Linux ps command is a built-in tool to capture current processes on the system. It will capture the system condition at a single time. If you want to have repetitive updates in a real-time, we can use the top command.
In this tutorial, I will show you common practical example of ps command which helps for your daily linux system administration.
Table of Contents
1) Run ps without any options
This is a very basic ps usage. Just type ps on your console to see its result.
By default, it will show us 4 columns of information.
- PID is a Process ID of the running command (CMD)
- TTY is a place where the running command runs
- TIME tell about how much time is used by CPU while running the command
- CMD is a command that runs as a current process
This information is displayed in an unsorted result.
2) Show all current processes
To do this, we can use -a options. As we can guess, -a is stand for “all”. While x will show all process even the current process is not associated with any TTY (terminal)
$ ps -ax
This result might be a long result. To make it easier to read, combine it with less command.
$ ps -ax | less
3) Filter processes by its user
For some situation, we may want to filter processes by a user. To do this, we can use -u option. Let say we want to see what processes which run by user pungki. So the command will be like below
$ ps -u pungki
4) Filter processes by CPU or memory usage
Another thing that you might want to see is to filter the result by CPU or memory usage. With this, you can grab information about which processes that consume your resource. To do this, we can use aux options. Here’s an example of it :
$ ps -aux | less
Since the result can be in a long list, we can pipe less command into ps command. Explaining each term in the result.
1. USER - Username : The name of the user associated with the process.
2. PID - Process ID : The unique numeric identifier assigned to the process.
3. %CPU - Percentage of CPU: Time used (total CPU time divided by length of time the process has been running).
4. %MEM - Percentage of RAM Memory: used (memory used divided by total memory available).
5. VSZ - Virtual Memory Size: Size of the process in virtual memory expressed in KiB.
6. RSS - Resident Set Size.
7. TTY - Terminal controlling the process.
8. STAT - Process State - Possible values.
* R - Running.
* S - Sleeping (may be interrupted).
* D - Sleeping (may not be interrupted) - used to indicate process is handling input/output.
* T - Stopped or being traced.
* Z - Zombie or "hung" process.
9. START: The date or time at which the process started.
10. TIME: Cumulative CPU time used by the process and the child processes started by the process.
11. COMMAND: Command used to start the process.
By default, the result will be in unsorted form. If we want to sort by particular column, we can add --sort option into ps command.
Sort by the highest CPU utilization in ascending order
$ ps -aux --sort -pcpu | less
Sort by the highest Memory utilization in ascending order
$ ps -aux --sort -pmem | less
Or we can combine it into a single command and display only the top ten of the result :
$ ps -aux --sort -pcpu,+pmem | head -n 10
5) Top 10 memory consuming processes
This shows the top 10 memory consuming processes running on the system. It is useful to see what processes are the most memory consuming.
Options: --sort spec specifies sorting order. Sorting syntax is [+|-]key[,[+|-]key[,...]]. Choose a multi-letter key from the STANDARD FORMAT SPECIFIERS section. The "+" is optional since default direction is increasing numerical or lexicographic order. Identical to k. For example: ps jax --sort=uid,-ppid,+pid
# ps -auxf | sort -nr -k 4 | head -10 root 3025 3.2 13.0 1600004 245276 ? Sl 10:00 2:01 \_ /usr/bin/gnome-shell root 2261 0.5 1.8 188108 34540 tty1 Rs+ 09:49 0:25 \_ /usr/bin/Xorg :0 -background none -verbose -auth /run/gdm/auth-for-gdm-fTksZM/database -seat seat0 -nolisten tcp vt1 root 3089 0.0 1.2 1060728 22608 ? Sl 10:00 0:00 /usr/bin/nautilus --no-default-window root 2957 0.0 1.2 998384 23244 ? Sl 10:00 0:00 \_ /usr/libexec/gnome-settings-daemon root 3482 0.0 1.0 632688 19344 ? Rl 10:07 0:02 /usr/libexec/gnome-terminal-server root 3181 0.1 1.0 349960 20280 ? S 10:00 0:07 /usr/bin/vmtoolsd -n vmusr root 802 0.0 0.9 550008 18036 ? Ssl 09:49 0:01 /usr/bin/python -Es /usr/sbin/tuned -l -P root 950 0.0 0.8 102312 15580 ? S 09:49 0:00 \_ /sbin/dhclient -d -sf /usr/libexec/nm-dhcp-helper -pf /var/run/dhclient-eno16777736.pid -lf /var/lib/NetworkManager/dhclient-42456ebc-a752-4950-9adf-1b8bc29f43eb-eno16777736.lease -cf /var/lib/NetworkManager/dhclient-eno16777736.conf eno16777736 root 3154 0.0 0.8 898940 15300 ? Sl 10:00 0:00 /usr/libexec/evolution-calendar-factory root 3020 0.0 0.8 551480 16420 ? Sl 10:00 0:00 /usr/libexec/goa-daemon
6) Filter processes by its name or process ID
To do this, we can use -C option followed by the keyword. Let say, we want to show processes named getty. We can type :
$ ps -C getty
If we want to show more detail about the result, we can add -f option to show it on full format listing. The above command will look like below :
$ ps -f -C getty
7) Filter processes by a thread of the process
If we need to know the thread of a particular process, we can use -L option followed by its Process ID (PID). Here’s an example of -L option in action :
$ ps -L 1213
As we can see, the PID remain the same value, but the LWP which shows numbers of thread show different values.
