What is ps?

According to the man page, the ps utility displays a header line, followed by lines containing information about all of your processes that have controllng terminals.

This is a fancy way of saying that ps shows all of the running processes on your Linux system. This is especially helpful when troubleshooting issues with system resources or stuck programs and seeing what processes are running on your system.

Without an option, ps will display a list of currently active processes ran by the user.

$ ps
    PID TTY          TIME CMD
  43682 pts/1    00:00:00 bash
  43706 pts/1    00:00:00 ps
  • PID = Process ID
  • TTY = Name of console that the user is logged in at
  • TIME = Time that the process has been running
  • CMD = Command executed that launched the process

-e, select all processes

ps -e lists all processes that have been started by all users.

$ ps -e | head -3
    PID TTY          TIME CMD
      1 ?        00:00:03 systemd
      2 ?        00:00:00 kthreadd

-f, full format listing

This option can be combined with something like -e to display extra columns.

$ ps -ef | head -3
UID          PID    PPID  C STIME TTY          TIME CMD
root           1       0  0 Mar06 ?        00:00:03 /sbin/init
root           2       0  0 Mar06 ?        00:00:00 [kthreadd]
  • UID = User ID of the owner of the process
  • PID = Process ID
  • PPID = Parent process ID of the process
  • C = Number of children the process has
  • STIME = Start time of the process
  • TTY = Name of console that the user is logged in at
  • TIME = Time that the process has been running
  • CMD = Command executed that launched the process

-F, Extra full format

$ ps -eF | head -3
UID          PID    PPID  C    SZ   RSS PSR STIME TTY          TIME CMD
root           1       0  0 45072 11088   3 Mar06 ?        00:00:03 /sbin/init
root           2       0  0     0     0   3 Mar06 ?        00:00:00 [kthreadd]
  • UID = User ID of the owner of the process
  • PID = Process ID
  • PPID = Parent process ID of the process
  • C = Number of children the process has
  • SZ = Size in RAM page of the process image
  • RSS = Resident set size. Non-swappable physical memory used
  • PSR = processor that the process is assigned to
  • STIME = Start time of the process
  • TTY = Terminal the process is started from. ? indicates it didn’t start from a terminal.
  • TIME = Time that the process has been running
  • CMD = Command executed that launched the process

ps aux

ps aux is another way to list all processes (not the same as ps -aux, which displays all processes owned by user named “x”). This is the legacy way of seeing all processes running using BSD syntax.

  • a = all users
  • u = shows the user
  • x = displays the processes not executed in the terminal
$ ps aux | head -3
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root           1  0.0  0.0 180288 11088 ?        Ss   Mar06   0:03 /sbin/init
root           2  0.0  0.0      0     0 ?        S    Mar06   0:00 [kthreadd]
  • USER = User account running process
  • PID = Process ID
  • %CPU = CPU time used by the process (in %)
  • %MEM = Physical Memory used by the process (in %)
  • VSZ = Virtual memory used (in bytes)
  • RSS = Resident set size. Non-swappable physical memory used
  • TTY = Terminal the process is started from. ? indicates it didn’t start from a terminal.
  • STAT = Process state
  • START = Starting time/date of the process
  • TIME = Time that the process has been running
  • COMMAND = Command which started the process

Now that we have a bunch of different ways to pull running processes, we can filter that information with different options.

-C, cmdlet

-C can be used to search in ps with a command name.

$ ps -C chrome
    PID TTY          TIME CMD
  23128 ?        00:01:49 chrome

-p, process id

-p can be used to search for process id

$ ps -p 23128
    PID TTY          TIME CMD
  23128 ?        00:01:51 chrome

-u, userlist

-u can be used to search by user

$ ps -u bob
    PID TTY          TIME CMD
  17827 ?        00:00:00 systemd
  17828 ?        00:00:00 (sd-pam)
  17854 ?        00:00:00 dbus-daemon

ps can be used with grep to locate specific processes as well. This can be helpful when we have to locate or kill certain processes. I’ll most likely make another post on killing processes using commands such as ps and pgrep.