Pebellslearn by building
0%
RoadmapsMatrixCoursesSandboxSign in
Terminal Knowledge  ›  Lesson

Process Monitoring — Find It, Inspect It, Signal It

Process Monitoring 12 minEvery running program has a PID that you can find with ps, pgrep, ss or lsof, inspect, and stop with a polite SIGTERM before resorting to SIGKILL.

Process Monitoring — Find It, Inspect It, Signal It

You restart notes-api and it refuses to start: "address already in use". Something is still holding port 8000. To fix it you need to find that process, understand what it is, and stop it without making things worse.

The rule

Every running program is a process with a PID: find it, inspect it, signal it.

The kernel gives every running program a process ID (PID). The tools you need:

ps aux                      # every process, with user, CPU, memory, command
pgrep -af notes-api         # PIDs and full command lines matching a pattern
top                         # live view, busiest first (htop is a friendlier version)
sudo lsof -i :8000          # which process has port 8000 open
sudo ss -ltnp               # every listening TCP port and its process
systemctl status notes-api  # a systemd service's state, PID and last log lines
journalctl -u notes-api -n 50   # the service's recent log

To stop a process you send it a signal with kill:

  • kill 4312 sends SIGTERM (15), the default: "please shut down". The program can finish requests, flush files and exit cleanly.
  • kill -9 4312 sends SIGKILL: the kernel ends it immediately. No clean-up, open work is lost.
  • kill -HUP (SIGHUP) asks many daemons, such as nginx, to reload their configuration.

If the process belongs to a systemd service, stop it with systemctl stop instead, or systemd may simply start it again.

The shortcut

Find, inspect, signal gently, force last. Never jump straight to kill -9.

Freeing port 8000Step 1 of 4
  1. Find

    sudo ss -ltnp shows port 8000 held by python, PID 4312.

The trap: killing the wrong PID because you matched a pattern too loosely. Always inspect the full command line before you signal.

Drills

Answer fast — trust the rule.

quick drill

Which signal does kill 4312 send when you give no option?

quick drill

Why try SIGTERM before SIGKILL?

quick drill

Which command shows the process listening on port 8000?

quick drill

You kill a process that belongs to a systemd service, and a new PID appears seconds later. Why?

Remember

  • Every running program is a process with a PID: find it, inspect it, signal it.
  • Shortcut: find, inspect, signal gently, force last.
  • Trap: kill -9 on a PID you have not inspected.

Practice — level up

0/1 solved

Write your answer, then compare it with a rubric and a model answer.

ExplainAddress already in use

notes-api will not start because port 8000 is already in use. Explain how you would find the process holding the port, decide whether to stop it, and stop it safely.