15 Linux ps Command with Examples

The ps is a built-in command used in Unix/Linux operating systems to list out the currently running processes. It displays a static snapshot with information about the processes whereas top, htop, and glances show repetitive updates.

Ps command comes with lots of options to manipulate the outputs. It pulls all information of the processes from /proc virtual filesystem.

This tutorial will focus on explaining the way to use the ps command along with some practical examples

The syntax of ps command

The basic syntax for ps command usage is as follows:

$ ps [options]

ps command

The 'options' of the ps command may be:

• UNIX options - preceded by a dash
• BSD options - must be used without a dash
• GNU long options - preceded by two dashes

This is a very basic ps command usage. Just type 'ps' on your console to see its result:

$ ps

By default, it shows us four columns of information.

• PID is a Process ID of the running command (CMD)
• TTY is a place where the running command runs
• TIME tell about how much time is used by CPU while running the command
• CMD is a command that runs as a current process

Running ps command without any option is just a simplest format of the command, it returns not much information. In order to make the most of power of the ps command, let's run it with additional options which will be explained in further detail in the following sections.

01) Display all processes (UNIX format)

To view all of the processes in your Linux system, you can run either of the following commands:

$ ps -A

or:

$ ps -e

Output of ps -e

Moreover, in order to list all of the running processes, run:

$ ps -r

Output of ps -r

02) Display all processes (BSD format)

In order to see all of the processes on your Linux system using the ps command in BSD format, you can run the following commands:

$ ps ax

or

$ ps aux

Output of ps aux

Where:

• USER - the user runs the process
• PID - the process id
• %CPU / %MEM - the percentage of CPU / RAM being occupied by the processes
• VSZ - the virtual memory size being occupied by the processes
• RSS - the size of physical memory being occupied by the processes
• START - start time
• STAT - the state of the process in which: S (sleeping), R (running), I (interruptible sleep).
• Time - display how long CPU time was given by kernel for that running process.
• COMMAND - the command that runs as a current process

03) Display all processes which be run by a command

To list all the processes which be run by a command, let's use the following syntax:

$ ps -C <command_name>

For example, list all the processes of '/usr/sbin/kerneloops' command by running:

$ ps -C kerneloops

Output of ps -C

You may also use argument in the form of a blank-separated or comma-separated list, for example:

$ ps -C sshd,systemd

04) Display all processes which be run by a user

If you want to list the process by user whose user id 1000, let's run the following command:

$ ps -u 1000

You can also search process by username:

$ ps -U root -u root u

The -U parameter will select by real user ID (RUID). It selects the processes whose real user name or ID is in the userlist list. The real User ID identifies the user who created the process.

While the -u paramater will select by effective user ID (EUID)

05) Display processes owned by group

In order to list all processes owned by a specific group name, let's run the command with -fG option. For example:

$ ps -fG cas

Output of ps -fG

In order to display all processes by group id, you can run the command with '-g' option. For instance:

$ ps -g 1

Output:

   PID TTY          TIME CMD
     1 ?        00:00:03 systemd

06) Display processes by PID

You can list all processes by PID by running the ps command with '-fp' option. For example:

$ ps -fp 34531

Output:

UID         PID   PPID  C STIME TTY          TIME CMD
cas       34531      1  0 06:16 ?        00:00:00 /lib/systemd/systemd --user

Moreover, in order to list all processes by PPID, let's run the command with '--ppid' option:

$ ps -f --ppid 34529

Output:

UID         PID   PPID  C STIME TTY          TIME CMD
cas       34609  34529  0 06:16 ?        00:00:00 sshd: cas@pts/0

07) Display processes by TTY

In order to display all processes by TTY, you can run the command with '-t' option. For instance:

$ ps -t tty1

Output of ps -t

08) Display processes owned by current user

To list all processes are running by the current user, let's run the command with '-x' option:

$ ps -x

Output of ps -x

09) Display all processes with full format listing

For instance, let's run the ps command with -f option, to display all process with the full format:

$ ps -af

Output of ps -af

10) Display all processes with extra format

Moreover, to view the extra full format listing of the result, run ps command with -F option. For example:

$ ps -F

Output of ps-F

11) Display all processes in ASCII hierarchy format

To illustrate, assuming that you want to display all the process on your Linux system in ASCII art process hierarchy format, let's run:

$ ps af

The output will be in "forest" format:

Output of ps af

12) Display process in widen output

If you want to widen output when running the ps command, use w option:

$ ps w

Let make a comparison between the outputs of running 'ps w' and 'ps':

Output ps w and ps

13) Display process according to user-defined format

You can use the following  syntax to view in user-defined format:

Syntax:
$ ps --format column_name
$ ps -o column_name
$ ps o column_name

For example:
$ ps -e -o user,pid,cmd

14) Display threads with thread id

For example, in order to show threads with SPID column (SPID is the thread id), run:

$ ps -aT

Output of ps -aT

15) Show the information about threads

Besides, you can use '-L' option to get the information about threads in your Linux system:

$ ps -aL

The output with 'LWP' column show you the thread id:

Output of ps -aL

Some more examples

01) Check which processes taking most RAM

The following command will display most memory using processes, %MEM in 1st column, PID in 2nd column and command in 3rd column for all running processes on the system:

$ ps -eo pmem,pid,cmd | sort -k 1 -nr

02) Displays all threads of a specific process id

This will show all the threads of a particular process pid.

$ ps -Lf -p 3482

03) Shows child of a parent process

This will display all child processes of a process and is useful in finding out what processes have been forked out of this main process.

$ ps -o pid,pcpu,pmem,uname,comm -C apache2

04) Displays how long process has been running

The following command will show how long the 'mysql' process has been running on the system:

$ ps -e -o pid,comm,etime | grep mysql
3107 mysqld_safe 18-07:01:53
3469 mysqld 18-07:01:52

• etime: elapsed time since the process was started, in the form [[DD-]hh:]mm:ss.
• etimes: elapsed time since the process was started, in seconds.

05) Get security information

If we want to see who is currently logged on into your server, we can see it using the ps command:

$ ps -eo pid,user,args

Now you can map pids to their respective systemd units by below command:

$ ps -e -o pid,unit,cmd

Conclusion

The pstree (or use ps -axjf ) and pgrep are additional commands which can help get information about running process.

You may use ps as real-time monitor using watch command, let say, we want to filter processes by CPU and Memory usage report is updated every 1 second.

$ watch -n 1 ‘ps -aux --sort -pmem, -pcpu’

In this tutorial, we learned many ways to use the ps command in Linux. For exploring all options please refer ps man page. Thanks for reading and please leave your suggestion in the below comment section.