PS Command in Linux

Process or task is one of the most fundamental concepts of the Linux operating system. Linux can run multiple processes by multiple users simultaneously. System administrators may need to monitor these processes if an instance is causing a problem. For this purpose, Linux provides the ps or process status command to display information about these processes.

In this tutorial, we will learn how to use the ps command on your Linux computer.

Prerequisites

A Linux system with multiple running applications and processes.
Familiarity with the Linux command-line interface.
A sudo user, root user, or a normal user account.

Linux Ps Command

The ps, also known as process status, command is used to display information about the running Linux process. It also shows the unique process ID (PID) and other related attributes. The ps command in the Linux system retrieves process information from the /proc file system virtual files. It is called the virtual file system because it contains /proc virtual files.

The default ps command output includes only the processes for the current user terminal session and session leader. This process monitoring utility provides several options to manipulate its output, which are useful for the system administrators to monitor processes. Ps is one of the most commonly used Linux commands for system administrators.

PS Command Syntax

The basic syntax of the ps command is as follows:

ps [options]

PS Command Examples

The ps command in Linux provides numerous options, 80 options to be precise, to manipulate the output. We are going to show some of the useful usages of this command.

PS Command by Default

The default output of the ps command displays processes only for the current shell:

ps

In this output, we see the following four columns:

PID is the unique identifier of the process.
TTY is the current shell type of the logged-in user.
TIME is the amount of CPU time that the process is running.
CMD is the command that started the process.

Display all the Running Processes

The default ps command in Linux output does not provide any useful information. To display all currently running processes, use the ps command with the -A option:

ps -A

You can get the same results by using the -e option:

ps -e

Display Processes Not Associated with a Terminal

To display all the processes except for the processes that are not related to any terminal window and session leaders:

ps -a

Display Processes on Current Terminal Session

To display processes running on a terminal, use the ps command in Linux with the -T option:

ps -T

output of ps -T - showing processes running on a terminal

To display a list of all the running processes including all the processes that are not associated with the current terminal use the -ax option. In this example, the -a option lists all running processes, and the -x option lists processes even the ones that are not associated with the current terminal:

ps -ax

To display all running processes in the BSD job control format, use either of the following commands:

ps -au

ps -aux

View Full Format Listing

Use the -f option with the ps command to display a full format listing of the running processes:

ps -f

In this output, we see the following columns:

UID represents the username that started the process.
PID represents the process ID of the system process. You can use the kill command to kill a process.
PPID represents the parent process ID that started this process.
C represents the amount of CPU time the process is using.
STIME is the date and time on which the process started.
TTY is the name of the terminal that started the process.
TIME represents the total CPU time the process consumed since the beginning.
CMD is the command that started the process.

View the Extended Full Format Listing

To display the extended full format and display additional fields, use the -F option with the ps command:

ps -F

In this command output, we see the following additional fields:

SZ represents the physical page size of the process.
RSS represents the resident set size of the non-swapped physical memory consumed by the process.
PSR displays the number of processors assigned to this process.

To view processes in the full format of all the system processes:

ps -ef

Use ps -ef | grep <processes_name> to search specific process names from the list of all processes. Which gives a detailed overview of that process.

To view processes in the extended full format of all the system processes:

ps -eF

Long format

The long format option -l includes further information in the ps command output:

ps -l

The long option displays the following fields in addition to the extended long format fields:

F is the total number of flags set for this process.
S is the process status, which can be:
- D for uninterruptible sleep.
- I for idle Kernel thread.
- R for runnable or running.
- S for interruptible sleep.
- T for a process stopped by the job control signal.
- t for a process stopped by a debugger.
- W for paging.
- X for the dead process.
- Z for zombie process.
PRI represents the process priority.
NI represents the nice value of the process.
ADDR is the process memory address.
WCHAN represents the name of the kernel function of a sleeping process.

Display Specific User’s processes

To display processes that are owned by a specific user, use the following command with a real user id (RUID):

ps -u linuxopsys

Display Processes using Effective User ID

You can also specify the effective user-id instead of the user name to display which process belongs to which user:

ps -u 1000

You can display all processes owned by the root user, use the ps -u command with the root user:

ps -u root -U root

Display Processes by an Associated Group ID

Use the -g or -G option to display processes that are associated with a particular group ID or name.

To display processes associated with effective group id (EGID), use:

ps -g group_id

To display processes associated with real group id (RGID), use:

ps -G 1000

Display Processes based on Command

To display the process ID of all the processes that are started by the systemd command, type:

ps -C systemd

Display processes based on their command name

Display Processes by PID

To display information about the current running processes based on their PIDs, use this command with multiple process IDs:

ps -p 80 100 120

Display Processes using Parent Process IDs

To display current running processes based on their parent process ID (PPID), specify the PPID with the ps command:

ps --ppid 976

display processes by their parent process id

Thread of Particular Processes

Use the -L option with the process ID to display the thread of a particular Linux process:

ps -fL -C systemd

Display Process Hierarchy

To display the process hierarchy of the Linux processes, use the ps f command without the hyphen character before f:

ps f

Display a Selected List of Columns

By default, a list of columns is selected automatically based on the options you specify. To display a list of selected columns in output format, you can use the -eo option followed by the column list:

ps -eo pid,command,%mem

Display specific columns such as pid, command, %mem

Display Child of a Parent Process

To display child processes of the firefox command along with PID, memory usage percentage, and owner-user of these child processes, use the -o option for a list of columns and -C to specify the command name:

ps -o pid,%mem,uname,command -C firefox

Check Processes Consuming Memory

To list the running processes along with their memory consumption, use the -eo option. In the following example, we are displaying the most memory consuming processes with memory percentage in the first column, process ID in the second column, and command in the third column:

ps -eo %mem,pid,command | sort -k 1 -nr

ps output showing the process which consumes the most memory

The ps command can also be used with other commands. You can also use the ps command as a real-time process monitor using the watch command. To display processes by the memory and CPU usage, which is updated every 5 seconds, use the following command:

watch -n 1 ‘ps -eo %mem,cpu -sort=%mem’

Process Duration

Use the etime parameter with the -eo option to check the duration of the running process. The time is displayed as the elapsed time since the process was started:

ps -eo pid,command,etime

showing etime that displays elapsed time since the process was started

Search for a Particular Process

To get information about a particular process in the ps command results, you can use the grep command with the ps command:

ps -ef | grep firefox

using grep to find the desired process name

Conclusion

In this tutorial, we learned how to use the ps command to display information about the Linux processes. The ps command enables you to list information about the processes running on your Linux system. This command does not frequently update the listed processes like the top command. Run these examples to better learn the ps command.

Navigate all-in-one place of Linux Commands for more learning.