The ps is a built-in command used in Unix/Linux operating systems to list out the currently running processes. It displays a static snapshot with information about the processes whereas top, htop, and glances show repetitive updates.
Ps command comes with lots of options to manipulate the outputs. It pulls all information of the processes from /proc virtual filesystem.
This tutorial will focus on explaining the way to use the ps command along with some practical examples
The syntax of ps command
The basic syntax for ps command usage is as follows:
$ ps [options]
The 'options' of the ps command may be:
- UNIX options - preceded by a dash
- BSD options - must be used without a dash
- GNU long options - preceded by two dashes
This is a very basic ps command usage. Just type 'ps' on your console to see its result:
$ ps
By default, it shows us four columns of information.
- PID is a Process ID of the running command (CMD)
- TTY is a place where the running command runs
- TIME tell about how much time is used by CPU while running the command
- CMD is a command that runs as a current process
Running ps command without any option is just a simplest format of the command, it returns not much information. In order to make the most of power of the ps command, let's run it with additional options which will be explained in further detail in the following sections.
01) Display all processes (UNIX format)
To view all of the processes in your Linux system, you can run either of the following commands:
$ ps -A
or:
$ ps -e
Moreover, in order to list all of the running processes, run:
$ ps -r
02) Display all processes (BSD format)
In order to see all of the processes on your Linux system using the ps command in BSD format, you can run the following commands:
$ ps ax
or
$ ps aux
Where:
- USER - the user runs the process
- PID - the process id
- %CPU / %MEM - the percentage of CPU / RAM being occupied by the processes
- VSZ - the virtual memory size being occupied by the processes
- RSS - the size of physical memory being occupied by the processes
- START - start time
- STAT - the state of the process in which: S (sleeping), R (running), I (interruptible sleep).
- Time - display how long CPU time was given by kernel for that running process.
- COMMAND - the command that runs as a current process
03) Display all processes which be run by a command
To list all the processes which be run by a command, let's use the following syntax:
$ ps -C <command_name>
For example, list all the processes of '/usr/sbin/kerneloops' command by running:
$ ps -C kerneloops
You may also use argument in the form of a blank-separated or comma-separated list, for example:
$ ps -C sshd,systemd
04) Display all processes which be run by a user
If you want to list the process by user whose user id 1000, let's run the following command:
$ ps -u 1000
You can also search process by username:
$ ps -U root -u root u
The -U parameter
will select by real user ID (RUID)
. It selects the processes whose real user name or ID is in the userlist list. The real User ID identifies the user who created the process.
While the -u paramater
will select by effective user ID (EUID)
05) Display processes owned by group
In order to list all processes owned by a specific group name, let's run the command with -fG
option. For example:
$ ps -fG cas
In order to display all processes by group id, you can run the command with '-g' option. For instance:
$ ps -g 1
Output:
PID TTY TIME CMD 1 ? 00:00:03 systemd
06) Display processes by PID
You can list all processes by PID by running the ps command with '-fp' option. For example:
$ ps -fp 34531
Output:
UID PID PPID C STIME TTY TIME CMD cas 34531 1 0 06:16 ? 00:00:00 /lib/systemd/systemd --user
Moreover, in order to list all processes by PPID, let's run the command with '--ppid' option:
$ ps -f --ppid 34529
Output:
UID PID PPID C STIME TTY TIME CMD cas 34609 34529 0 06:16 ? 00:00:00 sshd: cas@pts/0
07) Display processes by TTY
In order to display all processes by TTY, you can run the command with '-t' option. For instance:
$ ps -t tty1
08) Display processes owned by current user
To list all processes are running by the current user, let's run the command with '-x' option:
$ ps -x
09) Display all processes with full format listing
For instance, let's run the ps command with -f
option, to display all process with the full format:
$ ps -af
10) Display all processes with extra format
Moreover, to view the extra full format listing of the result, run ps command with -F
option. For example:
$ ps -F
11) Display all processes in ASCII hierarchy format
To illustrate, assuming that you want to display all the process on your Linux system in ASCII art process hierarchy format, let's run:
$ ps af
The output will be in "forest" format:
12) Display process in widen output
If you want to widen output when running the ps command, use w
option:
$ ps w
Let make a comparison between the outputs of running 'ps w' and 'ps':
13) Display process according to user-defined format
You can use the following syntax to view in user-defined format:
Syntax: $ ps --format column_name $ ps -o column_name $ ps o column_name For example: $ ps -e -o user,pid,cmd
14) Display threads with thread id
For example, in order to show threads with SPID column (SPID is the thread id), run:
$ ps -aT
15) Show the information about threads
Besides, you can use '-L' option to get the information about threads in your Linux system:
$ ps -aL
The output with 'LWP' column show you the thread id:
Some more examples
01) Check which processes taking most RAM
The following command will display most memory using processes, %MEM
in 1st column, PID
in 2nd column and command in 3rd column for all running processes on the system:
$ ps -eo pmem,pid,cmd | sort -k 1 -nr
02) Displays all threads of a specific process id
This will show all the threads of a particular process pid.
$ ps -Lf -p 3482
03) Shows child of a parent process
This will display all child processes of a process and is useful in finding out what processes have been forked out of this main process.
$ ps -o pid,pcpu,pmem,uname,comm -C apache2
04) Displays how long process has been running
The following command will show how long the 'mysql' process has been running on the system:
$ ps -e -o pid,comm,etime | grep mysql 3107 mysqld_safe 18-07:01:53 3469 mysqld 18-07:01:52
etime
: elapsed time since the process was started, in the form [[DD-]hh:]mm:ss.etimes
: elapsed time since the process was started, in seconds.
05) Get security information
If we want to see who is currently logged on into your server, we can see it using the ps command:
$ ps -eo pid,user,args
Now you can map pids to their respective systemd units by below command:
$ ps -e -o pid,unit,cmd
Conclusion
The pstree (or use ps -axjf ) and pgrep are additional commands which can help get information about running process.
You may use ps as real-time monitor using watch command, let say, we want to filter processes by CPU and Memory usage report is updated every 1 second.
$ watch -n 1 ‘ps -aux --sort -pmem, -pcpu’
In this tutorial, we learned many ways to use the ps command in Linux. For exploring all options please refer ps man page. Thanks for reading and please leave your suggestion in the below comment section.
or apt install htop and be done with it