Linux Process Management & Monitoring Guide: Master Process Control in Kali Linux (2026)

Understanding linux process management is fundamental for any penetration tester, system administrator, or cybersecurity professional working with Kali Linux. Whether you're analyzing system behavior during security assessments, optimizing resource usage, or identifying malicious processes, mastering process management is an essential skill.

In this comprehensive guide, you'll learn everything from basic process concepts to advanced monitoring techniques, systemd service management, and security-focused process analysis. Let's dive into the world of Linux process management.

Table of Contents

1. Understanding Linux Processes
2. Process States Explained
3. Viewing and Monitoring Processes
4. Process Priority Management
5. Killing and Controlling Processes
6. Background and Foreground Job Control
7. Systemd and Service Management
8. Resource Monitoring Tools
9. Cron Jobs for Penetration Testers
10. Security Perspective: Process Analysis
11. FAQ

Understanding Linux Processes

A process is simply a running instance of a program in Linux. Every time you execute a command, launch an application, or run a script, the operating system creates a process to manage that execution.

Process Identifiers (PID and PPID)

Each process in Linux has unique identifiers:

• PID (Process ID): A unique numerical identifier assigned to every running process. PIDs start from 1 (the init/systemd process) and increment sequentially.
• PPID (Parent Process ID): The PID of the process that created (spawned) the current process. This creates a hierarchical tree structure of processes.

You can view your current shell's PID using:

echo $$

To see the parent process ID:

echo $PPID

Process Hierarchy

Linux processes follow a tree structure. The init system (systemd in modern distributions like Kali Linux) is the ancestor of all processes with PID 1. When you open a terminal and run a command, your shell becomes the parent process (PPID) of that command.

You can visualize this hierarchy with:

pstree -p

Understanding this hierarchy is crucial for linux terminal mastery and effective system administration.

Process States Explained

Linux processes exist in different states throughout their lifecycle. Understanding these states helps you diagnose system behavior and identify issues.

Common Process States

1. Running (R): The process is currently executing on a CPU or waiting in the run queue to be scheduled.

2. Sleeping (S): The process is waiting for an event to complete, such as I/O operations or user input. This is the most common state for inactive processes.

3. Uninterruptible Sleep (D): Similar to sleeping, but the process cannot be interrupted by signals. Usually indicates waiting for disk I/O. Prolonged D state may indicate hardware issues.

4. Zombie (Z): The process has completed execution but its parent hasn't read its exit status yet. The process entry remains in the process table. Zombies don't consume system resources except the process table entry.

5. Stopped (T): The process has been stopped, usually by receiving a SIGSTOP or SIGTSTP signal (Ctrl+Z in terminal). Can be resumed with SIGCONT.

6. Idle (I): Kernel threads in an idle state (newer kernels).

You can check process states using the ps command with specific format options:

ps aux | head -n 20

The STAT column shows the current state of each process.

Viewing and Monitoring Processes

Kali Linux provides multiple powerful tools for viewing and monitoring processes. Let's explore the most important ones.

The ps Command

The ps (process status) command is the fundamental tool for viewing process information.

Basic usage:

# Show processes for current user
ps

# Show all processes (BSD style)
ps aux

# Show all processes (Unix style)
ps -ef

# Show process tree
ps auxf

# Show specific user's processes
ps -u username

# Custom format output
ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%mem | head

Understanding ps aux output:

• USER: Process owner
• PID: Process ID
• %CPU: CPU usage percentage
• %MEM: Memory usage percentage
• VSZ: Virtual memory size (KB)
• RSS: Resident Set Size - actual physical memory (KB)
• TTY: Terminal associated with process
• STAT: Process state
• START: When process started
• TIME: Cumulative CPU time
• COMMAND: Command that started the process

The top Command

top provides a real-time, dynamic view of running processes:

top

Useful top shortcuts:

• h: Show help
• k: Kill a process
• r: Renice (change priority)
• M: Sort by memory usage
• P: Sort by CPU usage
• u: Filter by user
• q: Quit
• 1: Show individual CPU cores
• c: Show full command path

The htop Command

htop is an enhanced, user-friendly alternative to top with color coding and mouse support:

htop

If htop isn't installed on your Kali Linux system:

sudo apt update && sudo apt install htop -y

htop advantages:

• Color-coded output
• Mouse support
• Vertical and horizontal scrolling
• Tree view of processes
• Easy process killing without entering PID
• Visual CPU and memory bars

The pgrep Command

pgrep searches for processes by name and returns their PIDs:

# Find process by name
pgrep firefox

# Show process name and PID
pgrep -a firefox

# Find processes for specific user
pgrep -u root

# Count matching processes
pgrep -c sshd

This is particularly useful in penetration testing scripts when you need to check if a specific tool is running.

