ps and top show process evidence from different views. A high CPU figure identifies a candidate, not permission to kill every process. Match the command and PID to the incident, then signal only that process. Another writer may be preserving logs and must remain running.
The simulator shows a stable snapshot so the task is repeatable. Real process lists change, and a PID from an old note should be verified before use. kill sends a termination signal by default. It is a request for the process to stop, so inspect ps again afterward. A forced kill skips the program's normal cleanup and shouldn't be the first response to an unexplained high reading. Keep the evidence writer running so the incident record survives the repair.