Skip to content

Process Explorer(1)

Name

Explore Linux process states, signals, nice values, parse ps output, and browse the /proc filesystem — all in one interactive reference.

Process State Reference

RRunning

Process is running or ready to run

The process is either executing on a CPU or sitting in the run queue ready to execute. This is the only state where the process is actually doing work.

SSleeping (Interruptible)

Waiting for an event or signal

The process is waiting for an event to complete, such as I/O, a timer, or input from the user. It can be woken by a signal. Most processes spend the majority of their time in this state.

DUninterruptible Sleep

Waiting for I/O (cannot be interrupted)

The process is waiting for I/O to complete and cannot be interrupted by signals. Commonly seen during disk operations. Processes stuck in D state cannot be killed with SIGKILL until the I/O completes.

TStopped

Stopped by a signal (e.g., SIGSTOP or Ctrl+Z)

The process has been stopped, usually by receiving SIGSTOP or SIGTSTP (Ctrl+Z). It can be resumed by sending SIGCONT. Debuggers also use this state when tracing a process.

ZZombie

Terminated but not reaped by parent

The process has finished execution but its entry remains in the process table because the parent has not yet called wait() to read its exit status. Zombies consume no resources except a PID and process table entry.

XDead

Process is fully terminated

The process has been removed from the process table. This state should never be visible in ps output. It exists only briefly during cleanup.

State Transitions

R
Running
S
Sleeping (Interruptible)
D
Uninterruptible Sleep
T
Stopped
Z
Zombie
X
Dead
FromToTrigger
CreatedRfork()
RSwait for event
SRevent occurs / signal
RDwait for I/O
DRI/O completes
RTSIGSTOP / SIGTSTP
TRSIGCONT
RZexit()
ZXparent calls wait()

STAT Column Modifiers (ps output)

CharacterMeaning
<High priority (not nice to other processes)
NLow priority (nice to other processes)
LHas pages locked in memory
sSession leader
lMulti-threaded
+In the foreground process group
sponsored

Guide

What Are Linux Processes?

Every running program on a Linux system is a process with a unique PID, resource allocation, and state (running, sleeping, stopped, or zombie). Understanding process management is fundamental to Linux system administration and troubleshooting.

Signals, Nice Values, and /proc

Signals like SIGTERM and SIGKILL control process behavior, while nice values (-20 to 19) set CPU scheduling priority. The /proc virtual filesystem exposes detailed runtime information about every process on the system.

How to Use This Tool

Browse the interactive state diagram to understand process lifecycles, look up any signal by number or name, calculate nice values, or paste ps aux output to parse and analyze running processes on your system.

What do the process states R, S, D, T and Z mean?

R is running or waiting for a CPU. S is interruptible sleep — waiting for an event such as network input — and is where most processes spend their time. D is uninterruptible sleep, almost always waiting on disk or NFS I/O; such a process can't be killed until the I/O completes, and many D-state processes point to a storage problem. T is stopped, for example after Ctrl+Z. Z is a zombie that has exited but hasn't been collected by its parent. In ps output, extra STAT characters add detail: < high priority, N low priority, s session leader, l multithreaded, + foreground process group.

SIGTERM vs SIGKILL and other common signals

kill PID sends SIGTERM (15), which asks a process to shut down and lets it flush data and clean up. kill -9 PID sends SIGKILL, which the process can't catch or ignore, so nothing gets cleaned up — use it only when SIGTERM fails. SIGHUP (1) tells many daemons to reload their configuration, SIGINT (2) is what Ctrl+C sends, and SIGSTOP and SIGCONT pause and resume a process. kill -l lists every signal with its number.

How do I get rid of a zombie process?

You can't kill a zombie — it has already exited. It stays in the process table until its parent reads its exit status. Find the parent with ps -o ppid= -p PID, then restart or fix that parent; if the parent dies, init adopts the zombie and reaps it. A few zombies are harmless because they hold only a PID, but a growing number means a parent process isn't handling its children correctly.

nice and renice: CPU priority

Nice values run from -20 (highest priority) to 19 (lowest), and new processes start at 0. Start a background job politely with nice -n 10 tar czf backup.tgz /data, or change a running process with renice -n 15 -p PID. Regular users can only make their processes nicer; lowering the value to gain priority needs root. Nice only affects CPU scheduling — for disk-heavy jobs, ionice -c3 puts I/O in the idle class too.

Reading ps aux output

ps aux lists every process with USER, PID, %CPU, %MEM, VSZ (virtual memory in KiB), RSS (resident memory actually in RAM, in KiB), TTY, STAT, START, TIME (total CPU time used) and COMMAND. RSS is the number that matters for memory pressure; VSZ includes mapped but unused memory and is usually much larger. For a custom view sorted by memory, use ps -eo pid,ppid,stat,ni,%cpu,%mem,cmd --sort=-%mem | head.

Inspecting a process through /proc

Every process has a directory at /proc/PID. status shows its state, memory (VmRSS) and thread count; cmdline holds the exact command line; ls -l /proc/PID/fd lists its open files and sockets; limits shows ulimits such as the maximum number of open files; and environ holds its environment variables (readable by the owner or root). These are what ps, top and lsof read under the hood.

See also