Process Priority Management

Linux uses priority values to determine which processes get CPU time. Understanding and manipulating process priority is crucial for optimizing system performance during resource-intensive operations like password cracking or network scanning.

Understanding Nice Values

The "niceness" value ranges from -20 (highest priority) to 19 (lowest priority). The default niceness is 0.

• Lower nice values = higher priority = more CPU time
• Higher nice values = lower priority = less CPU time
• Only root can set negative nice values or decrease niceness of existing processes

The nice Command

Start a process with a specific priority:

# Start with lower priority (nice value 10)
nice -n 10 command

# Start with higher priority (requires root)
sudo nice -n -10 command

# Example: Run a CPU-intensive hash cracking with low priority
nice -n 15 hashcat -m 0 -a 0 hashes.txt wordlist.txt

The renice Command

Change the priority of an already running process:

# Increase niceness (lower priority) of PID 1234
renice +5 1234

# Decrease niceness (higher priority) - requires root
sudo renice -5 1234

# Change priority of all processes for a user
sudo renice +10 -u username

Killing and Controlling Processes

Sometimes processes become unresponsive or need to be terminated. Linux provides several methods for sending signals to processes.

Understanding Signals

Signals are software interrupts sent to processes. The most important signals for process management:

View all available signals:

kill -l

The kill Command

kill sends signals to processes by PID:

# Send SIGTERM (graceful termination)
kill 1234

# Send SIGKILL (force kill)
kill -9 1234
# or
kill -SIGKILL 1234

# Send SIGHUP (reload configuration)
kill -1 1234

# Send signal to multiple processes
kill 1234 1235 1236

Best practice: Always try SIGTERM (15) first to allow the process to clean up gracefully. Use SIGKILL (9) only if SIGTERM doesn't work.

The killall Command

killall terminates processes by name:

# Kill all instances of firefox
killall firefox

# Force kill
killall -9 firefox

# Interactive mode (confirm each kill)
killall -i firefox

# Kill processes for specific user
killall -u username

The pkill Command

pkill combines the pattern matching of pgrep with the killing functionality:

# Kill processes by name pattern
pkill firefox

# Kill by partial name match
pkill fire

# Kill processes for specific user
pkill -u username

# Send specific signal
pkill -SIGTERM apache2

Background and Foreground Job Control

Managing jobs in the background is essential for multitasking in the terminal, especially during penetration testing methodologies where you might run multiple tools simultaneously.

Running Commands in Background

Append & to run a command in the background:

# Run nmap scan in background
nmap -sV -p- target.com &

# Start multiple background jobs
ping google.com > ping1.log &
ping yahoo.com > ping2.log &

Job Control Commands

View current jobs:

jobs
jobs -l  # Show PIDs

Foreground a job:

# Bring job 1 to foreground
fg %1

# Bring most recent background job to foreground
fg

Background a job:

# First, stop the current process with Ctrl+Z
# Then send it to background
bg %1

The nohup Command

nohup (no hangup) allows a command to continue running after you log out:

# Run command immune to hangup signal
nohup long-running-command &

# Output goes to nohup.out by default
nohup python3 scanner.py &

# Redirect output
nohup python3 scanner.py > output.log 2>&1 &

The disown Command

disown removes jobs from the current shell's job table:

# Start a background job
command &

# Disown it (so it won't be killed when shell closes)
disown %1

# Disown all jobs
disown -a

Systemd and Service Management

Modern Linux distributions, including Kali Linux, use systemd as the init system and service manager. Understanding systemd is crucial for managing system services.