8) Displays All threads of a specific process id
This will show all the threads of a particular process pid.
Options: -L show threads possibly with LWP and NLWP columns. # ps -Lf -p 3482 UID PID PPID LWP C NLWP STIME TTY TIME CMD root 3482 1 3482 0 4 10:07 ? 00:00:03 /usr/libexec/gnome-terminal-server root 3482 1 3483 0 4 10:07 ? 00:00:00 /usr/libexec/gnome-terminal-server root 3482 1 3484 0 4 10:07 ? 00:00:00 /usr/libexec/gnome-terminal-server root 3482 1 3487 0 4 10:07 ? 00:00:00 /usr/libexec/gnome-terminal-server
9) Shows child of a parent process
This will display all child processes of a process and is useful in finding out what processes have been forked out of this main process.
# ps -o pid,pcpu,pmem,uname,comm -C apache2 PID %CPU %MEM USER COMMAND 2642 0.0 3.4 www-data apache2 4185 0.0 3.6 www-data apache2 4186 0.0 3.3 www-data apache2 4187 0.0 3.3 www-data apache2 5359 0.0 3.3 www-data apache2 13343 0.0 3.5 www-data apache2 17228 0.0 3.5 www-data apache2 21037 0.0 3.4 www-data apache2
10) Show processes in the hierarchy
Sometimes we want to see the processes in hierarchical form. To do this, we can use -axjf options.
$ps -axjf
Or, another command which we can use is.pstree
$ pstree
11) Displays a Process Duration
This will show how long a process has run on the system.
# ps -e -o pid,comm,etime | grep mysql 3107 mysqld_safe 18-07:01:53 3469 mysqld 18-07:01:52
We can even use these following two keywords to find the uptime of a live process.
etime: elapsed time since the process was started, in the form [[DD-]hh:]mm:ss.etimes: elapsed time since the process was started, in seconds.
First, you need to find out the PID of a process. The following command displays the PID of apache2.
# pidof apache2 21774
Now, we can find how long this process has been running using the command:
# ps -p 21774 -o etime ELAPSED 2-23:31:39
You can also view the elapsed time in seconds using etimes keyword as below:
# ps -p 21774 -o etimes ELAPSED 257895
12) Show security information
If we want to see who is currently logged on into your server, we can see it using the ps command. There are some options that we can use to fulfill our needs. Here are some examples :
$ ps -eo pid,user,args
Option -e will show you all processes while -o option will control the output. Pid, User and Args will show you the Process ID, the User who run the application and the running application.
The keyword / user-defined format that can be used with -e option are args, cmd, comm, command, fname, ucmd, ucomm, lstart, bsdstart and start.
Now ps command can map pids to their respective systemd units by below command.
$ ps -e -o pid,unit,cmd
13) Show every process running as root (real & effective ID) in user format
System admin may want to see what processes are being run by root and other information related to it. Using ps command, we can do by this simple command :
$ ps -U root -u root u
The -U parameter will select by real user ID (RUID). It selects the processes whose real user name or ID is in the userlist list. The real User ID identifies the user who created the process.
While the -u paramater will select by effective user ID (EUID)
The last u paramater, will display the output in user-oriented format which contains User, PID, %CPU, %MEM, VSZ, RSS, TTY, STAT, START, TIME and COMMAND columns.
Here’s the output of the above command.
14) Use PS in a realtime process viewer
ps will display a report of what happens in your system. The result will be a static report.
Let say, we want to filter processes by CPU and Memory usage as on the point 4 above. And we want the report is updated every 1 second. We can do it by combining ps command with watch command on Linux.
Here’s the command :
$ watch -n 1 ‘ps -aux --sort -pmem, -pcpu’
If you feel the report is too long, we can limit it by - let say - the top 20 processes. We can add head command to do it.
$ watch -n 1 ‘ps -aux --sort -pmem, -pcpu | head 20’
This live reporter is not like top or htop of course. But the advantage of using ps to make live report is that you can custom the field. You can choose which field you want to see.
For example, if you need only the pungki user shown, then you can change the command to become like this :
$ watch -n 1 ‘ps -aux -U pungki u --sort -pmem, -pcpu | head 20’
For documentation, you can type man ps on your Linux console to explore more options.
or apt install htop and be done with it