Seeing What the Machine Is Doing
Everything the computer is doing right now is a process. A couple of commands turn "it feels slow" or "what is that?" into a precise, answerable question.
My laptop's fan is roaring and I have no idea why. How do I find out what it is actually doing?
You ask it. Everything running is a processProcessOne running program — a single instance of something the computer is doing right now, with its own identity and resources., and the system will list them all, tell you which is working hardest, and let you act on exactly the one you mean.
A snapshot, and a live view
ps prints a snapshot of processes; top (or the friendlier htop) shows them live, sorted by how hard they are working. Between them you can answer both "what is running?" and "what is eating my machine right now?".
# a live, sorted view — heaviest first
$ top
PID USER %CPU %MEM COMMAND
4821 wren 98.3 4.1 ffmpeg
1190 wren 2.0 11.4 firefox
# there it is: ffmpeg, process 4821, pinning a core. press q to quit top.
PID USER %CPU %MEM COMMAND
4821 wren 98.3 4.1 ffmpeg
\__/ \____/
the id the program
you act on that is running
- Line 2The PIDPIDA process ID — the unique number the system gives each running process so you can refer to exactly one of them., 4821, is the handle: it names this one process out of all of them, so you can inspect or stop exactly it.
- Line 298.3% CPU is your fan's answer. High and sustained means "this is the work"; a brief spike is usually fine.
You suspect a program called updater is running but you cannot see it in a screenful of top. How do you check quickly?
ps aux | grep updater. ps aux lists every process; the pipePipeThe "|" that connects two commands, sending the output of the first straight in as the input of the second. and grepgrepThe search tool: it reads lines and prints only the ones that match a pattern you give it. keep only the lines mentioning "updater". This is the pipes chapter paying off — you do not scroll a list, you query it. The same two-tool move answers "is X running, and what is its PID?" every time.`top` shows a process at 99% CPU sustained for minutes. What does that most likely mean?
Guessing
- "It feels slow" and rebooting in hope
- Force-quitting random apps until it improves
- No idea what is running or whyAsking the system
- top / htop to see what is actually working hardest, right now
- ps aux | grep name to check for a specific process and get its PID
- Reading %CPU and %MEM to tell "busy" from "leaking"A slow or strange machine is not a mystery to endure — it is a question with an answer, and these commands are how you ask it precisely.
So "why is it slow" is just "which process, and doing what".
Exactly. See the processes, read the two numbers that matter, and the vague feeling becomes a specific, actionable fact.
And the reverse: the process I would rather you did not notice is the one I hope you never run top to see.
Legal
Inspect processes on your own machines and systems you administer. Listing or probing what is running on a host you are not authorised to access is reconnaissance against it, and outside the bounds of this course.
So everything happening is a process, top and ps reveal them, and a PID is the handle on any single one. Now that you can see what is running, one fact decides how much any of it can do: whose authority each process runs with.