Applications and processes: Task Manager / Activity Monitor tour
On This Lesson 11 topics
Lesson Overview
People say "program", "app", "application", and "process" as if they were the same word. They are related, but they are not the same, and the difference is one of the most useful ideas in this module. In this lesson you will learn what each word means, why one app can run as several processes, and how to see the processes running on your own computer with the tool your system already has: Task Manager on Windows, Activity Monitor on macOS, or top and ps on Linux.
Why this matters: when a backend service is slow, stuck, or using too much memory, the first thing an engineer does is look at its process: how much CPU and RAM it is using, how long it has been running, and whether it is still alive. The skill you practise here is the same on a laptop and on a server.
This lesson builds on the earlier ones: processes use CPU time and RAM, and the operating system manages them.
Learning Objectives
By the end of this lesson you will be able to:
- Explain the difference between a program, an application, and a process.
- Explain what a process ID (PID) is and why it is useful.
- Explain why opening the same program twice can create two processes, and why one application can use several.
- Open the process list on your own system and find a process's name, PID, CPU use, and memory use.
- Explain the difference between a foreground application and a background process or service.
- Describe what happens to unsaved work when you force a process to end.
Written Explanation
Program, application, process
Three words, three ideas:
| Word | Meaning | Where it lives | Kitchen analogy |
|---|---|---|---|
| Program | A set of instructions saved as a file | Storage | A recipe in a cookbook |
| Application (app) | A program that a person uses to do a task | Storage | A recipe you use often, such as "pancakes" |
| Process | A program that is running right now, with its own memory | RAM, and the CPU is working on it | A cook actually making the pancakes at this moment |
The key sentence is: a program is a recipe, a process is the cooking.
A recipe in a cookbook does nothing by itself. It becomes useful when someone follows it. In the same way, a program file sitting on your SSD does nothing. When you open it, the operating system copies it into RAM and starts a process. The process has its own area of memory, its own place in the CPU's schedule, and its own number.
Two consequences follow:
- You can have many processes from one program. If two people make pancakes from the same recipe at the same time, there are two cooks and two batches. Open the same app twice, and you may have two processes. (Some apps share one process across several windows, so what you see depends on how the app is built.)
- One application can be several processes. A web browser, for example, often runs separate processes for different tabs or components, so a problem in one does not take everything down. How an app divides its work is up to its authors, and it can change between versions.
Text version of this diagram
On the left a box called Program: a file of instructions stored on the SSD. Two arrows lead to a group called In RAM: running processes, which holds two boxes, Process with PID 5120 and Process with PID 5388. Each process has its own memory and is running now. The same program started twice gives two processes with different PIDs.
The process ID (PID)
When the operating system starts a process, it gives it a unique number called the process ID, or PID. The PID identifies that one running process, so you can talk about it precisely, even when many processes have the same name.
Useful facts about PIDs:
- Two processes running at the same time never share a PID.
- The PID belongs to that run. If you close the app and open it again, it normally gets a different PID.
- Once a process has ended, its number can later be given to a new process. So do not treat a PID as a permanent name.
If you tell a colleague "something is wrong with the Java process", they may ask "which one?". Saying "PID 4312" is exact.
Foreground and background processes
Not every process has a window.
- A foreground application is one you interact with: your browser, a chat window, a game.
- A background process runs without a window. Examples are a program that syncs files, one that checks for updates, or the one that plays your notifications.
- A service (Windows) or daemon (macOS, Linux) is a background process that the operating system starts to provide an ongoing function, often at start-up and without any user logging in. A web server on a backend machine runs as one.
On a typical computer, a large share of the processes are system or background ones, which is normal. Seeing dozens or even hundreds of entries in the process list does not mean something is wrong.
Looking at processes on your own machine
Every operating system includes a tool for this. Menus and names change slightly between versions, so treat the steps below as a guide.
Windows: Task Manager
- Open it with Ctrl + Shift + Esc, or right-click the Start button and choose Task Manager. If it opens in a compact view, choose More details.
- The Processes tab lists apps and background processes with columns such as CPU and Memory. Click a column heading to sort.
- The Details tab lists every process and shows its PID. This is the easiest place to find PIDs. (You can also add a PID column to the Processes tab through the column header's right-click menu in some versions.)
- To stop a process, select it and choose End task.
Microsoft's documentation describes the Details tab as the place that shows each process's ID in the PID column.
macOS: Activity Monitor
- Open Activity Monitor from Applications > Utilities, or find it with Spotlight.
