How to view processes in Android: from system utilities to ADB

Analyzing running processes on Android is a key skill for diagnosing freezes, finding malware, or optimizing performance. Unlike Windows or Linux, where there are standard task managers for this, on mobile devices the functionality is often hidden or limited. This article will cover all available methods: from built-in tools to professional utilities for developers.

You will learn how to display a list of processes without root access, what data can be retrieved through ADB, and which applications provide the most detailed information about the background of running services. Particular attention is paid to the differences between versions of Android - from Android 10 to Android 14where Google has tightened restrictions on access to system data.

Important: some methods require turning on Developer mode or connecting to a PC. If you are a beginner, start with the section about built-in tools - they are safe and do not require additional knowledge.

1. Built-in Android task manager

The easiest way to see active processes is to use the standard system interface. On most devices (with the exception of "pure" Android from Google), manufacturers add their own task manager with advanced functions.

How to open:

• 📱 On Samsung: hold the button Recent applications (three vertical lines) → tap "Manager" tasks".
• 📱 On Xiaomi/Redmi/POCO: swipe up and hold → "Lock" → icon i in the upper right corner.
• 📱 On Google Pixel or "pure" Android: swipe up and hold → "Application information" (shows only foreground processes).

What you can see:

• 🔹 Process name (for example, com.android.chrome).
• 🔹 Used RAM (RAM).
• 🔹 Possibility of forced stop (Stop or Force Stop).

⚠️ Attention: Forced stop of system processes (for example android.process.media) can lead to malfunctions of the phone, including loss of data in the gallery or contacts. Do not stop processes whose names begin with android. or com.google. unless clearly necessary.

Method limitations:

• 🚫 Does not show background services (for example, account synchronization).
• 🚫 No information about CPU, network activity or root processes.
• 🚫 On Android 12+ some manufacturers hide details about system processes.

2. Using developer mode

For advanced users Developer mode gives access to hidden monitoring tools. You can activate it on any device:

1. Go to Settings → About phone → Software information.
2. Find the item Build number and tap on it 7 times in a row.
3. Return to the main settings menu - a new section will appear For Developers.

Inside developer mode, two key tools are available:

Tool	What it shows	How to use
Processes (Running services)	List of all active services, including system ones	Open For developers → ProcessesShows PID, package name And memory usage.
Process statistics (Process stats)	History of processes for the last 3/6/12/24 hour	Useful for finding "hungry" applications that periodically wake up.
Do not save actions (Don’t keep activities)	Forcibly closes processes after exiting the application	Enable for testing, but do not leave it constantly - this will disrupt the work of background tasks.

On Android 13+ in the "Processes" menu there may be no data about system services due to new privacy restrictions. In this case, use ADB (section 4) or third-party utilities.

3. Third-party monitoring applications

Play Market offers dozens of utilities for analyzing processes, but most of them require root-right for full work. We have selected the top 3 applications that provide maximum information without root:

• 🛠️ Simple System Monitor - shows CPU, RAM, network activity and temperature supports widgets on the home screen.
• 🔍 Process Manager (from Spica Apps) - sorts processes by resource consumption, allows you to kill tasks in batches. There is a search function by process name.
• 📊 DevCheck - does not specialize in processes, but shows CPU core load, swap usage and active connections.

How to select an application:

• 🔹 For basic monitoring (which applications are hanging in the background) is enough Simple System Monitor.
• 🔹 For virus scan or suspicious processes use Process Manager —it shows package signatures.
• 🔹 For performance analysis (lag, overheating) suitable DevCheck.

⚠️ Attention: Applications like Clean Master or DU Speed Booster often show false warnings about "viruses" or "optimization". They do not provide accurate information about processes and can themselves consume resources. Use specialized utilities from the list above.

Example data from Simple System Monitor:

PID: 1234
Name: com.whatsapp
CPU: 12% (core) 3)
RAM: 450 MB
Network: 1.2 Mbps (upload)

Package name (should not contain random characters)

CPU consumption (more than 20% without active use is suspicious)

Network activity (unknown applications should not transfer data)

Working time (process, working for days, can be a miner)

-->

4. ADB: professional process analysis

Android Debug Bridge (ADB) is a tool for developers that allows you to obtain low-level information about the system. To work you will need:

• 🖥️ A computer with Platform Tools.
• 📱 Enabled USB debugging on the phone (Settings → For developers → USB debugging).
• 🔌 USB cable (preferably original).

Basic commands for analyzing processes:

# Show all processes (including system ones)
adb shell ps -A

Show processes with details by CPU and RAM
adb shell top -m 20 -t

Filtering by name (for example, for Chrome)
adb shell ps | grep chrome

View open ports and connections
adb shell netstat

Example command output adb shell top:

User 2%, System 5%, IOW 0%, IRQ 0%
12345 0% S 120 450M com.android.chrome
12346 12% R 450 1.2G com.whatsapp

Column decoding:

• 🔢 PID — process identifier.
• 📊 %CPU — processor load.
• 🔄 S/R — status (S = sleeping, R = running).
• 📱 VSS/RSS —virtual and real memory.

⚠️ Attention: On Android 11+ some ADB commands may require additional permissions If you see. error permission denied, run adb root (requires an unlocked bootloader or root access).

