# Use find, ps, top, and kill Safely on Linux You are diagnosing a Linux host where an application is consuming unexpected resources and may need to be stopped. Explain how you would use `find`, `ps`, `top`, and `kill` during the investigation. Give representative commands, explain what each command tells or changes, and make the sequence safe for a production environment. ### Constraints & Assumptions - You have ordinary shell access and may not have permission to inspect or signal every process. - File names may contain spaces or leading dashes. - Several processes may have similar names, and process IDs can be reused. - The goal is to gather evidence before making a narrowly targeted change. ### Clarifying Questions to Ask - Are we locating files, identifying a process, diagnosing resource use, or all three? - Is the process supervised by a service manager that should perform the stop? - What user owns the process, and is graceful shutdown required to protect in-flight work or data? - Which filesystem paths are in scope, and can the search cross mount points? ### What a Strong Answer Covers #### `find` - Choosing an explicit search root, predicates such as name, type, owner, size, or modification time, and safe handling of matched paths. - Previewing matches before any action and avoiding broad or unquoted destructive commands. #### `ps` and `top` - Using `ps` for a point-in-time process snapshot and `top` for an updating view of CPU, memory, state, and load. - Confirming the exact PID, owner, command, parent, start time, and relevant resource signal rather than matching a name alone. #### `kill` - Understanding that `kill` sends a signal, normally `SIGTERM`, rather than directly guaranteeing termination. - Preferring a graceful, narrowly targeted stop; verifying the result; and reserving `SIGKILL` for justified escalation. ### Follow-up Questions 1. Why is parsing `ps | grep` often less reliable than selecting processes by explicit fields or using `pgrep`? 2. What can go wrong between identifying a PID and signaling it? 3. How would you safely process `find` results whose names contain whitespace or newlines? 4. When should a service manager be used instead of signaling a worker directly?