

ps gives a snapshot of processes at that moment. It is like taking a photo of system activity.

📸 Snapshot tool

ps versus top

ps shows a one-time snapshot. Use it when you want a clear command output you can filter, sort, copy, or save.

top shows live updating activity. Use it when you want to watch processes changing in real time.

Three beginner commands to remember

  • ps — current terminal processes
  • ps aux — all processes, BSD style
  • ps -ef — all processes, full Unix style

5) Interactive ps command simulator

Click a command. Watch sample output and read when to use it.

🧪 Try it
terminal

        

        

      


      

        

          

            
6) Anatomy of ps aux output

            
Click a column name to understand it. This removes the fear from large process output.

          

          🧩 Output decoder
        

        

          
sample ps aux

          
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root           1  0.0  0.2 168420 13520 ?        Ss   09:10   0:03 /sbin/init
jp          2417  2.8  3.4 952400 182140 ?       Sl   10:22   1:11 firefox
jp          3152  0.0  0.0   8784  3328 pts/0    R+   10:31   0:00 ps aux

        

        

          
          
          
          
          
          
          
          
        

        

      


      

        

          

            
7) Parent and child processes

            
Process trees help you answer: “Who started this process?” and “What will be affected if I stop it?”

          

          🌳 Process tree
        

        

          

            

              systemd PID 1
              

                sshd PID 925
                

                  bash PID 2280
                  
ps PID 3152

                

              

              

                cron PID 731
                
backup.sh PID 3901

              

              

                nginx PID 1040
                
worker PID 1041

                
worker PID 1042

              

            

          

          

            
Command to see a tree

            
$ ps -ef --forest

            
Look at the PPID column. A child process points back to the PID of its parent process.

            
Real use case: If an application started many child processes, stopping the parent may also affect the children. Always inspect the tree before killing processes in production.

          

        

      


      

        

          

            
8) Real-world process investigation stories

            
These are the practical situations beginners actually face on Linux servers and laptops.

          

          🕵️ Process detective
        

        

          
🔥
CPU fan is loud
Find top CPU users.
ps aux --sort=-%cpu | head

          
🐘
Memory is getting full
Find top memory users.
ps aux --sort=-%mem | head

          
🧵
Need to find a service
Search by process name.
ps -ef | grep ssh

          
👨‍👦
Who started this?
Show PID, PPID, state, and command.
ps -o pid,ppid,stat,etime,cmd -p PID

        

      


      

        

          

            
9) Hands-on labs: beginner-safe practice

            
Run these on Ubuntu, Rocky Linux, RHEL, Fedora, Debian, or most modern Linux systems. No destructive command is used.

          

          ✅ Practice
        

        

          
Lab progress: 0/10

          

        


        
Lab 1: See processes attached to your terminal basic
ps
Expected: You usually see your shell such as bash or zsh and the ps command itself.

        
Lab 2: Show full details for terminal processes
ps -f
Expected: More columns such as UID, PID, PPID, STIME, and CMD.

        
Lab 3: Show all processes in full format
ps -ef | head
Expected: A system-wide list. The first lines often include root processes and PID 1.

        
Lab 4: Show all processes with CPU and memory
ps aux | head
Expected: Columns like %CPU, %MEM, VSZ, RSS, STAT, and COMMAND.

        
Lab 5: Find top CPU consumers
ps aux --sort=-%cpu | head
Expected: Highest CPU processes appear near the top after the header.

        
Lab 6: Find top memory consumers
ps aux --sort=-%mem | head
Expected: Highest memory processes appear near the top after the header. Check %MEM and RSS.

        
Lab 7: Show processes owned by your user
ps -u "$USER"
Expected: Processes owned by your current login user.

        
Lab 8: Inspect PID 1
ps -p 1 -f
Expected: On most modern distributions, PID 1 is systemd. Some containers may show a different PID 1.

        
Lab 9: Start a background process and inspect it
sleep 300 &
ps -o pid,ppid,stat,etime,cmd -p $!
Expected: You see the sleep 300 process with its PID, PPID, state, elapsed time, and command.

        
Lab 10: Clean up the background process safely
kill $!
ps -p $!
Expected: After killing it, ps -p $! should normally show no process row for that PID.
Careful: In real systems, always inspect a process before killing it. Do not kill unknown production processes casually.

      


      

        

          

            
10) Mini game: spot the process problem

            
Read the table and choose the suspicious process. This trains your troubleshooting eyes.

          

          🎮 Quick game
        

        

          

            
USERPID%CPU%MEMSTATCOMMAND

            
              
root10.00.2Sssystemd

              
jp24011.22.1Slfirefox

              
app391096.48.4Rpython data_import.py

              
root10500.10.4Ssshd

            
          

          

            
            
            
            
          

          
Which process would you investigate first?

        

      


      

        

          

            
11) Quick quiz

            
Small checks, big retention. Click an answer and get instant feedback.

          

          📝 Self-check
        

        

          
What does PID mean?

          
Which command shows all processes with CPU and memory?

          
What does state Z usually mean?

        

      


      

        

          

            
12) Flashcards

            
Hover or tap a card to reveal the answer.

          

          🃏 Memory cards
        

        

          
PID
Unique process number.

          
PPID
PID of the parent process.

          
ps
Snapshot of process activity.

          
STAT S
Sleeping / waiting normally.

        

      


      

        

          

            
13) Beginner cheat sheet

            
Use this during labs or troubleshooting.

          

          ⚡ Quick revision
        

        

          

            
Useful ps commands

            
    
              
  • psShow current terminal processes.
    • 
              
  • ps -fShow full format for current terminal processes.
    • 
              
  • ps -efShow all processes in full format.
    • 
              
  • ps auxShow all processes with CPU and memory columns.
    • 
              
  • ps -p PID -fShow details for one process ID.
    • 
              
  • ps -u USERShow processes owned by a user.
    • 
              
  • ps aux --sort=-%cpuSort by highest CPU first.
    • 
              
  • ps aux --sort=-%memSort by highest memory first.
    • 
            

          

          

            
Troubleshooting pattern

            
    
              
  • IdentifyFind PID, user, command, CPU, memory.
    • 
              
  • UnderstandCheck parent process and process state.
    • 
              
  • ConfirmVerify whether it is expected or abnormal.
    • 
              
  • ActRestart service or kill process only when safe.
    • 
            

            
Production habit: Before taking action, capture evidence: ps -ef, ps aux --sort=-%cpu | head, and relevant service logs.

          

        

      


      

        
14) Beginner doubts answered
Clear answers to common confusions.

        
Why does ps show itself?
Because when you run ps, that command becomes a process too. It appears briefly while it is collecting and printing process information.

        
Is a sleeping process bad?
No. Sleeping usually means the process is waiting for something. Many healthy services spend most of their time sleeping.

        
Why do I see many processes owned by root?
System services often run as root or service users because they manage core operating system functions.

        
Should I kill high CPU processes?
Not immediately. First identify what the process is, who owns it, what started it, and whether it is expected work. Killing blindly can break services or lose data.