ps, top and kill: see and stop running programs

Every running program is a process with a number, its PID. These commands list processes, show which are busy, and stop the ones that have hung. The examples are illustrations, since a real list would describe a real computer.

ps: a snapshot

Linux or Mac terminal not run here

ps

On its own, ps shows only the processes started from this terminal. To see everything on the system:

Linux or Mac terminal not run here

ps aux

What the output looks like an illustration, not a real run

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.1 168140 11280 ?        Ss   08:42   0:02 /sbin/init
asha      2315  0.3  2.1 987452 84120 ?        Sl   08:45   0:41 /usr/bin/gnome-shell
asha      4120 12.5  6.8 3452100 271340 ?      Sl   09:10   4:12 /usr/lib/firefox/firefox
asha      5231  0.0  0.1  11264  3840 pts/0    R+   10:02   0:00 ps aux

Column	Meaning
USER	who owns the process
PID	the process number
%CPU	share of a processor it is using
%MEM	share of memory
COMMAND	the program and its arguments

The list is long. Find one program by piping it through grep:

Linux or Mac terminal not run here

ps aux | grep firefox

The search itself appears in the result, as a line containing "grep firefox". pgrep firefox avoids that and prints only the PIDs. pgrep -l adds the names.

top: a live view

Linux or Mac terminal not run here

top

top fills the screen with a list that refreshes every few seconds, busiest first. The lines at the head show the load on the machine, the memory in use and the number of processes.

Key	Action
q	quit
P	sort by processor use (Linux)
M	sort by memory (Linux)
k	kill a process: type its PID
h	help

On a Mac, top -o cpu sorts by processor use. Many people install htop, a friendlier version with colours and scrolling.

kill: asking a process to stop

kill sends a signal to a process. Give it the PID.

Linux or Mac terminal not run here

kill 4120

With no signal named, kill sends TERM, a polite request to finish. A well-behaved program saves what it needs to and exits.

When it will not stop

If a process ignores the request, wait a few seconds and then send KILL, signal 9, which the system enforces. The program gets no chance to tidy up.

Linux or Mac terminal not run here

kill -9 4120

Danger. kill -9 ends a program instantly. Unsaved work is lost, and files it was writing may be left half-written. Try a plain kill first and use -9 only when that fails.

The signals worth knowing

Signal	Number	Meaning
TERM	15	please finish (the default)
INT	2	interrupt, the same as pressing Ctrl + C
HUP	1	hang up; many services reload their settings
KILL	9	stop now, no arguments
STOP	19	pause
CONT	18	continue after a pause

kill -l lists them all.

By name: killall and pkill

Linux or Mac terminal not run here

killall firefox
pkill -f "python server.py"

killall stops every process with exactly that name. pkill matches part of a name, and with -f part of the whole command line.

Danger. Matching by name can catch more than you meant. pkill python stops every Python program you are running, not only the one you had in mind. Run pgrep -l with the same pattern first to see what it would hit. On some older Unix systems, killall with no name stops all processes; on Linux and the Mac it needs a name.

What you may stop

You can stop your own processes. Stopping another user's, or the system's, needs sudo, and deserves thought.

Danger. Do not kill processes you do not recognise, and never PID 1, the first process, which keeps the system running. Look a name up before stopping it.

From the keyboard, without commands

For a program running in the terminal in front of you:

Ctrl + C interrupts it.
Ctrl + Z pauses it and gives you the prompt back. fg resumes it, bg lets it carry on in the background, and jobs lists what is paused.

Running something in the background

Put & at the end of a command to start it in the background: long-task &. The shell prints its PID. To let it carry on after you close the terminal, start it with nohup long-task &.

Finding what is slowing the computer

Run top and look at the first few lines of the list. One process using nearly all of a processor for a long time, or memory close to full, is the usual culprit. Note its PID and name, decide whether you know what it is, and only then consider stopping it.

On a Mac

The same commands work. Activity Monitor, in Applications, Utilities, shows the same information in a window, and Cmd + Option + Esc opens Force Quit for ordinary apps.

The Windows equivalents are tasklist and taskkill.

Examples shown with output were run on 12 November 2026 in a practice folder: Windows commands in cmd.exe on Windows 11, Linux commands with the GNU tools of Git Bash. The folder path and user name were replaced with made-up ones. Commands marked "not run here" are shown as you would type them.

This is an independent learning site. It is not connected with Microsoft, Apple or any Linux distribution. Windows, macOS and other names belong to their owners. Try commands first in a practice folder, never on files you cannot afford to lose.