ps Command in Linux: List Running Processes in Detail

The ps command in Linux generates a list with all running processes and their attributes.

There was a time in Linux when two versions of the ps command coexisted in different distributions. Not long ago, the developers decided to merge the two versions of ps into a single version, but they left the options from both different versions coexisting.

That way, when you specify a parameter in ps, the results will be different:

• Without using a minus sign, ps behaves showing processes in BSD style;
• With a single minus sign "-" ps behaves showing processes in Unix style, using the POSIX standard;
• With two minus signs "--" ps behaves showing processes in GNU style.

There is no right or wrong, just historical preference.

The most common ps options are:

• a  Shows running processes attached to a terminal, from all users;
• -a  Shows running processes attached to a terminal, except for session processes;
• -e, -A  Shows all processes;
• -u  Shows the process list including the names of the users who own the processes and the start of execution, percentage of CPU used, percentage of memory used, and associated terminal;
• -x  Shows the process list, including those that do not have a terminal associated with them. Useful for viewing server processes (daemons);
• -f  Shows processes in tree form. Very useful for identifying the parent and child process relationship among running processes;
• -H  Shows process hierarchy in tree form;

See the ps command help for more options.

In this example, ps only shows the processes of the logged-in user connected to the terminal:

$ ps
  PID TTY          TIME CMD
 1415 pts/0    00:00:00 ps
30019 pts/0    00:00:00 bash

To show all processes of all users connected to a terminal:

$ ps a  PID TTY      STAT   TIME COMMAND 1628 pts/0    R+     0:00 ps a 3297 tty1     Ss+    0:00 /sbin/agetty --noclear tty1 linux27159 pts/0    T      0:00 sudo find / -iname backup.sh27160 pts/0    T      0:00 find / -iname backup.sh30019 pts/0    Ss     0:00 -bash

Notice how the option "-a" differs from "a":

$ ps -a  PID TTY          TIME CMD 1675 pts/0    00:00:00 ps27159 pts/0    00:00:00 sudo27160 pts/0    00:00:00 find

The "u" option adds some process attributes:

$ ps auUSER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMANDroot      3297  0.0  0.0 121336  1600 tty1     Ss+  ago15   0:00 /sbin/agetty --noclear tty1 linuxroot      3298  0.0  0.1 120984  2064 ttyS0    Ss+  ago15   0:00 /sbin/agetty --keep-baud 115200,38400,9600 ec2-user  3414  0.0  0.1 164440  4032 pts/0    R+   18:38   0:00 ps auroot     27159  0.0  0.3 216984  6608 pts/0    T    17:46   0:00 sudo find / -iname backup.shroot     27160  0.0  0.1 128308  3944 pts/0    T    17:46   0:00 find / -iname backup.shec2-user 30019  0.0  0.2 127120  4348 pts/0    Ss   14:48   0:00 -bash

To get a complete list of running processes, not just those connected to the terminal, add the "x" option:

$ ps auxUSER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMANDroot         1  0.0  0.2 199452  4968 ?        Ss   ago15   9:23 /usr/lib/systemd/systemd --switched-root --root         2  0.0  0.0      0     0 ?        S    ago15   0:00 [kthreadd]( ... )ec2-user 30018  0.0  0.2 152864  4384 ?        S    14:48   0:00 sshd: ec2-user@pts/0ec2-user 30019  0.0  0.2 127120  4348 pts/0    Ss   14:48   0:00 -bashpostfix  30391  0.0  0.3  90536  6928 ?        S    18:06   0:00 pickup -l -t unix -u

Processes whose commands are enclosed in brackets, as highlighted in [ktheradd], indicate that they have been removed from RAM memory and placed in virtual memory on disk. When processes are in virtual memory on disk, they are called sleeping.

The Kernel frequently puts processes to sleep while they are waiting for some event, which can be, for example, loading data from disk, or a network connection. When the event is triggered, the Kernel sends a signal to the process.

