Tag: computer performance

How to increase the swap partition in Linux Mint and Ubuntu. How to create a Swap file in Linux

In this article, using Linux Mint and Ubuntu as an example, we will learn how to view information on the swap partition, create a swap file, and also increase the space available for swap.

The swap file is a specific place on permanent storage (for example, on a hard disk), where data that does not fit in RAM is temporarily dumped. That is, it is an opportunity to increase the amount of RAM without buying RAM modules. But such a “virtual” RAM is slower.

You can view the current size of the swap partition with the command:

swapon --show

Or with the free command:

free -h

Or with top:


As you can see, there is a 2 GB swap file on the system, which, let's say, is not enough.

Disable and delete this paging file with the following commands:

sudo swapoff -a
sudo rm -f /swapfile

There must be enough space on the disk to fit the swap file of the size you specified.

To create an 8G swap file (change the value as you wish) run the command:

sudo fallocate -l 8G /swapfile

Then run the commands:

sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile

Open System Monitor to make sure the system uses the swap file:

Or you can do it with the command:

swapon --show

That's all! You don't even need to reboot your system for the changes to take effect.

By the way, if you go again to change the size of the paging file (up or down – it doesn’t matter), then exactly follow the same instructions again, but specify a different size when creating the paging file.

How to delete swap file in Linux Mint and Ubuntu

To completely remove the paging file, run the commands:

sudo swapoff -a
sudo rm -f /swapfile

Then open the /etc/fstab file:

sudo gedit /etc/fstab

And remove the line from it:

/swapfile none swap defaults 0 0

Error “fallocate: fallocate failed: Text file busy”

If you encounter an error:

fallocate: fallocate failed: Text file busy

This means that you want to create a swap file, but a file with the same name already exists and is still in use.

To disable and remove it, run the commands:

sudo swapoff -a
sudo rm -f /swapfile

Managing Swap files on other Linuxes

To increase or create a swap file on other distributions, see the articles:

How to create a swap partition on another drive

You don't have to use the system disk for the swap, which can be low on space. You can create a partition on any drive in the system. For details, see the instruction “How to create a swap partition not on the system drive. How to move the swap partition to another disk”.

How to check swap file usage in Linux

Stress testing the system in a out of RAM scenario: How to check Swap file usage in Linux

Swap file and swap partition in Arch Linux (BlackArch): what to choose and how to add Swap

RAM, along with the central processor, is a determining factor in the performance of a computer. Moreover, the speed (frequency) of RAM is not so important, how important is its quantity – the amount of RAM.

The computer starts to work much slower if it does not have enough RAM. Moreover, if it has a swap partition, then it can copy some information from RAM to it and then read it – this reduces performance, but at least does not lead to a reset of running tasks and a computer freeze.

So, if the performance of your computer drops due to a lack of RAM, then I would recommend upgrading the hardware first, that is, buying more RAM sticks. But this is not always possible. Or, in addition to buying hardware RAM, you can add another swap partition.

What is Swap

Swap is a place in permanent storage (hard disk, SSD, USB storage) to which part of the RAM is temporarily dumped, which:

a) not currently used in calculations

b) does not fit in physical RAM.

What is the difference between swap partition and swap file

So, we have decided that the swap partition and swap file in Linux is called Swap.

Now let's look at the two available options: partition and swap file.

Swap partition

A swap partition is a dedicated disk space, a separate volume that is created when partitioning a disk during installation of an operating system.

If you want to create a swap partition after installing the operating system, for example, as follows: reduce the volume of one of the partitions, and create a Swap partition on the freed space, then most likely you will not be able to do this “hot”, that is, during operation this same operating system. You will have to boot from a USB stick or optical disc and perform the necessary operations from it.

Swap file

A swap file performs the same functions as a partition, but is more convenient to use.

The convenience of using the swap file is expressed as follows:

a) the swap file is created as a regular file, that is, there is no need to partition the disk

b) to connect the swap file, you do not need to restart the operating system

c) to change the size of the swap file, you do not need to restart the operating system

d) to disable and delete the swap file, you do not need to restart the computer

That is, the situation is quite real when you need a swap file for a short time – for example, for an hour. You can create it, connect it, perform a task that requires a significant amount of RAM, and disable and delete it after. This is especially true if you have, for example, a fast, but not large SSD drive – and you don't want to constantly keep the swap file, especially if it is not particularly needed most of the time.

Another option with a paging file is convenient on VPS hosting, when unnecessary server downtime due to maintenance is not needed, and the impossibility of physical access requires contacting the support service.

How to display information about the swap file in Linux

To check if the swap file is present, what size it is and how much it is being used, run the command:

swapon --show

Either the command:

free -h

How to create a swap file in Arch Linux

All subsequent commands must be run with root user privileges.