The systemctl Command

systemctl is the primary tool for controlling systemd services:

# List all running services
systemctl list-units --type=service --state=running

# List all services (active and inactive)
systemctl list-units --type=service --all

# Check status of a service
systemctl status ssh

# Start a service
sudo systemctl start ssh

# Stop a service
sudo systemctl stop ssh

# Restart a service
sudo systemctl restart ssh

# Reload service configuration without restarting
sudo systemctl reload ssh

# Enable service to start at boot
sudo systemctl enable ssh

# Disable service from starting at boot
sudo systemctl disable ssh

# Check if service is enabled
systemctl is-enabled ssh

# Check if service is active
systemctl is-active ssh

Common Services in Kali Linux

# SSH server
sudo systemctl start ssh

# Apache web server
sudo systemctl start apache2

# PostgreSQL database (for Metasploit)
sudo systemctl start postgresql

# Networking
sudo systemctl restart NetworkManager

The journalctl Command

journalctl views systemd logs:

# View all logs
journalctl

# View logs for specific service
journalctl -u ssh

# Follow logs in real-time
journalctl -f

# View logs since last boot
journalctl -b

# View logs from specific date
journalctl --since "2026-01-01"

# View kernel messages
journalctl -k

# Show only errors
journalctl -p err

# Limit number of lines
journalctl -n 50

Resource Monitoring Tools

Monitoring system resources is essential for identifying bottlenecks, detecting anomalies, and optimizing performance during security assessments.

The free Command

Display memory usage:

# Show memory in human-readable format
free -h

# Show memory with total line
free -h -t

# Update every 2 seconds
free -h -s 2

Understanding free output:

• total: Total installed RAM
• used: Memory in use
• free: Completely unused memory
• shared: Memory used by tmpfs
• buff/cache: Memory used for buffers and cache (can be freed if needed)
• available: Memory available for starting new applications

The df Command

Display disk space usage:

# Show disk usage in human-readable format
df -h

# Show inode usage
df -i

# Show specific filesystem type
df -h -t ext4

# Exclude specific types
df -h -x tmpfs -x devtmpfs

The du Command

Estimate file and directory space usage:

# Show size of current directory
du -sh

# Show size of all files and directories
du -h

# Show sizes of immediate subdirectories
du -h --max-depth=1

# Sort by size
du -h | sort -h

# Find top 10 largest directories
du -h --max-depth=1 | sort -hr | head -n 10

The uptime Command

Show system uptime and load averages:

uptime

Output explanation:

• Current time
• How long system has been running
• Number of logged-in users
• Load averages for 1, 5, and 15 minutes

Load average interpretation:

• Below 1.0 on single-core system: no load issues
• Multiply by number of cores (e.g., 4.0 is fine on quad-core)
• Consistently high load indicates CPU bottleneck

The w Command

Show who is logged in and what they're doing:

w

# Show without header
w -h

# Show specific user
w username

This command is particularly useful for security monitoring to detect unauthorized access.

Cron Jobs for Penetration Testers

Cron allows you to schedule automated tasks, which is valuable for recurring security scans, log monitoring, and automated reporting.

Understanding Cron Syntax

Cron job format:

* * * * * command
│ │ │ │ │
│ │ │ │ └─── Day of week (0-7, Sunday=0 or 7)
│ │ │ └───── Month (1-12)
│ │ └─────── Day of month (1-31)
│ └───────── Hour (0-23)
└─────────── Minute (0-59)

Managing Cron Jobs

# Edit crontab for current user
crontab -e

# List cron jobs
crontab -l

# Remove all cron jobs
crontab -r

# Edit crontab for another user (root)
sudo crontab -u username -e

Practical Examples for Pentesters

# Daily vulnerability scan at 2 AM
0 2 * * * /usr/bin/nmap -sV target-list.txt -oA /home/user/scans/daily-$(date +\%Y\%m\%d)

# Check for new subdomains every 6 hours
0 */6 * * * /opt/subfinder -d target.com -o /home/user/recon/subdomains.txt

# Automated backup every Sunday at midnight
0 0 * * 0 tar -czf /backup/pentest-data-$(date +\%Y\%m\%d).tar.gz /home/user/pentest/

# Monitor specific port every 15 minutes
*/15 * * * * nmap -p 443 target.com | grep -i open && echo "Port open" | mail -s "Alert" admin@example.com

# Clear temporary files daily
0 3 * * * find /tmp/pentest-temp -type f -mtime +7 -delete

Cron with Environment Variables

# Set environment variables in crontab
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
SHELL=/bin/bash
MAILTO=admin@example.com

# Your cron jobs here
0 2 * * * /path/to/script.sh

Security Perspective: Process Analysis

As a penetration tester, understanding process analysis from a security perspective is crucial for both offensive and defensive operations.

