Process Management on Linux, macOS, and Windows: Monitoring, Killing, and Background Execution
A process is a running instance of a program that the operating system tracks with a unique identifier called a Process ID (PID), alongside its own memory space and resources. Process management is the set of techniques for finding, monitoring, and, when necessary, terminating those running instances.
Have you ever started a Python script for a machine learning experiment, popped to make a cup of tea, and then promptly forgotten all about it? Hours later, you glance at your system monitor and wonder whether it’s still working or just quietly sulking in the corner.
I once left a script running for three days before realising it was printing “Hello World” in an infinite loop thanks to a misplaced indent. Embarrassing? Absolutely. Educational? Without question.
Processes sometimes need our attention — whether to check their progress, free up system resources, or save our fans from sounding like an aircraft taking off. Processes can be obedient helpers or stubborn little gremlins hiding in the background, and knowing how to find, monitor, and, when necessary, end them is a vital skill.
In this post, we’ll tour the essentials of process management on Linux, macOS, and Windows. We’ll talk about background and foreground execution, and you’ll learn to recognise when a process needs encouragement… or when it’s time to show it the door.
What Is a Process? Understanding PIDs
Think of your computer as a busy workshop, and each process as one of its workers. When you open a programme or run a script, your operating system issues that worker a unique badge — a Process ID (PID) — along with a workspace and the tools to do its job.
Some of these workers are quiet, efficient types. Others gobble up CPU cycles like biscuits at a meeting. A few might wander off and stop doing anything useful, in which case you may need to intervene.
How to Check Running Processes on Linux, macOS, and Windows
Before managing processes, we first need to see who’s on shift.
Linux/macOS Process Monitoring: ps and top
Two classic tools reign supreme here: ps and top. One gives you a snapshot; the other offers a constantly updating live view.
ps: The Instant Snapshot
ps (short for “process status”) lists what’s running at the moment you call it. It can be terse or detailed depending on the options you choose.
| Command | Purpose | Flag Breakdown |
|---|---|---|
ps aux |
The standard, detailed snapshot. | a: All users u: User-oriented format (shows CPU/MEM) x: Include daemon processes (no terminal) |
ps -ef |
Alternative layout (System V style). | -e: Every process -f: Full format listing |
ps aux \| grep python |
Search for a specific process. | Pipes the full snapshot into grep to filter for a keyword. |
Example output of ps aux:
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.1 103764 6332 ? Ss May02 0:02 /sbin/init
you 5678 0.0 0.5 45678 3210 pts/0 S+ 10:30 0:00 python my_script.py
The columns tell you who owns the process, how much CPU/memory it’s using, when it started, and the command that launched it. STAT deserves special mention: R means running, S means sleeping, and Z is a “zombie” — a process that’s finished but still hanging around in the table.
Tip: Zombie processes aren’t undead in the horror-film sense — they’ve already finished but their “desk” in the system hasn’t been cleared. Usually harmless, but if you see a lot of them, it’s worth investigating.
Watch out: When piping into `grep`, the `grep` command itself will often show up in its own results — don’t panic, that’s normal.
top: The Live Dashboard
If ps is a photo, top is a CCTV feed.
Run:
top
and watch as the busiest processes bubble to the top in real time. Press q to quit, P to sort by CPU, M for memory, N for PID.
Tip: If you’re investigating performance issues, leave `top` running for a while — you’ll spot “spikes” that a single `ps` snapshot might miss.
Windows Process Monitoring: Task Manager and tasklist
Windows offers both the visual comfort of Task Manager and the precision of tasklist.
Task Manager
- Open it with
Ctrl + Shift + Escor right-click the taskbar → Task Manager. - Processes tab – applications and background tasks with CPU/memory usage.
- Details tab – like
ps aux, but in a neat grid.
Tip: The Details tab in Task Manager is perfect for finding the PID you’ll need for `taskkill`.
tasklist: The Console View
tasklist
Similar in spirit to ps, this lists the image name, PID, session, and memory usage.
Filter with:
tasklist | findstr python
How to Kill a Process: SIGTERM vs SIGKILL
Killing a process means sending it a signal that requests or forces its termination — no actual violence involved. Graceful termination (SIGTERM) differs from forceful termination (SIGKILL) in whether the process gets a chance to clean up before it exits.