To create a sSwap file, run the fallocate command, along with which you need to specify the size of the swap file to be created. You can use abbreviations (M = megabytes, G = gigabytes). For example, to create a 16 GB swap file located at the /swapfile path, you need to run the command:

sudo fallocate -l 16G /swapfile

The fallocate command can cause problems with some file systems such as F2FS or XFS. A more reliable, though slower, alternative is to use the dd command (this example will create a 512 megabyte file):

dd if=/dev/zero of=/swapfile bs=1M count=512 status=progress

Set file permissions (readable swap is a huge local vulnerability):

sudo chmod 600 /swapfile

Format the file in swap:

sudo mkswap /swapfile

Activate the swap file:

sudo swapon /swapfile

Please note that already at this stage the swap file starts to be used – no system reboot is required!

To ensure that the swap file is used after each reboot, open the /etc/fstab file.


sudo gedit /etc/fstab

In the command line interface:

sudo vim /etc/fstab

And add this line to this file:

/swapfile none swap defaults 0 0

Note: The swap file must be specified by its location in the file system, not by its UUID or LABEL.

Removing the Swap file

To remove the swap file, you must first disable it, and then it can be deleted:

sudo swapoff -a
sudo rm -f /swapfile

Finally remove the relevant line from /etc/fstab.

How to check Swap File usage in Linux

Stress testing the system in a out of RAM Scenario: How to check Swap file usage in Linux

How to clean up Windows 11 without additional programs

Do I need to clean and optimize Windows 11 after installation

Operating systems, be it Windows, Android or even Linux, can be used to promote products and services. Therefore, at present, one of the main questions after reinstalling the OS is not how to install new programs, but how to remove pre-installed ones. For unnecessary, useless software that is installed against the will of the user, they came up with the term bloatware.

These unnecessary applications are often added to startup and consume system resources (RAM and CPU resources), take up space on the screen and even in the quick launch bar, they are automatically updated, sometimes at the wrong time, for example, when using a limited Internet connection.

There are several tools for removing unnecessary software, cleaning and optimizing the system for Windows, but how useful and harmless are they?

To begin with, I would strongly advise against running executable files on your computer from any source other than those that you are absolutely sure of.

There are open source tools available, such as a Windows cleanup script written in PowerShell. In my opinion, all these tools, even open source ones, are of little use and may even be harmful.

In most cases, it is enough to make a few settings and remove a few tools from autorun to get rid of bloatware in Windows. As for the dozens and even hundreds of other actions that Windows cleaning tools perform, they are mostly either useless or can cause unforeseen consequences.

In this note, we will look at how to remove unnecessary apps from startup and how to remove useless programs and icons from the quick launch bar.

Cleaning Windows 11 after installation without additional programs

This is what the Taskbar and System Tray look like in a freshly installed Windows 11:

Other than the Start menu, I don't need any of these icons! Let's see how to customize the quick launch bar (Taskbar) for yourself.

Checking and cleaning startup

Press Win+x and select Task Manager.

Click on the “More details” button, go to the “Startup” tab, sort by “Status” and disable applications that you do not need in autorun.

To remove an application from startup, right-click on it and select “Disable”.

The changes you make will take effect on the next boot.

How to remove icons from the taskbar

To customize the Taskbar, right-click on it and click “Taskbar settings”.

In the window that opens, find “Taskbar items” and disable the ones you don't need.

For example like this:

After that, the taskbar began to look like this:

I don't need a Microsoft browser (I use Chrome and Firefox instead), I don't need Windows Explorer (I use Double Commander instead), and I don't need the Microsoft Store in Quick Access. To remove all these items, right-click on them and select “Unpin from taskbar”.

See also: Free analogue of Total Commander

All that's left is this:

To add applications that you frequently use to the Taskbar, open the application, right-click on the application's icon in the Taskbar, and select “Pin to taskbar”.

My selection of the most used programs:

How to determine the type and speed of a USB port

How to determine the version and speed of the USB port?

It would seem that to say which version and speed of the USB connector on a computer is a trivial task. As it was before? The black connector is USB2 and the blue connector is USB3. Right? This information has long been outdated, in modern motherboards and laptops, blue has been abandoned as a sign of a fast USB socket.

What USB versions are there

You may already know notation such as

  • USB 4
  • USB 3.0 and USB 3.1 Gen 1
  • USB 3.1 and USB 3.1 Gen 2
  • USB 3.2 and Gen 2×2

All this became so complicated and incomprehensible that it was all considered obsolete and SuperSpeed USB with numbers was invented.

What does the labeling of USB ports mean

Surely there should be a hint about the version and speed of the USB ports next to the connectors.

Let's take a look at the following photo of the ports on my laptop:

First, all three of these ports are USB ports, even the small one! The small one is USB-C / USB Type C.

Second, what do these letters “SS” and the number mean?

The port without the letters “SS” is old USB 2.0. The small port with “SS” and number 10 is SuperSpeed USB 10 Gbps, formerly called USB 3.1 Gen 2.

Okay, we've figured out two out of three ports, what about the third port? It is clear that this is some version of SuperSpeed, but which one?

How to determine in Linux which port my computer has: USB3, USB3.0, USB3.1, USB3.2, or USB4

To check the USB version run the following command:

sudo lsusb -v | grep -i bcdusb

The conclusion is not very informative, we can only say with confidence that the system has USB ports 3.1 and 2.0 and that two devices are connected to USB 3.1, and the rest are connected to USB 2.0. Don't be surprised at the number of devices – some of them are internal devices (like a webcam) and are connected to a USB hub inside the case.

