14 Linux ps Command with Practical Examples

Linux ps command is a built-in tool to capture current processes on the system. It will capture the system condition at a single time. If you want to have repetitive updates in a real-time, we can use the top command.

In this tutorial, I will show you common practical example of ps command which helps for your daily Linux system administration.

1) Run ps without any options

This is a very basic ps usage. Just type ps on your console to see its result.

ps with no options

By default, it will show us 4 columns of information.

  • PID is a Process ID of the running command (CMD)
  • TTY is a place where the running command runs
  • TIME tell about how much time is used by CPU while running the command
  • CMD is a command that runs as a current process

This information is displayed in an unsorted result.

2) Show all current processes

To do this, we can use -a options. As we can guess, -a is stand for “all”. While x will show all process even the current process is not associated with any TTY (terminal)

$ ps -ax

This result might be a long result. To make it easier to read, combine it with less command.

$ ps -ax | less

ps all information

3) Filter processes by its user

For some situation, we may want to filter processes by a user. To do this, we can use -u option. Let say we want to see what processes which run by user pungki. So the command will be like below

$ ps -u pungki

filter by user

4) Filter processes by CPU or memory usage

Another thing that you might want to see is to filter the result by CPU or memory usage. With this, you can grab information about which processes that consume your resource. To do this, we can use aux options. Here’s an example of it :

$ ps -aux | less

show all information

Since the result can be in a long list, we can pipe less command into ps command. Explaining each term in the result.

1. USER - Username : The name of the user associated with the process.
2. PID - Process ID : The unique numeric identifier assigned to the process.
3. %CPU - Percentage of CPU: Time used (total CPU time divided by length of time the process has been running).
4. %MEM - Percentage of RAM Memory: used (memory used divided by total memory available).
5. VSZ - Virtual Memory Size: Size of the process in virtual memory expressed in KiB.
6. RSS - Resident Set Size.
7. TTY - Terminal controlling the process.
8. STAT - Process State - Possible values.
* R - Running.
* S - Sleeping (may be interrupted).
* D - Sleeping (may not be interrupted) - used to indicate process is handling input/output.
* T - Stopped or being traced.
* Z - Zombie or "hung" process.
9. START: The date or time at which the process started.
10. TIME: Cumulative CPU time used by the process and the child processes started by the process.
11. COMMAND: Command used to start the process.
By default, the result will be in unsorted form. If we want to sort by particular column, we can add --sort option into ps command.

Sort by the highest CPU utilization in ascending order

$ ps -aux --sort -pcpu | less

sort by cpu usage

Sort by the highest Memory utilization in ascending order

$ ps -aux --sort -pmem | less

sort by memory usage

Or we can combine it into a single command and display only the top ten of the result :

$ ps -aux --sort -pcpu,+pmem | head -n 10

5) Top 10 memory consuming processes

This shows the top 10 memory consuming processes running on the system. It is useful to see what processes are the most memory consuming.

--sort spec specifies sorting order. Sorting syntax is [+|-]key[,[+|-]key[,...]]. Choose a multi-letter key from the STANDARD FORMAT SPECIFIERS section. The "+" is optional since default direction is increasing numerical or lexicographic order. Identical to k. For example: ps jax --sort=uid,-ppid,+pid
# ps -auxf | sort -nr -k 4 | head -10
root 3025 3.2 13.0 1600004 245276 ? Sl 10:00 2:01 \_ /usr/bin/gnome-shell
root 2261 0.5 1.8 188108 34540 tty1 Rs+ 09:49 0:25 \_ /usr/bin/Xorg :0 -background none -verbose -auth /run/gdm/auth-for-gdm-fTksZM/database -seat seat0 -nolisten tcp vt1
root 3089 0.0 1.2 1060728 22608 ? Sl 10:00 0:00 /usr/bin/nautilus --no-default-window
root 2957 0.0 1.2 998384 23244 ? Sl 10:00 0:00 \_ /usr/libexec/gnome-settings-daemon
root 3482 0.0 1.0 632688 19344 ? Rl 10:07 0:02 /usr/libexec/gnome-terminal-server
root 3181 0.1 1.0 349960 20280 ? S 10:00 0:07 /usr/bin/vmtoolsd -n vmusr
root 802 0.0 0.9 550008 18036 ? Ssl 09:49 0:01 /usr/bin/python -Es /usr/sbin/tuned -l -P
root 950 0.0 0.8 102312 15580 ? S 09:49 0:00 \_ /sbin/dhclient -d -sf /usr/libexec/nm-dhcp-helper -pf /var/run/dhclient-eno16777736.pid -lf /var/lib/NetworkManager/dhclient-42456ebc-a752-4950-9adf-1b8bc29f43eb-eno16777736.lease -cf /var/lib/NetworkManager/dhclient-eno16777736.conf eno16777736
root 3154 0.0 0.8 898940 15300 ? Sl 10:00 0:00 /usr/libexec/evolution-calendar-factory
root 3020 0.0 0.8 551480 16420 ? Sl 10:00 0:00 /usr/libexec/goa-daemon

ps memory

6) Filter processes by its name or process ID

To do this, we can use -C option followed by the keyword. Let say, we want to show processes named getty. We can type :

$ ps -C getty

filter by its name or process ID

If we want to show more detail about the result, we can add -f option to show it on full format listing. The above command will look like below :

$ ps -f -C getty

filter by its name or process ID

7) Filter processes by a thread of the process

If we need to know the thread of a particular process, we can use -L option followed by its Process ID (PID). Here’s an example of -L option in action :

$ ps -L 1213

show processes in threaded view

As we can see, the PID remain the same value, but the LWP which shows numbers of thread show different values.

