Linux › Module 6 › Lesson 1
Processes (ps, top, kill)
List and manage processes with ps, top, and kill
Opening
What is actually running?
Malware, miners, and rogue shells show up as processes. Legitimate admins use ps and top daily. kill stops runaway jobs. You cannot secure a box if you cannot see what it is doing.
1. ps — Process Snapshot
ps aux — all processes, detailed ps -ef — full format list ps aux | grep ssh — find ssh-related processes
2. top / htop — Live View
top — interactive CPU/memory view (q to quit) htop — friendlier UI (install with apt if missing) Watch for unknown processes eating 100% CPU—common miner sign.
3. kill — Stop a Process
kill PID — polite SIGTERM (ask to stop) kill -9 PID — force SIGKILL (last resort) killall processname — by name (use carefully)
Incident response
Before kill -9, note the PID, command line, and parent process. You may need that evidence—or the malware respawns from a parent you missed.
Knowledge Check
ps aux shows:
Multiple choice
Knowledge Check
kill -9 sends:
Multiple choice
Knowledge Check
High unexplained CPU in top might indicate:
Multiple choice