To figure out which devices use USB 3.* and what their speed is, you need to delve into the properties of the system hardware.

Let's start with the command


As you can see in the screenshot, this computer has root hubs 3.0 and 2.0:

Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

USB host controllers are PCI devices, so you can see them with lspci:

lspci | grep USB

Find “xHCI” which is USB3.

The following command will also show the available xhci controllers or hubs. The operating speed is shown at the end of each line. USB3 speed starts from 5000M.

Let's compare the output of the two commands:

lsusb -t | grep xhci
lsusb | grep hub

As you can see, the 2.0 root hub has a speed of 480M, and the 3.0 root hub has a speed of 10000M.

To determine which USB port the flash drive is connected to and its speed, connect the device you are interested in and run

lsusb -t

Find the phrase “Mass Storage” – these are disks and flash drives. The parent of this node corresponds to the USB port where you connected your flash drive. The last figure is speed.

How USB Versions and Speed Compare

In the screenshot above, we could see the speed of 10000M, but which version of USB is it exactly?

Look at the following data:

  • 12M = 12MBit/s = USB1
  • 480M = 480MBit/s = USB2
  • 5000M = 5000MBit/s = USB3.0, also known as USB3.1 gen. 1
  • 10000M = 10000MBit/s = USB 3.1, also known as USB 3.1 Gen 2
  • 20000M = 20000MBit/s = USB 3.2, also known as USB 3.2 Gen 2×2; or it could be USB4 Gen 2×2 or USB4 Gen 3×1
  • 40000M = 40000MBit/s = USB4 Gen 3×2

In fact, the names like USB 3.* are considered obsolete since only the connection speed really matters. Currently, the following designations are considered “relevant”:

  • SuperSpeed USB 5 Gbps
  • SuperSpeed USB 10 Gbps
  • SuperSpeed USB 20 Gbps

lsusb.py script to display USB devices in an understandable way

The lsusb.py script conveniently displays information about USB hubs and devices connected to them.

To display information, just run on the command line:


You may get an error that the lsusb.py command was not found. The lsusb.py script comes with the usbutils package, which contains another lsusb program we already use. For some reason, in some distributions the usbutils package is distributed without the lsusb.py script. To install it run the following commands:

curl https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usbutils.git/plain/lsusb.py.in > lsusb.py
chmod +x lsusb.py
sudo mv lsusb.py /usr/bin/lsusb.py

Lines starting with usb1, usb2, etc. are USB hubs.

Lines that start with 1-1, 1-3, 2-2, and so on are USB devices.

In addition to the manufacturer and device identifiers, each line in square brackets contains information about version, speed, and maximum power consumption, for example

  • USB 3.10
  • 5000 Mbps
  • 304mA

Device names are shown in parentheses.

UsbView – viewing a tree of USB devices in a graphical interface

You can find out the speed of USB connectors and devices with a program such as UsbView, which provides very detailed technical information.

USBView is a small GTK application that shows what a USB bus device tree looks like. It shows a graphical representation of the devices that are currently connected, showing the topology of the USB bus. It also displays information about each individual device on the bus.

Installing UsbView on Debian, Kali Linux, Linux Mint, Ubuntu and their derivatives:

sudo apt install usbview

Installing UsbView on Arch Linux, Manjaro, BlackArch and their derivatives:

sudo pacman -S usbview

During installation, the program will inform you that for it to work, you need to run the command

mount -t debugfs none /sys/kernel/debug

or add the line to the /etc/fstab file

none /sys/kernel/debug debugfs defaults 0 0

Instead, you can get by by running the program with superuser rights:

sudo usbview

The screenshot shows that the computer has 2 xHCI host controllers, one of them is version 3.10:

There are two devices connected to the controller version 3.10, one of the devices version 3.00 (note the line “USB Version: 3.00”).

And the other device is version 3.10:

Comparison of performance (data transfer rate) of OpenVPN over UDP and TCP

The previous article showed how to use OpenVPN with TCP instead of the default UDP. It is also known that the use of the TCP protocol is not recommended because, due to the “overhead” of the TCP transport protocol, less payload will be transmitted, since part of the channel will be occupied by the transmission of overhead information necessary to control the integrity of transmitted packets. But how exactly will switching from UDP to TCP affect the performance of the OpenVPN server and the speed of receiving and sending data? This article is devoted to the answer to this question.

My internet connection speed without using OpenVPN:

My internet connection speed using OpenVPN over UDP:

My internet connection speed using OpenVPN over TCP:

As you can see, the speed loss when migrating from UDP to TCP is quite significant. The difference in speed between the absence of OpenVPN and OpenVPN over UDP is negligible – in fact, in both cases, the speed is practically limited by the maximum bandwidth of my network.

See also:

What happens if Linux runs out of RAM. Do I need a Swap file

Linux installers create a swap file or partition by default. The Swap file is used when the RAM is full, in this case the system writes part of the data that is not needed right now from the RAM to the Swap file, which somewhat unloads the RAM. Subsequently, the system can re-move the data from the Swap file into RAM.