- The tabs CPU, Memory, and others list processes with the resources each uses. Click a column heading to sort.
- Use the menu View to choose which processes to show (for example all processes), and the columns that include PID.
- To stop a process, select it and use the Stop (X) button in the toolbar, then Quit or Force Quit.
Apple describes processes as the programs running on your Mac, which can be apps, system apps macOS uses, or invisible background processes.
Linux: top and ps
In a terminal, top shows live processes sorted by default by CPU use, with the PID in the first column. ps aux prints a snapshot list. Servers are usually inspected this way, because they often have no graphical interface.
Reading the numbers
| Column | What it tells you | Be careful |
|---|---|---|
| Name | Which program the process is running | Several processes can share a name |
| PID | The unique ID of this process | Changes if the process is restarted |
| CPU % | How busy the process is keeping the CPU | Tools differ: some show a share of the whole machine, others per core, so values can differ between tools |
| Memory | Roughly how much RAM the process is using | Different tools measure memory in different ways, so compare numbers within one tool, not across tools |
Two habits to build:
- Take a baseline first. Look at the numbers while the machine is idle, then again after you do something. The difference tells you what your action cost.
- Sort by the column you care about. Sort by Memory to find the biggest memory users, by CPU to find what is keeping the CPU busy.
Ending a process, and what you lose
If an app freezes, you can force its process to end (End task, Force Quit, or the kill command on Linux). This stops the process at once and frees its memory.
Remember Lesson 2: unsaved work lives in RAM, in the process's memory. Ending the process discards that memory. Force-ending an app loses any work that was not saved, and some apps may lose recent changes even if they have an autosave. Use it when you have to, and not for processes you do not recognise: some belong to the operating system, and ending them can cause the machine to misbehave or restart.
Examples
Example 1: two windows of one app (simple)
You open a text editor and then open it a second time to write another note. In the process list you may see two entries with the same name. Their PIDs are different, for example 5120 and 5388. They are two processes of the same program. (Some editors open a second window inside the same process, in which case you will see just one entry. Which you see depends on the app.)
Example 2: which process is using my RAM? (practical)
Your laptop becomes slow. You open Task Manager or Activity Monitor and click the Memory column to sort from highest to lowest. At the top is the browser, with a large figure. A few entries below there is a video editor that you forgot was open. You close the editor normally. The memory in use drops, and the machine speeds up. You did not need to guess: the tool showed which process was using the counter space.
Example 3: a frozen app (realistic)
A spreadsheet stops responding. You wait a minute, then open the process list, find the spreadsheet, and choose End task or Force Quit. The process stops and its RAM is freed. The changes you made since your last save are lost. The version in storage (from your last save) is still there. This is Lesson 2 in action: what is in RAM disappears with the process, what is in storage survives.
Backend Insight
On a server, the application you wrote is a process, often one that runs for weeks without anyone looking at it.
- Engineers find it by name and PID, then check its CPU and memory use to see whether it is healthy.
- A process whose memory use grows steadily and never falls is a typical sign of a memory problem, and the process list is where you first notice it.
- A backend that is "down" may mean the process has crashed or been killed. Tools that restart failed services for you work by watching the process.
- Several copies of the same program can be started as separate processes to share the load, each with its own PID.
The vocabulary from this lesson (program, process, PID, service) is the vocabulary of operating a backend.
Common Mistakes
Mistake 1: Treating program and process as the same thing
- Incorrect: "The program is using 400 MB."
- Correct: "The program is a file on disk. The running process is using 400 MB of RAM."
Mistake 2: Assuming one application equals one process
An application may use several processes, and an app with several windows may use only one. Look at the PIDs rather than guessing.
Mistake 3: Ending processes you do not recognise
An unfamiliar name is not a sign of a virus. Many are normal system processes. Search for the name first, and do not end system processes unless you know what they do.
Mistake 4: Comparing memory numbers between different tools
Tools measure memory differently, so numbers from different tools need not match. Compare readings taken from the same tool.
Mistake 5: Assuming a high number of processes means a problem
It is normal for a system to have many background processes. Look at what they use (CPU and memory), not at how many there are.
Exercises
Try each exercise yourself before opening the solutions. Items marked "hands-on" use your own machine.
Level A: Foundation
A1. In one sentence each, define program, application, and process.
