Everyday Linux ps command Examples for System Admin

April 24, 2011 | By
| Reply More

Linux/Unix system administrator should be very proficient in performance monitoring and tuning. For performance monitoring, administrator should understand how various Linux component and processes works (like CPU, Memory, I/O and Network). Process status (PS) is a command used to display current running processes on Unix/Linux operating systems. This command is commonly used for process monitoring. Whenever you feel that system become slow, this is a very useful command to troubleshoot. If you have process which seems to hang and you want to stop the process, then you need pid of the process so that you can terminate by using kill command.

Enter ps faux--cumulative to quickly list all running processes. Output will resemble the following:

USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.1 1516 520 ? Ss May30 0:05 init [2]
root 1559 0.0 0.1 1564 536 ? Ss May30 0:00 /sbin/syslogd
root 1579 0.0 0.2 2512 1228 ? S May30 0:00 /bin/sh /usr/bin/
root 1598 0.0 0.1 2512 560 ? S May30 0:00 \_ /bin/sh /usr/
mysql 1599 0.0 3.2 97960 16464 ? S May30 0:02 \_ /usr/sbin
root 1600 0.0 0.0 1496 504 ? S May30 0:00 \_ logger -p
daemon 1673 0.0 0.0 1696 368 ? Ss May30 0:00 /usr/sbin/atd
root 1676 0.0 0.1 1776 748 ? Ss May30 0:02 /usr/sbin/cron
root 1683 0.0 0.8 10516 4216 ? S May30 0:00 /usr/sbin/apache
www-data 1696 0.0 0.3 10520 1988 ? S May30 0:00 \_ /usr/sbin/apa
www-data 1697 0.0 0.3 10520 1960 ? S May30 0:00 \_ /usr/sbin/apa
root 11830 0.0 0.1 3472 896 ? Ss May30 0:03 /usr/sbin/sshd
root 28133 0.0 0.3 14576 2000 ? Ss 02:38 0:00 \_ sshd: root@pt
root 28166 0.0 0.2 2568 1412 pts/0 Rs 02:38 0:00 \_ -bash
root 13826 0.0 0.1 2500 816 pts/0 R+ 03:49 0:00 \_ ps fa

ps -faux

Column Names

Commonly-used columns:

1. USER - Username - The name of the user associated with the process.
2. PID - Process ID - The unique numeric identifier assigned to the process.
3. %CPU - Percentage of CPU - Time used (total CPU time divided by length of time the process has been running).
4. %MEM - Percentage of RAM - Memory used (memory used divided by total memory available).
5. VSZ - Virtual Memory Size - Size of the process in virtual memory expressed in KiB.
6. RSS - ???
7. TTY - Terminal controlling the process.
8. STAT - Process State - Possible values:
* R - Running.
* S - Sleeping (may be interrupted).
* D - Sleeping (may not be interrupted) - used to indicate process is handling input/output.
* T - Stopped or being traced.
* Z - Zombie or "hung" process.
9. START - The date or time at which the process started.
10. TIME - Cumulative CPU time used by the process and the child processes started by the process.
11. COMMAND - Command used to start the process.

1) Show Every process on the system

This shows every process on the system using standard syntax and displays them in full-format listing. This is an overview of every process that runs on the system at the given moment.

Options:
-e selects all processes. Identical to -A.
-f does full-format listing. This option can be combined with many other UNIX-style options to add additional columns. It also causes the command arguments to be printed. When it is used with -L, the NLWP (number of threads) and LWP (thread ID) columns will be added. See the c option, the format keyword args and the format keyword command.

# ps –ef

2) All processes run by a specific user

This shows all the process that are run by a specific user. This is useful to check all the processes run by a normal user or check the process run by a specific service like apache or postfix.

Options:
-u userlist selects by effective user ID (EUID) or name. This selects the processes whose effective user name or ID is in userlist. The effective user ID describes the user whose file access permissions are used by the process (see geteuid(2)). Identical to U and --user.

# ps -u postfix
PID TTY TIME CMD
2224 ? 00:00:00 pickup
2225 ? 00:00:00 qmgr

ps user

3) Top 10 memory consuming processes

This shows the top 10 memory consuming processes running on the system. It is useful to see what processes are the most memory consuming.