In modern Linux, the swap file can be easily created, moved, deleted, and resized. That is, now it is not a disk partition, in order to delete which you must always carry out somewhat risky disk partitioning operations.

Nevertheless, I noticed that in recent years when installing Linux, I persistently switch to manual partitioning in order to partition a disk without Swap. The point here is not only to save disk space (although sometimes this is really important when installing an operating system on a USB flash drive), but also in the fact that, in my opinion, the Swap file is more harmful than useful. For some users at least.

My computer has 32 gigabytes of RAM. In my typical use, I have 2-3 virtual machines running, my Writer text editor open, and a web browser running with a lot of tabs open. I usually have 10-20 Gigabytes of RAM occupied with infrequent peak uses up to 31 Gigabytes.

As you can see in the screenshot, I have my swap file disabled.

The problem with the Swap is that when it is used, the system slows down quite. In fact, if you only have 4 Gigabytes of RAM then Swap might be useful for you. But in this case, you need to put up with the possible “freeze” of the operating system.

If there is a lot of RAM, then its full consumption is usually associated with a software error. For example, look at the following screenshot – due to a software error, the system has used up all the RAM.

The memory ran out, the system forcibly terminated the problematic process and continued working without crashing.

If the swap file were present, then it would also be completely full, and the process would also be terminated. At the same time, during the use of the swap file, the system would start to slow down greatly, perhaps it would become inaccessible.

That is, the result is the same, but the time for the “agony” of the system is shorter.

Of course, terminating the process due to insufficient RAM will result in the loss of unsaved data. Therefore, if you think that you can completely use up RAM, then you need Swap.

If your system regularly uses Swap, then you need to increase the size of the RAM – this will have a good effect on the performance of your computer.

What are the differences and how to use the kill, pkill and killall commands

How to shutdown a process by process id

Each of the kill, pkill and killall commands are used to stop processes in Linux. In “How to use ps command to monitor Linux processes”, we looked at a number of ways to identify processes, including name, command, user, and terminal. We also looked at ways to identify processes by their dynamic attributes such as CPU and memory usage.

One way or another, we can define the processes that are running. Knowing their process ID, we can (if needed) stop any of these processes with the kill command. If we wanted to kill process 898, we would use this format:

sudo kill 898

Please be aware that in some cases the process will not terminate and will not display any errors or warnings. In fact, this command is a “recommendation”, it “asks” the process to exit. See the article “Why doesn't the kill command kill the process?” for details.

How to disable a process knowing its name

The pkill command allows you to kill processes by name. Make sure you define the correct process! This command will end the top process.

sudo pkill top

How to stop multiple processes by name

If you have multiple copies of a process running, or the process spawned multiple child processes (as Google Chrome can do), how can you shutdown them all? It's just as easy. We are using the killall command.

We have two instances of top running:

ps -e | grep top

We can terminate both of them with this command:

sudo killall top

This time no response means no problem, that is, both of these processes have been stopped.

Before killing the process

Make sure it's the one you want and make sure it doesn't cause any problems. In particular, it is worth checking this with the ps command running with the -H and --forest options to make sure there are no important child processes that you forgot about. See “How to use ps command to monitor Linux processes” for details.

ps -f --forest -C sshd

See also: Why doesn't the kill command kill the process?

How to use ps command to monitor Linux processes

The ‘ps’ (processes status) command is a built-in Unix/Linux utility for viewing information regarding the selection of running processes on the system: it reads this information from virtual files in the /proc file system. It is one of the essential system administration utilities, especially in the context of process monitoring, to help you understand what is happening on a Linux system.

ps has many options for manipulating the output, but you will find a small number of them practically useful for daily use.

The ps utility displays a snapshot of the processes on your Linux machine. You will be able to find processes by name, user or even terminal with as much detail as you need. This article has prepared many examples of using ps.

Linux process control

The heart of all Linux and Unix-like operating systems is the kernel. Among its many responsibilities is the allocation of system resources such as RAM and CPU time. They must be executed in real time so that all running processes get their fair share according to the priority of each task.

Sometimes tasks can be locked, or get stuck, or stop responding for other reasons. Or they can continue to run, but gobble up too much processor time or RAM, or behave in some similar antisocial manner. Sometimes tasks need to be killed to keep the system running smoothly. Of course, the first step is to identify the problematic process.

But perhaps you have no problem with tasks or performance at all. Perhaps you're just curious about what processes are running on your computer and would like to look under the hood of the Linux operating system. The ps command meets both of these requirements. It gives you a snapshot of what is happening inside your computer “right now”.

ps is flexible enough to provide you with exactly the information you need, in exactly the format you like. In fact, ps has a lot of options. The options described here will suit most common needs. If you want to take a deeper look at the ps command, familiarizing yourself with the ps command in this article and examples of using ps will make the man page easier for you.

Program for showing processes in Linux

The easiest way to use ps is to run it without parameters:


ps will show the list of processes in the given terminal.