Linux/macOS Process Termination: kill, killall, and pkill
The kill command does not inherently destroy a process; it sends a POSIX signal to it. The process decides how to handle that signal.
| Command | Signal Sent | Description |
|---|---|---|
kill <PID> |
SIGTERM (15) | The polite “please wrap up” signal. Allows the process to save state and terminate gracefully. |
kill -9 <PID> |
SIGKILL (9) | The “pull the plug” signal. The kernel immediately destroys the process without giving it a chance to clean up. |
killall <name> |
SIGTERM (15) | Terminates every process matching the given string name (e.g., killall python3). |
pkill <name> |
SIGTERM (15) | Similar to killall, but allows for more complex pattern matching. |
Watch out: SIGKILL doesn’t give a process the chance to clean up file handles or network sockets. Use it only if gentler signals fail. Furthermore, killall will happily terminate every process matching the name. Triple-check before running it on a shared system.
Windows Process Termination: taskkill and Task Manager
In Task Manager:
- Right-click → End task (single process)
- End process tree (main process + children)
From the console:
taskkill /PID 1234
taskkill /IM python.exe
taskkill /F /IM python.exe :: force
Tip: `/F` is the nuclear option — much like `kill -9` — and should be your last resort.
Background and Foreground Execution: nohup, jobs, bg, and fg
On Unix-like systems, you can orchestrate tasks without blocking your active terminal session.
Background Execution Cheat Sheet
| Command | Action | Explanation |
|---|---|---|
command & |
Start in Background | Appending an ampersand starts the job in the background immediately. |
Ctrl+Z then bg |
Move to Background | Suspends a running foreground job (Ctrl+Z), then resumes it in the background (bg). |
jobs |
List Background Jobs | Displays all jobs attached to the current terminal session. |
fg %1 |
Move to Foreground | Brings the job marked as 1 back into the foreground. |
nohup command & |
Survive Disconnect | Runs the command immune to SIGHUP (hangup) signals. Perfect for leaving tasks running after you log out via SSH. |
disown -h %1 |
Detach Running Job | Removes a running job from the shell’s active job control, allowing it to survive terminal closure. |
Tip: nohup automatically saves the STDOUT output to a file named nohup.out in the current directory. Check that file later to see what your background task did while you were away.
Windows handles background tasks differently — often via services, scheduled tasks, or using pythonw.exe to avoid a console window.
Preventing Unwanted Process Starts: Startup Scripts, Cron, and Task Scheduler
Stopping processes before they start saves hassle.
Linux/macOS – check:
- Startup scripts (
/etc/systemd/system/,~/.bashrc) - Cron jobs (
crontab -l)
Windows – look in:
- Startup folder (
shell:startup) - Registry Run keys
- Task Scheduler
- Services (
services.msc)
Tip: If something keeps reappearing no matter how many times you close it, it’s probably set up as a scheduled task or service.
Process Management Takeaways: When to Escalate from SIGTERM to SIGKILL
Process management is part observation, part intervention. Escalation from a graceful signal to a forceful one is the categorical rule that governs every OS covered here: a process is a running instance identified by a PID, and the safest way to stop one is to request termination first (SIGTERM, End task, taskkill /PID) and only force it (SIGKILL, kill -9, taskkill /F) if it doesn’t respond.
Remember:
- Look before you leap – use
ps/Task Manager to understand the situation. - Start gently –
killbeforekill -9,/PIDbefore/F. - Use background execution wisely – it’s a productivity multiplier.
- Learn your escape hatches – they save reboots.
Watch out: Everyone has ended the wrong process at least once — the trick is to learn from it and avoid taking down your own session again.
Happy process wrangling.
Process Management FAQ
What is the difference between kill and kill -9 in Linux?
kill <PID> sends SIGTERM, a polite request that lets the process save state and shut down gracefully. kill -9 <PID> sends SIGKILL, which the kernel enforces immediately, destroying the process without giving it a chance to clean up file handles or network sockets.
What does a ‘Z’ status mean in ps aux output?
A Z in the STAT column marks a zombie process: one that has already finished running but whose entry hasn’t yet been cleared from the process table. Zombies are usually harmless, but a large number of them is worth investigating.
How do I kill a process by name instead of by PID?
On Linux/macOS, use killall <name> or pkill <name> to terminate every process matching that name. On Windows, use taskkill /IM <name>.exe (add /F to force it).
How do I keep a background process running after I log out of SSH?
Run it with nohup command &. nohup makes the process immune to the SIGHUP signal that is normally sent when the terminal session closes, so it keeps running after you disconnect.
Why does grep show up in my own ps aux | grep search results?
Because grep is itself a running process at the moment the pipeline executes, it briefly appears in its own search output. This is expected behaviour, not a bug.
References
- ps(1) — Linux manual page
- kill(1) — Linux manual page
- taskkill — Microsoft Learn
- Bash Job Control — GNU Bash Manual
Did you like this post? Please let me know if you have any comments or suggestions.
Git posts that might be interesting for youEnjoyed this? Get more like it.
Weekly notes on AI tools, Python, and what I'm actually building — plus a free copy of Fantastic AI: The 2026 Toolkit.