Show solution A1
A1. A program is a set of instructions saved as a file. An application is a program a person uses to do a task. A process is a program that is running now, with its own memory and its own ID.
A2. What is a PID? Can two running processes have the same PID?
Show solution A2
A2. A PID is the unique number the operating system gives to a running process. Two processes running at the same time never share a PID. A number can be reused after a process ends.
A3. Where does a program live when it is not running? Where does it live when it is a process?
Show solution A3
A3. Not running: stored as a file in storage. Running: loaded into RAM and executed by the CPU as a process.
Level B: Application
B1. (Hands-on) Open the process list on your computer. How many processes are there? Pick any three and write down name, PID, and memory use.
Show solution B1
B1. Answers depend on your machine. The number is often in the dozens or hundreds, which is normal. Check that you recorded three different PIDs.
B2. Give an example of a foreground application, a background process, and a service.
Show solution B2
B2. Example: foreground application is a web browser window. Background process: a file-sync program. Service: a program the operating system starts at boot to provide a network or print function. Any valid examples are accepted.
B3. You close an app and open it again. Do you expect the same PID? Explain.
Show solution B3
B3. No, normally not. Each time you start the program, the operating system creates a new process and gives it a new PID. Numbers can be reused later, but you should not rely on getting the same one.
Level C: Challenge
C1. (Hands-on) Open an app that you can run twice. Count its processes before and after you open it a second time. Explain what you see, using the word PID.
Show solution C1
C1. Answers depend on the app. If a second process appears, the rows have different PIDs, so they are two processes of one program. If no new process appears, the app handles several windows in one process. Both are normal.
C2. A friend force-quits a frozen document editor and says "my document is gone, but the computer is broken". Explain what happened, in terms of RAM, storage, and processes, and what they could do to lose less next time.
Show solution C2
C2. The document was only in RAM, in the memory of the editor's process, because it had not been saved to storage. Force-quitting ended the process and discarded that memory, so the unsaved text is gone. The computer is fine. Next time save often or enable autosave, which copies the document from RAM to storage regularly.
C3. A backend process starts at 200 MB of RAM and grows by about 50 MB each hour. What would you expect after 24 hours, and what would you check?
Show solution C3
C3. After 24 hours: 200 + 24 x 50 = 1,400 MB (about 1.4 GB), if the growth stays constant. Steady growth that never falls suggests a memory problem such as data that is kept and never released. Check the process's memory over time, whether it is restarted regularly, and the application's logs, and report it to the developers.
Mini Challenge
Make a "process profile" of one application you use daily.
- Record, with the app closed and the machine otherwise idle, the total RAM in use.
- Open the app and find all of its processes. Record the names, PIDs, CPU %, and memory.
- Do one heavy action in the app (open a big file, play a video, load a heavy web page) and record the same numbers again.
- Write one sentence on what changed and why, using the words CPU, RAM, process, and PID.
Check your work: you took readings from one tool throughout, and your explanation says what the process did, not just what the numbers were.
Summary & Next Lesson
Key takeaways
- A program is a file of instructions. A process is that program running, with its own memory and a unique PID.
- One program can have several processes, and one application can be made of several processes.
- Foreground apps have windows. Background processes, services, and daemons run without one, and many of them are normal.
- Task Manager (Windows), Activity Monitor (macOS), and
toporps(Linux) show processes, their PIDs, CPU use, and memory use. - Ending a process discards what was only in its RAM, so unsaved work is lost.
- Backend engineers look at processes first when a service is slow or stuck.
Next lesson
Now you can read the list. The next lesson is a hands-on demonstration: you will watch RAM and CPU while opening apps, record what changes, and explain it with the terms from this module.
Self-check
- What is the difference between a program and a process?
- What is a PID used for?
- Can one application use more than one process?
- Which Windows tab shows PIDs most easily?
- Why does force-quitting an app lose unsaved work?
Show answers
- A program is a file of instructions, a process is that program running.
- To identify one specific running process precisely.
- Yes, many applications use several.
- The Details tab.
- Unsaved work is only in the process's RAM, and ending the process frees that memory.
References
- Microsoft Learn, Finding the process ID. It describes opening Task Manager and finding each process's ID in the PID column on the Details tab.
- Apple Support, View information about Mac processes in Activity Monitor. It describes processes as apps, system apps, and invisible background processes, and sorting by column. The PID column and the Ctrl + Shift + Esc shortcut are not stated on these pages; they are widely documented in third-party guides and should be confirmed on your own system.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.