There are four columns in the output:

  • PID: process identification number.
  • TTY: The name of the console the user is signed in to.
  • TIME: The amount of CPU time that the process consumed.
  • CMD: the name of the command that started the process

How to see all processes in Linux

Adding the -e (select all processes) option will make ps list the processes that were started by all users, not just the user running the ps command. Since this will be a long list, you can add the less command.

ps -e | less

Scrollable list of processes in less command:

There are many more process records now, but we see the same four columns as before. A question mark (?) In the TTY column means that the process was not started from a terminal window.

Displaying the hierarchy of processes (process tree in Linux)

If you see what processes other processes have started, sometimes it can help you figure out a problem or identify a specific process. For this we use the -H option.

ps -eH | less

Indentation indicates which processes are the parents of which other processes.

To add some clarity, we can ask ps to add some ASCII lines and draw a tree-like hierarchy. This can be done with the --forest option.

ps -e --forest | less

This makes it easier to keep track of which processes are the parents of other processes.

How to print a tree of a specific process

You can get the process tree of only the program you need as follows (replace “sshd” with the process you are interested in):

ps -f --forest -C sshd

Or like this:

ps -ef --forest | grep -v grep | grep sshd

The -C option will be discussed later in this article.

Filtering ps output by specific lines (by command name, for example)

You can pipe the output from ps through grep and find the process entries you want along any lines. Here we are looking for entries matching the search term “firefox”:

ps -e | grep firefox

In this case, the output is a single record for the process of interest. Of course, if we were running multiple instances of Firefox, there would be more than one item in the list.

More columns in ps output

To add additional columns to the output, use the -f (full format) option.

ps -ef | less

An additional set of columns is included in the ps output.

The following new columns have been added:

  • UID: User ID of the owner of this process.
  • PPID: Parent Process ID.
  • C: The number of children the process has.
  • STIME: Start time. The time when the process was started.

Using the -F (extra full format) option, we can get even more columns:

ps -eF | less

If you have a small terminal window, the columns we get this time require scrolling to the side to show them all. Pressing the Right Arrow key (→) shifts the display to the left.

The following columns have now been added:

  • SZ: The size of the RAM pages of the process image.
  • RSS: Resident Set Size. It is not the swapped physical memory used by the process.
  • PSR: The processor to which the process is assigned.

Do I need to put a hyphen in front of ps options

In some examples, you may see ps used with non-hyphen options or with long GNU-style options. For compatibility, ps supports all three formats. Non-hyphenated options are BSD style and the meaning of hyphenated and non-hyphenated options can be different!

An example of showing processes in BSD format:

ps au
# OR
ps axu

In this command, the meaning of the options is as follows:

  • u – user oriented format
  • a – removes the restriction “only own processes”
  • x – removes the restriction “only processes with a terminal”

Simply put, if you use “a” and “x” together, then all processes will be shown.

Be careful not to forget to hyphenate if you are using UNIX options, since ps will try to interpret it differently if it is ambiguous. In this manual, except for the example shown above, UNIX options are used everywhere.

Search for processes by process ID

Once you have found the process ID for the process you are interested in, you can use it with the ps command to display detailed information about that process. To do this, use the -p parameter after which specify a number – the process ID:

ps -p 3403

More than one process ID can be specified, separated by commas or spaces.

Search for processes by command name

The -C COMMAND option allows you to search for a process using the command name. That is, the name of the command that started the process. This is slightly different from a command line, which can include path names and parameters or options.

ps -F -C soffice.bin

Only information about the process started by the specified command is displayed:

There can be several processes if many instances of this command are running:

ps -F -C bash

How to see the flows of a process

To list all threads in a process, use the -H flag. The -L option will display the LWP (light weight process) column as well as the NLWP (number of light weight process) column.

ps -fL -C httpd

How to see the processes of a specific user

To see the processes owned by a specific user, use the -u USERNAME LIST option:

ps -u mial

Processes belonging to the mial user account are displayed.

How to list all processes started by root user

This is a special case of showing the processes of a certain user.

The command below allows you to view each process running with root privileges (a valid and effective identifier) in user format.

ps -U root -u root

Viewing group processes

If you want to list all processes belonging to a specific group (real group ID (RGID) or name), enter:

ps -fG www-data
ps -fG 33

To list all processes belonging to the effective group (or session) name, enter.

ps -fg www-data

Listing processes by terminal

To see the processes associated with a TTY, use the -t SPECIFY TTY option. When used without a TTY number, the -t option reports the processes associated with the current terminal window.

ps -t 1

All listed processes are associated with pts/1.

Selecting columns to display

With the -o FORMAT option, you can choose which columns you want to include in the ps output. Columns must be specified by name. From the ps manual:

man ps

you'll find a long list of column names in the “STANDARD FORMAT SPECIFIERS” section.

In the following example, we display the CPU time consumed by the process (pcpu), the processor's memory consumption (pmem) and the command that ran it along with the options (args):

ps -e -o pcpu,pmem,args | less

Note that the -o option does not add columns to the default set, but only displays the indicated fields.

Sorting output by columns

You can sort the output using the --sort option. Let's sort the output by the CPU column:

ps -e -o pcpu,pmem,args --sort -pcpu | less

The hyphen “-” means sorting from highest to lowest.

