What is process ID?

What is a process ID?

Every program that runs becomes one or more processes, and the operating system kernel labels each one with a number, its PID. The number exists only while the process runs. Close a program and start it again, and it gets a new PID; once a process ends, its number can later be reused. That is why tickets and scripts should record the program name along with the PID.

Every process also has a parent. On Linux, the parent's number is the PPID, and the chain leads back to PID 1, the init system (systemd on most current distributions), which the kernel starts at boot. On Windows, two low numbers are fixed: PID 0 is the System Idle Process and PID 4 is the System process.

Finding PIDs on Linux and macOS

• ps aux or ps -ef: a snapshot of all processes with PID, owner and resource use; ps -ef also shows the PPID
• top (or htop where installed): a live view sorted by CPU or memory use
• pgrep firefox (or pidof firefox on Linux): prints the PIDs for a program name
• ps aux | grep firefox: a quick text search through the process list
• Activity Monitor on macOS shows a PID column

Ending a process by PID on Linux

Try plain kill first and use -9 only when the process ignores it. Ending another user's process or a system process requires sudo. A service managed by systemd may just start again, so stop it with systemctl stop instead.

Finding and using PIDs on Windows

• Task Manager: the Details tab lists every process with its PID. On the Processes tab, right-click a column header to add a PID column. The Services tab shows the PID of each running service.
• Resource Monitor: shows PIDs alongside CPU, disk, network and memory activity, and can search for the process that holds a file open.
• tasklist: lists image names and PIDs; tasklist /FI "PID eq 2345" filters to one process.
• taskkill /PID 2345: ends a process by number. Add /F to force it and /T to end its child processes too; taskkill /IM notepad.exe ends by image name.
• PowerShell: Get-Process lists processes with an Id column, and Stop-Process -Id 2345 ends one.

Real-world uses

• Which program owns this connection? On Windows, netstat -ano shows the owning PID for each connection and listening port. Look up that PID in Task Manager's Details tab or with tasklist to name the program, a common step when a suspicious connection turns up.
• Several processes share one name. A browser or svchost.exe often runs many copies. The PID tells you exactly which one is using the CPU or memory.
• Frozen app. When the normal close fails, end that one PID rather than restarting the whole machine.

Process ID on the CompTIA A+ exam

PIDs come up in Core 2 (220-1202) objective 1.9, with Linux commands such as ps, top and kill, and in objective 1.4, with Windows tools such as Task Manager. Know that a PID identifies one running instance, that it changes each time a program starts, and which tool shows or ends it on each OS. If a question asks how to stop a hung process on Linux, think ps or top to find the PID, then kill. On Windows, think Task Manager's Details tab or taskkill /PID.