Processes & Services (systemd)
Inspect running processes and manage long-running services with systemd.
A process is a running program with a unique PID. You inspect them with ps,
top, or htop, and control them with signals sent via kill. The two you
use most: SIGTERM (15, polite “please stop”) and SIGKILL (9, forceful and
uncatchable).
Long-running background services are managed by systemd on modern Linux.
Services are defined as units (.service files) and controlled with
systemctl. Their logs go to the journal, read with journalctl.
systemctl start/stop/restart <svc>— control nowsystemctl enable/disable <svc>— control at bootsystemctl status <svc>— see state + recent logs
ps aux --sort=-%cpu | head # top CPU consumers
pgrep -a nginx # find a process by name
kill 4821 # SIGTERM (graceful)
kill -9 4821 # SIGKILL (force)
sudo systemctl status nginx # is it running? recent logs
sudo systemctl restart nginx # restart it
sudo systemctl enable --now nginx # start now AND at boot
journalctl -u nginx -f # follow this service's logs- Use
ps auxto find the process using the most memory. - Start a long process (e.g.
sleep 600 &), find its PID, and terminate it gracefully. - Check the status of a service like
sshorcronwithsystemctl status. - Tail a service’s logs in real time with
journalctl -u <name> -f.
Cheat Sheet▾
| Task | Command |
|---|---|
| List processes | ps aux / top / htop |
| Find by name | pgrep -a name |
| Graceful stop | kill <PID> |
| Force kill | kill -9 <PID> |
| Service status | systemctl status svc |
| Start/stop | systemctl start|stop svc |
| Enable at boot | systemctl enable svc |
| Service logs | journalctl -u svc -f |
Common Interview Questions▾
What's the difference between SIGTERM and SIGKILL?
SIGTERM (15) asks a process to stop and can be caught so it cleans up. SIGKILL (9) forcibly terminates it immediately and cannot be caught or ignored.
What's the difference between systemctl enable and start?
start runs the service now; enable configures it to start automatically at boot.
enable --now does both.
How do you view logs for a single systemd service?
journalctl -u <service> (add -f to follow, --since today to filter by time).