To see the ten most resource-intensive processes, pipe the output through the head command:

ps -e -o pcpu,args,args --sort -pcpu | head -10

We get a sorted, truncated list.

If we add more columns to display, we can sort by more columns.

Without a hyphen or with a “+” sign, sorting is performed from smallest to largest.

Let's add the pmem column to the sort:

ps -e -o pcpu,pmem,args --sort -pcpu,pmem

Sorting is still performed by pcpu value, but if these values are the same for some records, then pmem sort is performed for these values.

Let's make the output a little more useful and add a process id (pid) column so we can see the process number of each process in our listing.

ps -e -o pid,pcpu,pmem,args --sort -pcpu,pmem | head -10

We can now identify the processes.

All possible ps fields

To see all possible ps fields, run this command:

ps L

You can use these fields with the -o option.

Custom ps output examples

The command below allows you to see the PID, PPID, username and command of the process.

ps -eo pid,ppid,user,cmd

Below is another example of a custom output format showing the file system group, nice value, start time, and elapsed time of the process.

ps -p 1154 -o pid,ppid,fgroup,ni,lstart,etime

How to find the name of a process by PID

To find the name of a process using its PID.

ps -p 1154 -o comm=

Show parent and child processes

To select a specific process by its name, use the -C flag, this will also display all of its child processes.

ps -C sshd

To find all PIDs of all process instances, which is useful when writing scripts that need to read the PIDs from the stdin.

ps -C httpd -o pid=

How to shutdown a process by process id

We've covered a number of ways to identify processes, including name, command, user, and terminal. We also looked at ways to identify processes by their dynamic attributes such as CPU and memory usage.

One way or another, we can define the processes that are running. Knowing their process ID, we can (if needed) stop any of these processes with the kill command. If we wanted to kill process 898, we would use this format:

sudo kill 898

See also: What are the differences and how to use the kill, pkill and killall commands

Please be aware that in some cases the process will not terminate and will not display any errors or warnings. In fact, this command is a “recommendation”, it “asks” the process to exit. See the article “Why doesn't the kill command kill the process?” for details.

How to disable a process knowing its name

The pkill command allows you to kill processes by name. Make sure you define the correct process! This command will end the top process.

sudo pkill top

How to stop multiple processes by name

If you have multiple copies of a process running, or the process spawned multiple child processes (as Google Chrome can do), how can you shutdown them all? It's just as easy. We are using the killall command.

We have two instances of top running:

ps -e | grep top

We can terminate both of them with this command:

sudo killall top

Usually no response means no problem, that is, both of these processes have been stopped.

Before killing the process

Make sure it's the one you want and make sure it doesn't cause any problems. In particular, it is worth checking with the -H and --forest options to make sure there are no important child processes that you forgot about.

Troubleshooting Linux system performance

If your system is not working properly, for example, if it is unusually slow, you can troubleshoot some system problems as follows.

To find all the processes consuming the most memory and CPU in Linux:

ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%mem | head


ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%cpu | head

Displaying security information

You can show the security context (specifically for SELinux) as follows:

ps -eM


ps --context

You can also display security information in a user-defined format with this command:

ps -eo euser,ruser,suser,fuser,f,comm,label

Monitor your processes in real time with the watch utility

Finally, because ps displays static information, you can use the watch utility to continuously update the screen information and monitor processes in real time with repeated output. In this example, the information will be updated every second. Specify your own ps command to suit your purpose.

watch -n 1 'ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%mem | head'

See also:

How to find out which process is causing high disk usage in Linux

Monitoring input and output operations

Excessive load on the disk can be caused by such a reason as a virus infection or incorrect program settings. In any case, you need to start by identifying the process (program) that most reads and writes to disk.

iotop – analog of top for tracking disk load in real time

The top program allows you to see which processes are consuming the most CPU time and RAM, but does not say anything about disk usage, reads and writes to disk.

See also: How to use the top command to monitor Linux processes

The iotop program shows the speed of reading and writing to the disk, as well as the percentage of paging file used by each process.

To install iotop on Debian, Linux Mint, Kali Linux, Ubuntu and their derivatives, run the command:

sudo apt install iotop

To install iotop on Arch Linux, BlackArch, Manjaro and their derivatives, run the command:

sudo pacman -S iotop

The program requires elevated privileges to run:

sudo iotop

The program output contains the following columns:

  • TID – process identifier
  • PRIO – process priority
  • USER – the user who owns the process
  • DISK READ – disk read speed
  • DISK WRITE – disk write speed
  • SWAPIN – the percentage of swap file used
  • IO> – percentage of all I/O operations
  • COMMAND – the command that started the process

Using the cursor right () and left () keys, you can switch between columns, simultaneously choosing which of them will be sorted by.

With the buttons “Home” and “End” you can switch between the outermost columns.

Pressing any key will refresh the window.

Press “q” to exit.

By pressing the “o” key, you will switch to showing only active processes, that is, only processes that write and read data from persistent storage. You can get the same result by running the program with the -o option:

sudo iotop -o

Pressing the “o” key again will return the display of all processes.

Descending sorting is used by default, using the “r” button you can switch between descending and ascending sorting.

The “p” button toggles between displaying processes and streams.

