ps

The ps command on Linux is one of the most basic commands for viewing the processes running on the system. It provides a snapshot of the current processes along with detailed information like user ID, cpu usage, memory usage, command name, etc. It does not display data in real time like top or htop commands. But even though being simpler in features and output it is still an essential process management/monitoring tool that every Linux user should know about and learn well.

Syntax Differences

The ps command accepts different argument syntax or options. It can accept:

Unix98: options may be group and must be preceeded by a dash
BSD: options may be grouped and must not be used with a dash
GNU: long option names are preceeded by two dashes

Different syntax styles can be used concurrently. In other words, ps ax -f is valid.

The output from seemingly identical command options may not be identical. In other words, the output from ps ax is different to ps -ef:

[root@hdcentos ~]# ps ax
   PID TTY      STAT   TIME COMMAND
     1 ?        Ss     0:03 /usr/lib/systemd/systemd --switched-root --system --

The output from ps -ef is:

[root@hdcentos ~]# ps -ef
UID         PID   PPID  C STIME TTY          TIME CMD
root          1      0  0 07:01 ?        00:00:03 /usr/lib/systemd/systemd --swi

help

When the ps command used with the help option, you get:

[root@hdcentos ~]# ps --help all

Usage:
 ps [options]

Basic options:
 -A, -e               all processes
 -a                   all with tty, except session leaders
  a                   all with tty, including other users
 -d                   all except session leaders
 -N, --deselect       negate selection
  r                   only running processes
  T                   all processes on this terminal
  x                   processes without controlling ttys

Selection by list:
 -C          command name
 -G, --Group     real group id or name
 -g, --group   session or effective group name
 -p, p, --pid    process id
        --ppid   parent process id
 -q, q, --quick-pid 
                      process id (quick mode)
 -s, --sid   session id
 -t, t, --tty    terminal
 -u, U, --user   effective user id or name
 -U, --User      real user id or name

  The selection options take as their argument either:
    a comma-separated list e.g. '-u root,nobody' or
    a blank-separated list e.g. '-p 123 4567'

Output formats:
 -F                   extra full
 -f                   full-format, including command lines
  f, --forest         ascii art process tree
 -H                   show process hierarchy
 -j                   jobs format
  j                   BSD job control format
 -l                   long format
  l                   BSD long format
 -M, Z                add security data (for SELinux)
 -O           preloaded with default columns
  O           as -O, with BSD personality
 -o, o, --format 
                      user-defined format
  s                   signal format
  u                   user-oriented format
  v                   virtual memory format
  X                   register format
 -y                   do not show flags, show rss vs. addr (used with -l)
     --context        display security context (for SELinux)
     --headers        repeat header lines, one per page
     --no-headers     do not print header at all
     --cols, --columns, --width 
                      set screen width
     --rows, --lines 
                      set screen height

Show threads:
  H                   as if they were processes
 -L                   possibly with LWP and NLWP columns
 -m, m                after processes
 -T                   possibly with SPID column

Miscellaneous options:
 -c                   show scheduling class with -l option
  c                   show true command name
  e                   show the environment after command
  k,    --sort        specify sort order as: [+|-]key[,[+|-]key[,...]]
  L                   show format specifiers
  n                   display numeric uid and wchan
  S,    --cumulative  include some dead child process data
 -y                   do not show flags, show rss (only with -l)
 -V, V, --version     display version information and exit
 -w, w                unlimited output width

        --help 
                      display help and exit

For more details see ps(1).

Common Tasks

List all Processes

Use the following command to display a list of all processes:

ps ax
ps -ef

The output may look like this:

[root@hdcentos ~]# ps ax
   PID TTY      STAT   TIME COMMAND
     1 ?        Ss     0:03 /usr/lib/systemd/systemd --switched-root --system --
     2 ?        S      0:00 [kthreadd]
...
  6338 ?        S      0:00 [kworker/3:2]
  6356 ?        S      0:00 sleep 60
  6359 pts/0    R+     0:00 ps ax

Process by User

Filter the processes by the owning user by using the -u option followed by the username. Multiple usernames can be provided separated by a comma.

ps -u username[,username]

The output may look like this:

[root@hdcentos ~]# ps -f -u postfix
UID         PID   PPID  C STIME TTY          TIME CMD
postfix    2968   2966  0 07:02 ?        00:00:00 qmgr -l -t unix -u
postfix    6010   2966  0 10:22 ?        00:00:00 pickup -l -t unix -u

Process by Name

To search the processes by their name or command use the -C option followed by the search term.

ps -C name

ps -C bash
   PID TTY          TIME CMD
  3963 pts/0    00:00:00 bash

When using the -C option, the exact process name must be used. Partial searches or wildcards are not supported. However, to search the process list using partial names or wildcards, use the grep command:

[root@hdcentos ~]# ps | grep bas
  3963 pts/0    00:00:00 bash

Process by Process ID

To search the processes by their process ID, use the -p option and provide the process IDs separated by commas.

ps -p pid[,pid]

[root@hdcentos ~]# ps -p 3963
   PID TTY          TIME CMD
  3963 pts/0    00:00:00 bash

Sort Output by CPU or Memory Usage

System administrators often want to find out processes that are consuming lots of memory or CPU. The sort option will sort the process list based on a particular field or parameter.

Multiple fields can be specified with the --sort option separated by a comma. Additionally the fields can be prefixed with a - or + symbol indicating descending or ascending sort respectively. There are lots of parameters on which the process list can be sorted. Check the man page for the complete list.

To display the top 4 processes consuming the most CPU, use:

[root@hdcentos ~]# ps aux --sort=-pcpu | head -5
USER        PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root        934  0.5  0.1 322924  7068 ?        Ssl  07:03   1:24 /usr/bin/vmtoolsd
root       1149  0.2  0.2 175152  7764 ?        S    07:03   0:37 /usr/sbin/vmtoolsd
root       3654  0.2  2.7 1953576 107668 ?      Rl   07:04   0:46 /usr/bin/gnome-shell
root        293  0.1  0.0      0     0 ?        S    07:02   0:28 [kworker/2:1]

Display process hierarchy in a tree style

Many processes are actually forked out of some parent process, and knowing this parent child relationship is often helpful. The --forest option will construct an ascii art style tree view of the process hierarchy.

The following command will construct a tree and display detailed information.

[root@hdcentos ~]# ps -f --forest
UID         PID   PPID  C STIME TTY          TIME CMD
root       7014   7010  0 11:47 pts/0    00:00:00 bash
root       7057   7014  0 11:48 pts/0    00:00:00  \_ ps -f --forest