Finding Suspicious Processes

Look for unusual patterns:

# Find processes running as root
ps aux | grep root

# Find processes without a controlling terminal (potential backdoors)
ps aux | grep '?'

# Find processes with network connections
ss -tulpn
# or
netstat -tulpn

# Find processes listening on specific port
lsof -i :4444

# Find processes accessing specific files
lsof /path/to/file

# Check for processes with suspicious names
ps aux | grep -E '(nc|netcat|/tmp/|/dev/shm)'

Check process information:

# View process command line
cat /proc/[PID]/cmdline | tr '\0' ' '

# View process environment variables
cat /proc/[PID]/environ | tr '\0' '\n'

# View process working directory
ls -la /proc/[PID]/cwd

# View process executable
ls -la /proc/[PID]/exe

# View process open files
ls -la /proc/[PID]/fd/

Detecting Hidden or Rootkit Processes

Compare process listings:

# Compare ps output with /proc
for pid in /proc/[0-9]*; do
  pid=$(basename $pid)
  if ! ps -p $pid > /dev/null 2>&1; then
    echo "Hidden process: $pid"
  fi
done

Use rkhunter or chkrootkit:

# Install and run rkhunter
sudo apt install rkhunter
sudo rkhunter --update
sudo rkhunter --check

# Install and run chkrootkit
sudo apt install chkrootkit
sudo chkrootkit

Process Hiding Techniques (For Red Team)

Understanding how processes can be hidden helps both attackers and defenders:

1. Running from memory: Processes that don't touch disk
2. Process name spoofing: Renaming binaries to look legitimate
3. Rootkit hooks: Kernel-level manipulation
4. Parent process hijacking: Making malicious process appear to have legitimate parent

Basic process name obfuscation:

# Copy and rename binary
cp /usr/bin/nc /tmp/systemd-update
/tmp/systemd-update -lvnp 4444

Monitoring Process Creation

Using auditd:

# Install auditd
sudo apt install auditd

# Add rule to monitor execve syscall
sudo auditctl -a always,exit -F arch=b64 -S execve

# View audit logs
sudo ausearch -sc execve

Essential Commands for Security Analysis

These essential Linux commands are invaluable for security professionals:

# Show all network connections with processes
sudo netstat -tulpn

# Show real-time network connections
watch -n 1 'ss -tulpn'

# Find SUID binaries (potential privilege escalation)
find / -perm -4000 -type f 2>/dev/null

# Find recently modified files (potential indicators)
find /tmp /var/tmp /dev/shm -type f -mtime -1

# Check for processes accessing sensitive files
lsof /etc/shadow

Frequently Asked Questions

1. What's the difference between SIGTERM and SIGKILL?

SIGTERM (signal 15) is a graceful termination signal that allows a process to:

• Clean up temporary files
• Save current state
• Close open files and network connections
• Perform cleanup routines
• Can be caught, handled, or ignored by the process

SIGKILL (signal 9) is a forceful termination that:

• Cannot be caught, blocked, or ignored
• Immediately terminates the process
• Doesn't allow any cleanup
• Should only be used when SIGTERM fails
• May leave temporary files or corrupt data

Best practice: Always try kill PID (SIGTERM) first, wait a few seconds, then use kill -9 PID (SIGKILL) only if necessary.

2. How do I find which process is using a specific port?

Method 1 - Using lsof:

sudo lsof -i :8080

Method 2 - Using netstat:

sudo netstat -tulpn | grep :8080

Method 3 - Using ss (modern alternative):

sudo ss -tulpn | grep :8080

Method 4 - Using fuser:

sudo fuser 8080/tcp

All these commands will show the PID and process name using the specified port. The sudo prefix is necessary to see processes owned by other users.