By default, read and write speeds are shown, using the “a” button you can switch to displaying the total amount of written and read data.

iotop has several options that allow you to control the behavior of the program, for example, the following command will work in batch mode (-b), showing the total amount of written and read data (-a) only for active processes (-o), to the output data will be appended timestamp (-t), only systemd-journald information will be filtered from all processes (grep 'systemd-journald'):

iotop -b -a -o -t | grep 'systemd-journald'

pidstat – Display statistics for Linux tasks

The sysstat package contains two utilities at once with which you can collect statistics on disk usage by processes:

  • pidstat
  • iostat

To install pidstat on Debian, Linux Mint, Kali Linux, Ubuntu and their derivatives, run the command:

sudo apt install sysstat

To install pidstat on Arch Linux, BlackArch, Manjaro and their derivatives, run the command:

sudo pacman -S sysstat

The next command will display the accumulated statistics for every 20 seconds, only active processes will be shown (that have made read and write operations to the disk during the specified interval), and the full command that started the process will also be shown. For more complete statistics, run the program with elevated privileges:

sudo pidstat -dl 20

Each row will have the following columns:

  • Time stamp
  • UID: The real user identification number of the task being monitored.
  • USER: The name of the real user owning the task being monitored.
  • PID: The identification number of the task being monitored.
  • kB_rd/s: Number of kilobytes the task has caused to be read from disk per second.
  • kB_wr/s: Number of kilobytes the task has caused, or shall cause to be written to disk per second.
  • kB_ccwr/s: Number of kilobytes whose writing to disk has been cancelled by the task. This may occur when the task truncates some dirty pagecache. In this case, some IO which another task has been accounted for will not be happening.
  • iodelay: Block I/O delay of the task being monitored, measured in clock ticks. This metric includes the delays spent waiting for sync block I/O completion and for swapin block I/O completion.
  • Command: The command name of the task.

iostat – statistics of using devices and disk partitions

The iostat utility is also included in the sysstat package. As you might guess from the name of the program, it generates reports on I/O statistics for devices and partitions. Its peculiarity is that it shows generalized statistics for the entire system, as well as for individual disks, without breaking it down into processes. The iostat program can come in handy when you need to answer the question: “Which of the persistent media is most loaded?”

Running the program without options


will display two blocks of information:

  • CPU utilization report
  • device usage report

The section with device usage statistics contains the following columns:

  • Device: This column gives the device (or partition) name as listed in the /dev directory.
  • tps: Indicate the number of transfers per second that were issued to the device. A transfer is an I/O request to the device. Multiple logical requests can be combined into a single I/O request to the device. A transfer is of indeterminate size.
  • kB_read/s: Indicate the amount of data read from the device expressed in a number of kilobytes per second. Blocks are equivalent to sectors and therefore have a size of 512 bytes.
  • kB_wrtn/s: Indicate the amount of data written to the device expressed in a number of kilobytes per second.
  • kB_dscd/s: Indicate the amount of data discarded for the device expressed in a number of kilobytes per second.
  • kB_read: The total number of kilobytes read.
  • kB_wrtn: The total number of kilobytes written.
  • kB_dscd: The total number of kilobytes discarded.

The report is output for the entire system from the moment it was booted.

Since data is output in kilobytes by default, and modern volumes of information written to disk are usually multiples of a gigabyte, the numbers are difficult to read. To display numbers in human-readable units, use the -h option:

iostat -h

The -h option is the equivalent of specifying two options --human and --pretty at once, so if you are not completely satisfied with the appearance of the outputted report, then try using these options separately.

To display as much information as possible, use the -x option:

iostat -x

If you only want information about devices, then use the -d option:

iostat -d

You can run the command by specifying the interval time (in seconds) and the counter (number of reports) – in this case, the program will display information at the specified interval:


The first report will contain information from the moment the system was booted, and subsequent reports will contain information for the period since the previous report.

To find problems, you can use the following command, which will continuously print information:

iostat -d 1
iostat -dx 1

With iostat, you can monitor the read and write speed of the entire device, as well as identify discarded blocks.

htop command guide: how to view processes in Linux interactively

Is htop better or top?

The htop command is similar to top in function: they both display real-time information about processes, display system resource consumption, and allow you to search, stop, and manage processes.

Both commands have their own advantages. For example, the htop program implements a very convenient process search and filtering. In the top command, this is not so convenient – you need to know the button to display the search function.

But in top, you can split the window area and display information about processes in accordance with different settings. In general, top is much more flexible in customizing the display of processes.

In general, to decide which command is best for you, try both of them. This article will go into detail about htop, to get familiar with top refer to the article “How to use the top command to monitor Linux processes”.

How to install htop

Install a package named htop using your distribution's package manager.

On Debian, Linux Mint, Ubuntu, Kali Linux and their derivatives, run:

sudo apt install htop

On Arch Linux, Manjaro, BlackArch and derivatives run:

sudo pacman -Syu htop

How to view all processes in Linux

The htop command can be run by a regular user:


So to run it with superuser privileges, use sudo for this:

sudo htop

Superuser rights are needed only for some actions: to change the priority (nice) of processes, to close the processes of other users.