8) Displays All threads of a specific process id

This will show all the threads of a particular process pid.

-L show threads possibly with LWP and NLWP columns.

# ps -Lf -p 3482
root 3482 1 3482 0 4 10:07 ? 00:00:03 /usr/libexec/gnome-terminal-server
root 3482 1 3483 0 4 10:07 ? 00:00:00 /usr/libexec/gnome-terminal-server
root 3482 1 3484 0 4 10:07 ? 00:00:00 /usr/libexec/gnome-terminal-server
root 3482 1 3487 0 4 10:07 ? 00:00:00 /usr/libexec/gnome-terminal-server

ps thread

9) Shows child of a parent process

This will display all child processes of a process and is useful in finding out what processes have been forked out of this main process.

# ps -o pid,pcpu,pmem,uname,comm -C apache2
2642 0.0 3.4 www-data apache2
4185 0.0 3.6 www-data apache2
4186 0.0 3.3 www-data apache2
4187 0.0 3.3 www-data apache2
5359 0.0 3.3 www-data apache2
13343 0.0 3.5 www-data apache2
17228 0.0 3.5 www-data apache2
21037 0.0 3.4 www-data apache2

ps child

10) Show processes in the hierarchy

Sometimes we want to see the processes in hierarchical form. To do this, we can use -axjf options.

$ps -axjf

show in hierarchy

Or, another command which we can use is.pstree

$ pstree

show information in hierarchy

11) Displays a Process Duration

This will show how long a process has run on the system.

# ps -e -o pid,comm,etime | grep mysql
3107 mysqld_safe 18-07:01:53
3469 mysqld 18-07:01:52

We can even use these following two keywords to find the uptime of a live process.

  • etime: elapsed time since the process was started, in the form [[DD-]hh:]mm:ss.
  • etimes: elapsed time since the process was started, in seconds.

First, you need to find out the PID of a process. The following command displays the PID of apache2.

# pidof apache2

Now, we can find how long this process has been running using the command:

# ps -p 21774 -o etime

You can also view the elapsed time in seconds using etimes keyword as below:

# ps -p 21774 -o etimes

12) Show security information

If we want to see who is currently logged on into your server, we can see it using the ps command. There are some options that we can use to fulfill our needs. Here are some examples :

$ ps -eo pid,user,args

Option -e will show you all processes while -o option will control the output. Pid, User and Args will show you the Process ID, the User who run the application and the running application.

show security information

The keyword / user-defined format that can be used with -e option are args, cmd, comm, command, fname, ucmd, ucomm, lstart, bsdstart and start.

Now ps command can map pids to their respective systemd units by below command.

$ ps -e -o pid,unit,cmd

13) Show every process running as root (real & effective ID) in user format

System admin may want to see what processes are being run by root and other information related to it. Using ps command, we can do by this simple command :

$ ps -U root -u root u

The -U parameter will select by real user ID (RUID). It selects the processes whose real user name or ID is in the userlist list. The real User ID identifies the user who created the process.

While the -u paramater will select by effective user ID (EUID)

The last u paramater, will display the output in user-oriented format which contains User, PID, %CPU, %MEM, VSZ, RSS, TTY, STAT, START, TIME and COMMAND columns.

Here’s the output of the above command.

show real and effective User ID

14) Use PS in a realtime process viewer

ps will display a report of what happens in your system. The result will be a static report.
Let say, we want to filter processes by CPU and Memory usage as on the point 4 above. And we want the report is updated every 1 second. We can do it by combining ps command with watch command on Linux.

Here’s the command :

$ watch -n 1 ‘ps -aux --sort -pmem, -pcpu’

combine ps with watch

If you feel the report is too long, we can limit it by - let say - the top 20 processes. We can add head command to do it.

$ watch -n 1 ‘ps -aux --sort -pmem, -pcpu | head 20’

combine ps with watch

This live reporter is not like top or htop of course. But the advantage of using ps to make live report is that you can custom the field. You can choose which field you want to see.

For example, if you need only the pungki user shown, then you can change the command to become like this :

$ watch -n 1 ‘ps -aux -U pungki u --sort -pmem, -pcpu | head 20’

combine ps with watch

For documentation, you can type man ps on your Linux console to explore more options.

Pungki Arianto 8:00 pm


Your email address will not be published. Required fields are marked *

All comments are subject to moderation.

1 Comment