The "efH" options show all processes, with their hierarchy in tree form:

$ ps -efHUID        PID  PPID  C STIME TTY          TIME CMDroot      3252     1  0 ago15 ?        00:00:00   /usr/sbin/sshd -Droot     29998  3252  0 14:48 ?        00:00:00     sshd: ec2-user [priv]ec2-user 30018 29998  0 14:48 ?        00:00:00       sshd: ec2-user@pts/0ec2-user 30019 30018  0 14:48 pts/0    00:00:00         -bashec2-user  4176 30019  0 18:43 pts/0    00:00:00           ps -efH

It's possible to experiment with commands, such as, for example, finding out which processes consume the most CPU:

$ ps aux | sort -nrk 3,3 | head -n 5USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMANDnginx     3342  0.2  1.6 426976 34048 ?        Sl   ago15 133:04 amplify-agentrpc       2729  0.0  0.1  73828  3276 ?        Ss   ago15   0:02 /sbin/rpcbind -wroot      9421  0.0  0.0      0     0 ?        I    set13   0:01 [kworker/u30:1]root         9  0.0  0.0      0     0 ?        I    ago15   0:00 [rcu_bh]

A very interesting option for programmers is to view running processes sorted by memory consumption. To do this, simply change the sort column to 4:

$ ps -aux | sort -nk 4 | head -5chrony     745  0.0  0.0  80736  2988 ?        S    mar17   0:52 /usr/sbin/chronyddbus       727  0.0  0.0   8872  3668 ?        Ss   mar17  12:10 /usr/bin/dbus-daemon --systemec2-user 24036  0.0  0.0  21720  5108 ?        S    11:37   0:01 sshd: ec2-user@pts/0ec2-user 24037  0.0  0.0 117164  6248 pts/0    Ss   11:37   0:00 -bashec2-user 32446  0.0  0.0 118552  3448 pts/0    R+   16:51   0:00 ps -aux

Regardless of how you want to view running processes, some attributes are important for a Linux administrator, such as:

Process owner user (UID)

It's impossible to run a program in Linux without it having an owner user. This means the program will have the disk and resource access permissions of the user who executed the program. This concept is important because it's possible to run a program as a different user who is not the logged-in user.

Process Number - Process ID (PID)

Every running program receives a unique numerical ID. This number can be used to send signals to the running program.

Parent Process (PPID)

Every program except init or systemd has a parent process that originated its execution. It's common for a server program, for example, to have a parent process (master) and several processes or threads (children).

Threads can be understood as pieces of the program that execute as if they were child processes, but lighter, because they share many things with the parent process. This technology is widely used in processors with multiple cores to allow execution of multiple threads at the same time.

CPU %

Each process gets a slice of the CPU time, which can be accounted for, and serves as a parameter for the administrator to know which processes consume a lot of CPU.

Memory %

Each running process also gets a slice of RAM memory, which can also be accounted for so the administrator knows which processes consume a lot of RAM

Start time (STIME)

Each process also has as an attribute the time it was executed.

CPU Time (TIME)

Each process also has as an attribute the accumulated CPU time in its execution.

Command line (CMD)

Processes also maintain an attribute which is the command line that was used in execution

Terminal (TTY)

Each process may or may not have an associated Terminal. As a curiosity, what the ps command actually does is scan some information from the /proc directory. Take the sshd process as an example:

$ ps aux | grep sshroot      3252  0.0  0.3 112928  7848 ?        Ss   ago15   0:00 /usr/sbin/sshd -D

If we look at the /proc directory, it will have a subdirectory with the number 3252, which corresponds to the PID of the sshd program:

# cd /proc/3252# lsattr        coredump_filter  gid_map    mem         oom_adj        root          stack    timerslack_nsautogroup   cpuset           io         mountinfo   oom_score      sched         stat     uid_mapauxv        cwd              latency    mounts      oom_score_adj  schedstat     statm    wchancgroup      environ          limits     mountstats  pagemap        sessionid     statusclear_refs  exe              loginuid   net         patch_state    setgroups     syscallcmdline     fd               map_files  ns          personality    smaps         taskcomm        fdinfo           maps       numa_maps   projid_map     smaps_rollup  timers

For example, the command line of the program with PID 3252 can be queried with a simple cat:

# cat cmdline /usr/sbin/sshd-D

Various information about a process can be viewed in the /proc/[PID number] directory. The ps utility simply organizes the information for more human-readable viewing.

Learn much more about Linux in our online course. You can enroll here. If you already have an account, or want to create one, just log in or create your user here.

Like it? Share