ps Command in Linux Explained [With Examples]

The ps command, short for "process status," is used in UNIX and UNIX-like operating systems to view information about processes running in a system. It offers system administrators, developers, and other users insights into the system's process activity.

The ps command is part of the procps package on most Linux distributions. In addition to ps, the procps package typically includes tools like: top, vmstat, free etc.

Basic Syntax:

The basic syntax of the ps command is:

ps [options]

Options

Commonly used ps options:

• -A, -e: Display information about all processes.
• -f: Provide a full-format listing.
• -l: Display long format.
• -u user: Display processes owned by user.
• -x: Include processes not attached to a terminal.
• -o format: User-defined format.
• -p PID: Display information for a specific process ID (or list of PIDs).
• -T: Display information about processes and threads.

Displaying Processes

Default display

Running the ps command without any options will display a basic list of processes that are associated with the terminal from which the command is executed.

ps

Output typically includes:

• PID: Process ID.
• TTY: Terminal type associated with the process.
• TIME: Total CPU time the process has taken.
• CMD: The command that initiated the process.

User-specific processes

To display processes for a specific user, you use the -u option followed by the username.

Command Example:

ps -u ubuntu

This will list all processes owned by the user 'ubuntu'.

Displaying all processes

To see every process on the system, you can use several options:

a) UNIX-style

ps -e

Sample output

# ps -e
    PID TTY          TIME CMD
      1 ?        00:01:28 systemd
      2 ?        00:00:00 kthreadd
      3 ?        00:00:00 rcu_gp
...

OR

ps -ef //Provides a full-format listing

Sample Output:

# ps -ef
UID          PID    PPID  C STIME TTY          TIME CMD
root           1       0  0 Sep05 ?        00:01:28 /sbin/init
root           2       0  0 Sep05 ?        00:00:00 [kthreadd]
...

OR

ps -eF   //Provides a Extra full-format listing

Sample Output:

# ps -eF
UID          PID    PPID  C    SZ   RSS PSR STIME TTY          TIME CMD
root           1       0  0 41859  9752   0 Sep05 ?        00:01:28 /sbin/init
root           2       0  0     0     0   0 Sep05 ?        00:00:00 [kthreadd]
...

You can use -l (long format) option to provide a more detailed view of the processes, especially in terms of scheduling and memory.

# ps -el
F S   UID     PID    PPID  C PRI  NI ADDR SZ WCHAN  TTY          TIME CMD
4 S     0       1       0  0  80   0 - 41859 ep_pol ?        00:01:28 systemd
1 S     0       2       0  0  80   0 -     0 kthrea ?        00:00:00 kthreadd
...

b) BSD-style

ps aux

The aux option in BSD style, is among the most frequently used variations of ps due to the depth of information it provides.

• a: Stands for "all users". Without this option, ps would only display processes for the current user. By using a, it displays processes for all users on the system.

• u: Specifies the "user-oriented" format. This format displays detailed information about each process, including:
  • USER: The owner of the process.
  • %CPU: Percentage of the CPU being used by the process.
  • %MEM: Percentage of RAM being used.
  • VSZ: Virtual Memory Size in kilobytes.
  • RSS: Resident Set Size in kilobytes - the portion of the process's memory that is held in RAM.
  • TTY: The terminal type. If the value is ?, the process is not associated with any terminal.
  • STAT: The process status.
  • START: The start time of the process.
  • TIME: Total accumulated CPU time used by the process since it started.
  • COMMAND: The command or program being executed.

x: Includes processes not attached to a terminal, i.e., processes that are running in the background.

Displaying process hierarchies

To view processes in a hierarchical manner, showcasing parent-child relationships, you can use the --forest option or the -f option:

Command:

ps -ef --forest

The indents and \_ symbols depict the parent-child relationships between the processes.

OR

ps auxf

This will present processes in a tree structure, helping you understand which processes were spawned by others.

Process Selection

The ps command provides a variety of ways to select and display processes based on different criteria.

By PID (Process ID)

You can use the -p option followed by the Process ID (or a list of PIDs) to display specific processes.

ps -p PID

For multiple PIDs:

ps -p PID1,PID2,PID3

By PGID (Process Group ID)

To select processes based on the Process Group ID, you use the -g option.

ps -g PGID

By session ID

You can select processes by their session ID using the -s option followed by the session ID.

ps -s SID

By user

By terminal

To select processes associated with a specific terminal or tty, you use the -t option.

ps -t tty1

Replace tty1 with the specific terminal name or its number.

Output Formatting

With the -o option (or o without a dash in BSD-style), you can specify the exact columns you want to display.

