processes

Overview

Monitoring running processes is a continuous part of both system administration and security. Building on the Processes module, this lesson focuses on observing processes as part of system monitoring — spotting what is running, using resources, or behaving suspiciously.

Learning objectives

• Use monitoring tools to observe processes live.
• Identify resource-heavy or suspicious processes.
• Connect process observation to security investigation.

Core concept

Process monitoring means watching the set of running processes and their behavior over time. Key tools:

• ps — a point-in-time snapshot (e.g. ps aux).
• top — a live, auto-updating view sorted by resource usage.
• htop — an enhanced, interactive top (if installed).
• pgrep/pidof — find processes by name.

Together they answer: what is running, who owns it, and how much CPU/memory it consumes.

How it works

top/htop refresh continuously, ranking processes so heavy CPU or memory consumers rise to the top — useful for spotting a runaway or malicious process. ps aux captures a full snapshot you can pipe into grep/sort for analysis. Observing the owning user, the command, and the resource usage together tells you whether a process is expected. Cross-referencing with the process-lineage skills (parent/child) reveals how a suspicious process was launched.

Practical example

$ top
  PID USER      %CPU %MEM COMMAND
 4821 www-data  98.7  2.1 /tmp/.hidden/miner
  900 root       0.1  0.3 /usr/sbin/sshd

A process named miner running from /tmp/.hidden as www-data and consuming 98.7% CPU is highly suspicious — unusual location, hidden directory, and resource abuse together suggest a compromise (e.g. a cryptominer dropped via a web exploit). Monitoring surfaced it immediately.

Cybersecurity relevance

Live process monitoring is a frontline detection method: malware often reveals itself through abnormal resource use, odd names or locations (e.g. executables in /tmp), or running as an unexpected user. During incident response, observing processes identifies active threats to investigate (then trace lineage, check network sockets, and respond). Baseline familiarity with what normally runs on a system is what makes the abnormal stand out — the same anomaly-recognition principle from the networking path applied to processes.

Common mistakes

• Relying only on a single snapshot when a live view (top/htop) would reveal changing behavior.
• Ignoring the process's location and owner, missing signs like execution from /tmp or an odd user.
• Lacking a baseline of normal processes, so anomalies do not stand out.

Key takeaways

• Monitor processes with ps (snapshot), top/htop (live, resource-sorted), and pgrep/pidof (find by name).
• Observe owner, command, location, and resource usage together to judge whether a process is expected.
• Abnormal resource use, odd names/locations, or unexpected owners are key detection signals; a baseline of normal makes anomalies visible.

Check your understanding

• What advantage does top/htop have over a single ps snapshot when hunting a misbehaving process?
• Name three characteristics of a running process that might mark it as suspicious.