The ps command, short for "process status," is used in UNIX and UNIX-like operating systems to view information about processes running in a system. It offers system administrators, developers, and other users insights into the system's process activity.
The ps command is part of the procps package on most Linux distributions. In addition to ps, the procps package typically includes tools like: top, vmstat, free etc.
The basic syntax of the ps command is:
Commonly used ps options:
-e: Display information about all processes.
-f: Provide a full-format listing.
-l: Display long format.
-u user: Display processes owned by user.
-x: Include processes not attached to a terminal.
-o format: User-defined format.
-p PID: Display information for a specific process ID (or list of PIDs).
-T: Display information about processes and threads.
Running the ps command without any options will display a basic list of processes that are associated with the terminal from which the command is executed.
Output typically includes:
- PID: Process ID.
- TTY: Terminal type associated with the process.
- TIME: Total CPU time the process has taken.
- CMD: The command that initiated the process.
To display processes for a specific user, you use the -u option followed by the username.
ps -u ubuntu
This will list all processes owned by the user 'ubuntu'.
Displaying all processes
To see every process on the system, you can use several options:
# ps -e PID TTY TIME CMD 1 ? 00:01:28 systemd 2 ? 00:00:00 kthreadd 3 ? 00:00:00 rcu_gp ...
ps -ef //Provides a full-format listing
# ps -ef UID PID PPID C STIME TTY TIME CMD root 1 0 0 Sep05 ? 00:01:28 /sbin/init root 2 0 0 Sep05 ? 00:00:00 [kthreadd] ...
ps -eF //Provides a Extra full-format listing
# ps -eF UID PID PPID C SZ RSS PSR STIME TTY TIME CMD root 1 0 0 41859 9752 0 Sep05 ? 00:01:28 /sbin/init root 2 0 0 0 0 0 Sep05 ? 00:00:00 [kthreadd] ...
You can use -l (long format) option to provide a more detailed view of the processes, especially in terms of scheduling and memory.
# ps -el F S UID PID PPID C PRI NI ADDR SZ WCHAN TTY TIME CMD 4 S 0 1 0 0 80 0 - 41859 ep_pol ? 00:01:28 systemd 1 S 0 2 0 0 80 0 - 0 kthrea ? 00:00:00 kthreadd ...
The aux option in BSD style, is among the most frequently used variations of ps due to the depth of information it provides.
- a: Stands for "all users". Without this option, ps would only display processes for the current user. By using a, it displays processes for all users on the system.
- u: Specifies the "user-oriented" format. This format displays detailed information about each process, including:
- USER: The owner of the process.
- %CPU: Percentage of the CPU being used by the process.
- %MEM: Percentage of RAM being used.
- VSZ: Virtual Memory Size in kilobytes.
- RSS: Resident Set Size in kilobytes - the portion of the process's memory that is held in RAM.
- TTY: The terminal type. If the value is
?, the process is not associated with any terminal.
- STAT: The process status.
- START: The start time of the process.
- TIME: Total accumulated CPU time used by the process since it started.
- COMMAND: The command or program being executed.
x: Includes processes not attached to a terminal, i.e., processes that are running in the background.
Unix-style: Options begin with a dash.
BSD-style: Options are used without a leading dash. This style is more concise.
GNU/Linux: Which begin with double dashes (
Displaying process hierarchies
To view processes in a hierarchical manner, showcasing parent-child relationships, you can use the --forest option or the -f option:
ps -ef --forest
The indents and
\_ symbols depict the parent-child relationships between the processes.
This will present processes in a tree structure, helping you understand which processes were spawned by others.
The ps command provides a variety of ways to select and display processes based on different criteria.
By PID (Process ID)
You can use the -p option followed by the Process ID (or a list of PIDs) to display specific processes.
ps -p PID
For multiple PIDs:
ps -p PID1,PID2,PID3
By PGID (Process Group ID)
To select processes based on the Process Group ID, you use the -g option.
ps -g PGID
By session ID
You can select processes by their session ID using the -s option followed by the session ID.
ps -s SID
To select processes associated with a specific terminal or tty, you use the -t option.
ps -t tty1
Replace tty1 with the specific terminal name or its number.
With the -o option (or
o without a dash in BSD-style), you can specify the exact columns you want to display.
ps -o field1,field2,...