Syntax:

ps -o field1,field2,...

For example, to display just the PID, user, and command fields:

ps -o pid,user,cmd

Some commonly used format specifiers include:

• pid: Process ID.
• user or uid: User running the process.
• comm: Command name.
• %cpu: CPU utilization.
• %mem: Memory utilization.
• start: Start time of the process.
• time: Total CPU time used by the process.

You can sort the output based on any field using the --sort option.

For example, to sort processes based on memory usage:

ps -eo pid,user,%mem,cmd --sort -%mem

In the above command:

• -eo pid,user,%mem,cmd: Specifies a custom output format.
• --sort -%mem: Sorts the output by memory usage in descending order.

To combine multiple sort fields, you can separate them using commas:

ps -eo pid,user,%mem,%cpu,cmd --sort -%mem,-%cpu

This will sort by memory usage first, then by CPU usage, both in descending order.

Threads

Threads, often referred to as lightweight processes, offer a mechanism for parallel execution of code. The ps command, traditionally used for displaying processes, can also be utilized to view threads with appropriate options.

To view all threads for all processes:

ps -eLf

Here:

• -e: Shows all processes.
• -L: Shows info for all threads.
• -f: Provides full-format listing.

In the output, you'll see:

• PID: Process ID.
• PPID: Parent Process ID.
• LWP: LightWeight Process ID, which represents the Thread ID.
• CMD: The command associated with the thread or process.

Once you know the Process ID (PID) of a specific process, you can view its threads using:

ps -T -p <PID>
or
ps -T -C <Command-Name>

Example:

ps -T -p 784

This command shows all threads for the process with PID 784. The second column (SPID) shows thread ID or the ID for the individual thread (referred to as LightWeight Process ID or LWP). This will be unique for each thread.

Note: If the process is a multi-threaded process, you'll see multiple lines in the output, each representing a different thread of that process. If it's a single-threaded process, you'll just see one line corresponding to the main thread.

To get the total number of threads of the process, you can use ps -o nlwp 784. From the above output, the total number of threads is 4. You can also find this information in /proc/<PID>/status/ file.

Related read: How to Show the Threads of a Process in Linux

Controlling Output Width

By default, the ps command will determine the column width based on the content it needs to display and the width of your terminal window.

You can specify a fixed width for any column using the : syntax with the -o option

ps -e -o cmd:50

In the above command, the cmd column will have a width of 50 characters.

Without any adjustments, ps will truncate values to fit within the defined or default column width. You can use w option to widen the display. It can be used multiple times to keep increasing the width.

Example:

ps ww -o cmd

Displaying process commands (cmd) without truncating them (assuming they aren't excessively long):

Use Cases and Examples

In addition to examples in the previous section here we list some useful examples of ps command.

1. Sort processes by Memory or CPU Usage

$ ps aux --sort=-%mem   # Sort by memory
$ ps aux --sort=-%cpu   # Sort by CPU

Use Case: Identify which processes are consuming the most resources.

2. Display process start time

$ ps -eo pid,cmd,start

Determine when a particular process began execution

3. Display processes in a custom format

$ ps -eo pid,cmd,%mem,%cpu --sort=-%mem

Use Case: Extract specific details about processes in a tailored format.

4. Search processes by Name

$ ps aux | grep <process_name>

Use Case: Find all instances of a particular application or command.

5. Display processes with specific PID

$ ps -p <pid1>,<pid2>

Use Case: Check details of processes by their Process IDs.

6. Finding the Parent of a Specific Process

$ ps -o pid,ppid,cmd -p <PID>

This will display the PID, PPID, and command (CMD) of the specified process. The PPID column will give you the parent process's ID.

If you want to find all child processes of a particular parent, you can search for processes that have a given PPID:

$ ps --ppid <PPID>

7. Check process elapsed time

The etime option displays the elapsed time since the process was started, in the format [days-]hours:minutes:seconds.

Example:

ps -e -o pid,cmd,etime
or
ps -e -o pid,cmd,etime -p <PID>  //Elapsed time for specific process id.

Sample output:

# ps -o pid,cmd,etime -p 606
    PID CMD                             ELAPSED
    606 nginx: master process /usr/ 27-02:35:05

This will display a list of all processes with their PID, the command they are executing, and the elapsed time since they started. In this case, it has been running for 27 days, 2 hours, 35 minutes, and 5 seconds.

If this resource helped you, let us know your care by a Thanks Tweet. Tweet a thanks

Did you find this article helpful?

We are glad you liked the article. Share with your friends.

"]

Sorry about that.

How can we improve it?