How to save ADB output to a file?

Use output redirection:

adb shell top -n 1 > processes.txt

The file processes.txt will appear in the folder where the command was launched.

5. Process analysis via Logcat

Logcat is the Android system log, where logs of all processes are written, including errors and warnings. It can be used to diagnose freezes or search for suspicious activity.

How to open Logcat:

1. Connect your phone to the PC and run adb logcat in the terminal.
2. To filter logs for a specific process, use:

   adb logcat | grep "com.example.app"

3. To save logs to a file:

   adb logcat -d > log.txt

Examples of useful filters:

• 🔍 adb logcat -s "ActivityManager" - will show the startup and stopping of applications.
• 🔍 adb logcat | grep "ANR" - will find freezes (Application Not Responding).
• 🔍 adb logcat | grep "crash" - will display failures applications.

What to look for in the logs:

• 🚨 Repeated errors E/ (for example, E/AndroidRuntime) indicate crashes.
• 🚨 Messages W/ActivityManager: Timeout —the application is not responding.
• 🚨 Entries with NetworkSecurityConfig —possible problems with certificates (often found in malware).

6. Viewing processes on rooted devices

If your smartphone has root accessadditional opportunities for analyzing processes open up. The main advantage is access to system processes and the ability to modify them.

Popular utilities for root:

• 🛡️ Root Explorer — allows you to view process files in /proc/.
• 🔧 SystemPanel 2 —shows process tree, threads i file descriptors.
• 📈 BetterBatteryStats - analyzes processor wake-ups (wakelocks) and background activity.

How to view processes through /proc/:

1. Open Root Explorer and go to /proc/.
2. Each folder with a numeric name (for example, /proc/1234) corresponds to a process with PID=1234.
3. Inside the folder, find the files:
   • status — process state.
   • cmdline — launch command.
   • fd/ —open files and sockets.

Example content /proc/1234/status:

Name:   chrome
State:  S (sleeping)
Tgid:   1234
Pid:    1234
PPid:   456
VmSize: 1.2 GB
Threads: 45

⚠️ Warning: Deleting or modifying files in /proc/ may lead to crash systems. Do not change anything if you are not sure of the consequences. Also, some banking applications (for example, SberBank Online) can block work on rooted devices.

7. Online services for analyzing suspicious processes

If you find unknown process and want to check its security, use online services:

Service	What it checks	How to use
VirusTotal	The presence of the package in the virus databases (60+ antiviruses)	Enter the package name (for example, com.malware.example) into the search bar.
APKCombo	Information about the application by package name	Helps to find out the developer and description if the process is masquerading as legitimate.
Google Play	Official availability applications in the store	Enter search pub: package_name (for example, pub:com.whatsapp).

Signs of a suspicious process:

• 🚩 The package name contains random characters (for example, com.a1b2.c3d4).
• 🚩 The process consumes CPU/RAM for no apparent reason.
• 🚩 The logs (logcat) contain entries about network connections to unknown IPs.
• 🚩 Process not found in Google Play or VirusTotal shows warnings.

If you have confirmed that the process is malicious:

1. Uninstall the application through Settings → Applications.
2. Check your device antivirus (for example, Malwarebytes).
3. If the process is a system one, perform a factory reset.

FAQ: Frequently asked questions about processes in Android

Is it possible to see processes without root access?

Yes, but with limitations. Built-in task manager and ADB will show most user processes, but system services may be hidden on new versions of Android. Third-party applications like Simple System Monitor also work without root, but do not provide complete information.

Why does the process mediaserver load the CPU?

The process mediaserver is responsible for processing multimedia (photo, video, sound). High load can be caused by:

• 🎵 Playing music/video.
• 📸 Indexing new photos in the gallery.
• 🐞 Codec failure (try rebooting the device).

If the load is constant, check the gallery for damaged files or update the firmware.

How to kill a process that is not killed through "Force Stop"?

If the standard stop does not works:

1. Use ADB:

   adb shell am force-stop com.example.app

2. On rooted devices:

   su
   kill -9 PID_process

3. Reboot the phone in Safe Mode (hold the power off button → "Reboot in safe mode").

If the process is a system one and is not killed, it may be a virus with superuser rights. Reset to factory settings.

What is a process zygote and why does it consume a lot of memory?

Zygote is a system process responsible for starting all Java applications. It creates templates (forks) for new applications, which speeds up their launch. High memory consumption (100-300 MB) is normal because:

• 🔄 It caches frequently used libraries.
• 📱 On devices with large amounts of RAM, it may take up more. space.

If zygote consumes >500 MB or is frequently restarted, this may indicate:

• 🐞 Failure Android Runtime (ART).
• 🦠 A virus that modifies system processes.

How to track which application is draining the battery through processes?

Use a combination of tools:

1. ADB to monitor the CPU:

   adb shell top -m 10 -s cpu

2. Logcat to find wakeups:

   adb logcat | grep "wakelock"

3. Third-party utilities like BetterBatteryStats (requires root) or AccuBattery.

Pay attention to processes that:

• 🔋 Constantly keep the CPU at >5%.
• 🔄 Wake up the device (wakelocks) more than 1 time per minute.
• 📡 Use mobile data in the background (check in Settings → Data transfer).