For example, to display just the PID, user, and command fields:
ps -o pid,user,cmd
Some commonly used format specifiers include:
pid: Process ID.
uid: User running the process.
comm: Command name.
%cpu: CPU utilization.
%mem: Memory utilization.
start: Start time of the process.
time: Total CPU time used by the process.
You can sort the output based on any field using the --sort option.
For example, to sort processes based on memory usage:
ps -eo pid,user,%mem,cmd --sort -%mem
In the above command:
-eo pid,user,%mem,cmd: Specifies a custom output format.
--sort -%mem: Sorts the output by memory usage in descending order.
To combine multiple sort fields, you can separate them using commas:
ps -eo pid,user,%mem,%cpu,cmd --sort -%mem,-%cpu
This will sort by memory usage first, then by CPU usage, both in descending order.
Threads, often referred to as lightweight processes, offer a mechanism for parallel execution of code. The ps command, traditionally used for displaying processes, can also be utilized to view threads with appropriate options.
To view all threads for all processes:
-e: Shows all processes.
-L: Shows info for all threads.
-f: Provides full-format listing.
In the output, you'll see:
- PID: Process ID.
- PPID: Parent Process ID.
- LWP: LightWeight Process ID, which represents the Thread ID.
- CMD: The command associated with the thread or process.
Once you know the Process ID (PID) of a specific process, you can view its threads using:
ps -T -p <PID>or
ps -T -C <Command-Name>
ps -T -p 784
This command shows all threads for the process with PID 784. The second column (SPID) shows thread ID or the ID for the individual thread (referred to as LightWeight Process ID or LWP). This will be unique for each thread.
Note: If the process is a multi-threaded process, you'll see multiple lines in the output, each representing a different thread of that process. If it's a single-threaded process, you'll just see one line corresponding to the main thread.
To get the total number of threads of the process, you can use ps -o nlwp 784. From the above output, the total number of threads is 4. You can also find this information in /proc/<PID>/status/ file.
Related read: How to Show the Threads of a Process in Linux
Controlling Output Width
By default, the ps command will determine the column width based on the content it needs to display and the width of your terminal window.
You can specify a fixed width for any column using the
: syntax with the
ps -e -o cmd:50
In the above command, the cmd column will have a width of 50 characters.
Without any adjustments, ps will truncate values to fit within the defined or default column width. You can use w option to widen the display. It can be used multiple times to keep increasing the width.
ps ww -o cmd
Displaying process commands (cmd) without truncating them (assuming they aren't excessively long):
Use Cases and Examples
In addition to examples in the previous section here we list some useful examples of ps command.
1. Sort processes by Memory or CPU Usage
$ ps aux --sort=-%mem # Sort by memory $ ps aux --sort=-%cpu # Sort by CPU
Use Case: Identify which processes are consuming the most resources.
2. Display process start time
$ ps -eo pid,cmd,start
Determine when a particular process began execution
3. Display processes in a custom format
$ ps -eo pid,cmd,%mem,%cpu --sort=-%mem
Use Case: Extract specific details about processes in a tailored format.
4. Search processes by Name
$ ps aux | grep <process_name>
Use Case: Find all instances of a particular application or command.
5. Display processes with specific PID
$ ps -p <pid1>,<pid2>
Use Case: Check details of processes by their Process IDs.
6. Finding the Parent of a Specific Process
$ ps -o pid,ppid,cmd -p <PID>
This will display the PID, PPID, and command (CMD) of the specified process. The PPID column will give you the parent process's ID.
If you want to find all child processes of a particular parent, you can search for processes that have a given PPID:
$ ps --ppid <PPID>
7. Check process elapsed time
The etime option displays the elapsed time since the process was started, in the format [days-]hours:minutes:seconds.
ps -e -o pid,cmd,etimeor
ps -e -o pid,cmd,etime -p <PID> //Elapsed time for specific process id.
# ps -o pid,cmd,etime -p 606 PID CMD ELAPSED 606 nginx: master process /usr/ 27-02:35:05
This will display a list of all processes with their PID, the command they are executing, and the elapsed time since they started. In this case, it has been running for 27 days, 2 hours, 35 minutes, and 5 seconds.