Inspect running processes

I need a quick inventory of what's actually running on server db-prod-01 right now and which users started those processes. Give me a one-screen list sorted by CPU then memory with full command lines, PID, user, start time, and the TTY if any. Highlight any process older than 72 hours or owned by users nobody recognizes (list unknown usernames). I will review before taking action.

Before I escalate to the dev team, make this process list easy for them to scan: surface the top three CPU and top three memory consumers up top, show their full command lines and parent PID, and flag any process with a nonstandard binary path or that runs from /tmp or a user home. Add a short note on whether the binary has been modified in the last 30 days.

I just noticed a single process on db-prod-01 consuming almost all CPU. The process is owned by user deploy, PID 18472, started six days ago by a systemd service. I don't know if it's part of the deployment or a runaway. I am worried killing it will interrupt a live deployment or corrupt writes. What's the most likely cause and the safest next step to diagnose without breaking production?

We keep finding long-running processes started by forgotten cronjobs or one-off deploys that later hog CPU and confuse monitoring. This costs us emergency pages and mistrust from developers. What operational habit should I change so every long-running process is traceable and safely reclaimable, and give the concrete steps to implement it in our team?