3. Why do zombie processes exist and how do I remove them?

Why zombie processes exist:

A zombie process occurs when:

1. A child process completes execution
2. It sends its exit status to its parent
3. The parent hasn't yet read this exit status (using wait() system call)
4. The process entry remains in the process table in "Z" state

Characteristics:

• Doesn't consume CPU or memory (except minimal process table entry)
• Shows as <defunct> in process listings
• Cannot be killed directly (it's already dead)

How to remove zombies:

# Find zombie processes
ps aux | grep Z

# Identify the parent process (PPID)
ps -o ppid= -p [ZOMBIE_PID]

# Send SIGCHLD to parent to make it reap the zombie
kill -SIGCHLD [PARENT_PID]

# If parent doesn't respond, kill the parent (zombie becomes orphan and init cleans it)
kill [PARENT_PID]

If zombies persist, it usually indicates a bug in the parent process. Rebooting will clear all zombies as a last resort.

4. How can I limit CPU or memory usage of a process in Kali Linux?

Using nice/renice for CPU priority:

# Start with lower priority (uses less CPU)
nice -n 19 cpu-intensive-command

# Change priority of running process
renice +10 -p [PID]

Using cpulimit (install first):

sudo apt install cpulimit

# Limit process to 50% of one CPU core
cpulimit -p [PID] -l 50

# Limit by process name
cpulimit -e firefox -l 50

# Launch process with limit
cpulimit -l 50 -- command

Using cgroups (systemd):

# Limit service to 50% CPU
sudo systemctl set-property [service] CPUQuota=50%

# Limit service memory to 1GB
sudo systemctl set-property [service] MemoryLimit=1G

Using ulimit for single session:

# Set max memory (KB) for shell session
ulimit -m 1000000

# Set max CPU time (seconds)
ulimit -t 300

# Then run your command in this shell

5. What's the best way to monitor processes during penetration testing?

For effective process monitoring during pentesting, use a combination of tools:

For real-time monitoring:

# htop with custom configuration
htop
# Press F2 for setup, configure columns to show: PID, USER, STATE, CPU%, MEM%, TIME, Command

For logging process activity:

# Log top output every 60 seconds
while true; do
  date >> process_monitor.log
  ps aux --sort=-%cpu | head -n 20 >> process_monitor.log
  sleep 60
done &

For network-connected processes:

# Watch network connections in real-time
watch -n 2 'netstat -tulpn | grep ESTABLISHED'

For suspicious process detection:

# Monitor for new processes
watch -n 1 'ps aux --sort=-start_time | head -n 20'

Using auditd for process execution tracking:

sudo auditctl -a always,exit -F arch=b64 -S execve
sudo ausearch -sc execve --format text

Creating a monitoring script:

#!/bin/bash
# pentest-monitor.sh

LOGFILE="pentest_process_$(date +%Y%m%d_%H%M%S).log"

while true; do
    echo "=== $(date) ===" >> $LOGFILE
    echo "Top CPU processes:" >> $LOGFILE
    ps aux --sort=-%cpu | head -n 10 >> $LOGFILE
    echo "\nNetwork connections:" >> $LOGFILE
    ss -tulpn >> $LOGFILE
    echo "\n" >> $LOGFILE
    sleep 300  # Log every 5 minutes
done

Conclusion

Mastering linux process management is a fundamental skill for any cybersecurity professional working with Kali Linux. From understanding process basics like PIDs and states to advanced techniques like systemd service management and security-focused process analysis, these tools and concepts form the foundation of effective system administration and penetration testing.

Key takeaways:

1. Understand the fundamentals: PIDs, PPIDs, and process states are core concepts
2. Use the right tool: ps for snapshots, top/htop for real-time monitoring, pgrep for searching
3. Control wisely: Always try SIGTERM before SIGKILL
4. Leverage systemd: Modern service management with systemctl and journalctl
5. Monitor resources: Use free, df, and uptime to track system health
6. Automate tasks: Cron jobs for scheduled security scans
7. Think like an attacker: Understand how processes can be hidden and detected

Continue building your Linux skills by exploring our other tutorials on essential Linux commands for cybersecurity and Kali Linux configuration.

For additional resources, check out the official documentation:

• Kali Linux Documentation
• Linux Process Management

Happy hunting! 🐧

Written by Andrax Pentester / Syed Abrar