As with the top program, the window is divided into two main sections:

  • generalized information about the system
  • detailed information on processes

System information area

At the very top, the load on each core of the central processor is shown (numbers from 1 to 12).

Mem – the total amount of RAM and the memory used.

Task – generalized statistics on processes

Swp – swap file consumption level (if any)

Load average – average CPU load

Uptime – operating system uptime since the last boot

Now let's move on to the area with information about running processes.

Htop columns value

The htop program displays the following columns:


Process ID.


The username of the owner of the process, or ID if the name cannot be determined.


Priority is the internal kernel priority for the process, usually just nice plus twenty. Differs for processes with real-time execution priority.


NICE process value from 19 (low priority) to -20 (high priority). A higher value means that the process is “nice” to others and allows them to have a higher execution priority.


Process virtual memory size (M_SIZE).


The size of the resident set (text + data + stack) of the process (i.e. the size of the physical memory used by the process, M_RESIDENT).


The size of the shared pages of the process (M_SHARE).


STATE, the state of the process, can be:

S for sleeping (idle)

R for running

D for disk sleep (uninterruptible)

Z for zombie (waiting for parent to read its exit status)

T for traced or suspended (e.g by SIGTSTP)

W for paging


The percentage of CPU the process is currently using.


The percentage of memory the process is currently using (depending on the size of the process resident memory, see M_RESIDENT above).


The time measured in hours indicates how much the process has spent in user and system time.


The complete command line of the process (that is, the program name and arguments).

How to speed up or slow down the htop refresh rate

To set the update time for htop, use the -d option, after which specify the update time in tenths of seconds. For example, to make the program refresh the window every 1/10th of a second:

sudo htop -d 1

To make the program display new data every 5 seconds:

sudo htop -d 50

How to display processes in the form of a tree

To list processes as a tree, use the -t option:

sudo htop -t

Or, while the program is running, press the F5 key:

How to navigate the list of processes in htop

You can use the cursor keys (, , , ) to scroll through the list of processes.

The “PgUp”, “PgDn” keys also work for scrolling the window.

The “Home” button will move to the top of the list.

The “End” button will scroll to the end of the list.

Ctrl-a or ^ – scroll to the beginning of the item (beginning of the line).

Ctrl-e or $ – scrolls to the end of a process entry item (that is, the end of a line).

How to sort by memory consumption in htop. How to choose a field to sort

Press F6 to select the field you want to use for sorting.

To switch to the reverse sorting order, use the “I” (Shift+i) key. Pressing again will re-sort the list in reverse order.

How to collapse branches of a process tree in htop

In process tree mode, select the tree branch you want to collapse and press F6.

Searching and filtering processes in htop

Search differs from filtering in that the found processes are shown along with the rest, and you can switch between the found processes by pressing F3.

When filtering, only processes that match the pattern will be displayed on the screen.

Press F3 or “/” to go to process search. Press F3 to switch between found processes.

To filter processes, press F4 or “\” start typing the process name.

Press F4 and then Esc again to clear the filter.

How to change the priority of a process in htop

To increase the priority of the process (subtract from the nice value) press the F7 or “]” key. Remember that only the superuser can do this operation (you must be root or run htop with sudo).

To decrease the priority of the process (add to the nice value) press the F8 or “[” key.

How to select one or more processes in htop

Use “Space” to select processes. After that, the entered commands, such as kill or changing the priority, can be applied to the group of selected processes instead of the currently highlighted one.

To deselect all processes, press “U” (Shift+u).

How to close a process in htop

To close a process, select one or more processes and press F9 or “k”. A termination signal will be sent to the selected process. If no process is marked, then the one on which the cursor is currently located will be closed.

How to show the files that a process is using

If you want to see the files opened by the process, then highlight the process you are interested in and press the “l” (small Latin L) button.

The lsof utility must be installed on the system for this feature to work.

See also: How to use lsof to view open files (on Linux, everything is files)

How to change the appearance of htop

To change the appearance of the panel with information about the system, displayed columns, etc., press the F2 or “S” (Shift+s) button.

There you will see the following tabs:

  • Meters (information displayed at the top of the window about the CPU, memory, etc.)
  • Display options
  • Colors
  • Columns (change the order of columns, add and remove columns)

How to specify the field to sort when starting htop

Using the -s option, you can specify the column by which the processes will be sorted.

For example, to sort processes by the PERCENT_MEM column (percentage of memory used):

sudo htop -s PERCENT_MEM

To see all available columns for sorting, run the command:

htop --sort-key help

How to show only processes of a specific user

Use the -u option to a command like:

sudo htop -u USER

For example, to display processes of only user named mial:

sudo htop -u mial

How to show only the process with a certain number

To monitor only some processes, use the -p PID,PID… option. You can separate one or more process IDs, separated by commas. Only these processes will be shown in the htop window.

System call tracing

You can trace what system calls the process made. To do this, select the process you are interested in and press the “s” button.

For this function to work, you must have the strace utility installed.

How to close htop

Press F10 or “q” or Ctrl+c to exit the program.

If htop isn't enough for you, see “How to use the top command to monitor Linux processes”.