Options:
--sort spec specifies sorting order. Sorting syntax is [+|-]key[,[+|-]key[,...]]. Choose a multi-letter key from the STANDARD FORMAT SPECIFIERS section. The "+" is optional since default direction is increasing numerical or lexicographic order. Identical to k. For example: ps jax --sort=uid,-ppid,+pid

# ps -auxf | sort -nr -k 4 | head -10
root 3025 3.2 13.0 1600004 245276 ? Sl 10:00 2:01 \_ /usr/bin/gnome-shell
root 2261 0.5 1.8 188108 34540 tty1 Rs+ 09:49 0:25 \_ /usr/bin/Xorg :0 -background none -verbose -auth /run/gdm/auth-for-gdm-fTksZM/database -seat seat0 -nolisten tcp vt1
root 3089 0.0 1.2 1060728 22608 ? Sl 10:00 0:00 /usr/bin/nautilus --no-default-window
root 2957 0.0 1.2 998384 23244 ? Sl 10:00 0:00 \_ /usr/libexec/gnome-settings-daemon
root 3482 0.0 1.0 632688 19344 ? Rl 10:07 0:02 /usr/libexec/gnome-terminal-server
root 3181 0.1 1.0 349960 20280 ? S 10:00 0:07 /usr/bin/vmtoolsd -n vmusr
root 802 0.0 0.9 550008 18036 ? Ssl 09:49 0:01 /usr/bin/python -Es /usr/sbin/tuned -l -P
root 950 0.0 0.8 102312 15580 ? S 09:49 0:00 \_ /sbin/dhclient -d -sf /usr/libexec/nm-dhcp-helper -pf /var/run/dhclient-eno16777736.pid -lf /var/lib/NetworkManager/dhclient-42456ebc-a752-4950-9adf-1b8bc29f43eb-eno16777736.lease -cf /var/lib/NetworkManager/dhclient-eno16777736.conf eno16777736
root 3154 0.0 0.8 898940 15300 ? Sl 10:00 0:00 /usr/libexec/evolution-calendar-factory
root 3020 0.0 0.8 551480 16420 ? Sl 10:00 0:00 /usr/libexec/goa-daemon

ps memory

4) All threads of a specific process id

This will show all the threads of a particular process pid.

Options:
-L show threads possibly with LWP and NLWP columns.

# ps -Lf -p 3482
UID PID PPID LWP C NLWP STIME TTY TIME CMD
root 3482 1 3482 0 4 10:07 ? 00:00:03 /usr/libexec/gnome-terminal-server
root 3482 1 3483 0 4 10:07 ? 00:00:00 /usr/libexec/gnome-terminal-server
root 3482 1 3484 0 4 10:07 ? 00:00:00 /usr/libexec/gnome-terminal-server
root 3482 1 3487 0 4 10:07 ? 00:00:00 /usr/libexec/gnome-terminal-server

ps thread

5) Child of a parent process

This will display all child processes of a process and is useful in finding out what processes have been forked out of this main process.

# ps -o pid,pcpu,pmem,uname,comm -C apache2
PID %CPU %MEM USER COMMAND
2642 0.0 3.4 www-data apache2
4185 0.0 3.6 www-data apache2
4186 0.0 3.3 www-data apache2
4187 0.0 3.3 www-data apache2
5359 0.0 3.3 www-data apache2
13343 0.0 3.5 www-data apache2
17228 0.0 3.5 www-data apache2
21037 0.0 3.4 www-data apache2
22011 0.0 2.9 www-data apache2
23169 0.0 0.1 root apache2
25128 0.0 3.3 www-data apache2
32084 0.0 0.0 www-data apache2

ps child

6) How long a process has run

This will show for how long a process has run on the system.

# ps -e -o pid,comm,etime | grep mysql
3107 mysqld_safe 18-07:01:53
3469 mysqld 18-07:01:52

ps child

Filed Under : LINUX COMMANDS, LINUX HOWTO

Tagged With : ,

Free Linux Ebook to Download

Leave a Reply

Commenting Policy:
Promotion of your products ? Comment gets deleted.
All comments are subject to moderation.