The ps command in Linux is our best asset for listing running processes on a system. But do you know how to use it effectively? ps comes with a small learning curve, thanks to its varying syntax and plethora of (overlapping) options. In this guide, we’ll go over the most useful ps commands that Linux users should know.
Command syntax for ps can be confusing because it accepts UNIX, BSD, and GNU formatted options. These various syntaxes also produce differing output. As long as you know some of the most common and useful options to supply with your ps command, then you don’t need to worry about the tool’s extensive and intertwined past. We’ll just show you what you need to know.
List all running processes
There’s one ps command that all Linux users need to know, maybe even the only one that you really need. The following command uses BSD syntax (no dashes) to list all the running processes on our system. The a option will list processes from all users, u lists detailed information for each process, and x will include processes that aren’t tied to any tty.
$ ps aux
Have you committed that one to memory yet? Because that is the one you really need. It will produce output like the following:
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND kernoops 735 0.0 0.0 11264 448 ? Ss 11:48 0:00 /usr/sbin/kerneloops root 903 0.0 0.4 239484 8752 ? Ssl 11:49 0:00 /usr/sbin/gdm3 root 908 0.0 0.1 295424 2692 ? Sl 11:49 0:00 /usr/sbin/VBoxService --pidfile /var/run/vboxadd-service.sh root 921 0.0 0.4 166944 9248 ? Sl 11:49 0:00 gdm-session-worker [pam/gdm-autologin] linuxni+ 928 0.7 0.5 19272 10524 ? Ss 11:49 0:01 /lib/systemd/systemd --user linuxni+ 934 0.4 0.9 1146112 18556 ? S<sl 11:49 0:00 /usr/bin/pulseaudio --daemonize=no --log-target=journal linuxni+ 936 0.2 1.1 511464 23880 ? SNsl 11:49 0:00 /usr/libexec/tracker-miner-fs linuxni+ 939 0.0 0.3 240028 7112 ? Sl 11:49 0:00 /usr/bin/gnome-keyring-daemon --daemonize --login linuxni+ 943 0.5 0.2 8508 5700 ? Ss 11:49 0:00 /usr/bin/dbus-daemon --session --address=systemd: --nofork -- linuxni+ 946 0.0 0.3 164020 6408 tty2 Ssl+ 11:49 0:00 /usr/lib/gdm3/gdm-x-session --run-script env GNOME_SHELL_SESS
This is just an excerpt. In reality, the command flooded our whole screen. But that’s because ps lists each running process on a new line. If you’re going to use the command without grepping for anything specifically, then do yourself a favor by piping to less or more.
$ ps aux | less
Or…
$ ps aux | more -20
As you can see from our output above, the ps aux command has given us very detailed information about the processes running on our system. Maybe a little too detailed. But we’ll learn how to deal with that later. For now, let’s go over a quick rundown of what each column represents.
USER– User that owns the running process.PID– The process ID.%CPU– Amount of CPU the process is utilizing.%MEM– Amount of RAM the process is utilizing.VSZ– Amount of virtual memory the process it utilizing.RSS– Amount of physical memory the process is utilizing.TTY– Which tty (terminal screen) the process belongs to.STAT– Status code of the process (detailed list of meanings is in the man page).START– What time the process began.TIME– Total amount of CPU time the process has used.COMMAND– The full command used to spawn the process.
In case you’re not overwhelmed yet, we can also use UNIX syntax (dashes) with ps! This will produce different, but very similar output.
You’re likely to see this command about as often as the BSD equivalent. Here’s how to list all running processes through UNIX syntax. The -e option lists processes from all users, and -f displays detailed information about each running process.
$ ps -ef
And here’s an excerpt of the output, listing the same processes as the ps aux command earlier.
UID PID PPID C STIME TTY TIME CMD kernoops 735 1 0 11:48 ? 00:00:00 /usr/sbin/kerneloops root 903 1 0 11:49 ? 00:00:00 /usr/sbin/gdm3 root 908 1 0 11:49 ? 00:00:00 /usr/sbin/VBoxService --pidfile /var/run/vboxadd-service.sh root 921 903 0 11:49 ? 00:00:00 gdm-session-worker [pam/gdm-autologin] linuxni+ 928 1 0 11:49 ? 00:00:01 /lib/systemd/systemd --user linuxni+ 934 928 0 11:49 ? 00:00:00 /usr/bin/pulseaudio --daemonize=no --log-target=journal linuxni+ 936 928 0 11:49 ? 00:00:00 /usr/libexec/tracker-miner-fs linuxni+ 939 1 0 11:49 ? 00:00:00 /usr/bin/gnome-keyring-daemon --daemonize --login linuxni+ 943 928 0 11:49 ? 00:00:01 /usr/bin/dbus-daemon --session --address=systemd: --nofork -- linuxni+ 946 921 0 11:49 tty2 00:00:00 /usr/lib/gdm3/gdm-x-session --run-script env GNOME_SHELL_SESS
That looks pretty similar, but we have one new column (PPID) and some of the others have been renamed. Quick rundown:
UID– User ID, same asUSER.PPID– Parent process ID. In other words, what process owns this process?C– CPU Utilization, same as%CPU.STIME– Start time, same asSTART.
How often are you actually going to want to see every running process? (hint: the answer is never). Usually, if you’re using either the ps aux or ps -ef commands, you’re probably checking to see if a particular process is running. In that case, just pipe to grep.
$ ps aux | grep nginx root 2049 0.0 0.0 57328 1496 ? Ss 12:21 0:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on; www-data 2050 0.0 0.2 57896 5288 ? S 12:21 0:00 nginx: worker process linuxni+ 2445 0.0 0.0 8908 664 pts/0 S+ 12:21 0:00 grep --color=auto nginx
Or…
$ ps -ef | grep nginx root 2049 1 0 12:21 ? 00:00:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on; www-data 2050 2049 0 12:21 ? 00:00:00 nginx: worker process linuxni+ 2447 1642 0 12:21 pts/0 00:00:00 grep --color=auto nginx
Note that the last process listed (this one: grep --color=auto nginx) is actually the process of us grepping for nginx. So, that one can be ignored. What we really wanted to see is that the root user is running the nginx master process, and the www-data user is running the nginx worker process. We also see, at a glance, how many resources the process is using, and its PID in case we want to issue a kill command, for example.
Now that you have the most essential ps usage examples out of the way, you can either stop here, or keep reading if you want to torture yourself by learning about some other handy options.
List processes for a particular user
To see a list of processes being run under a particular user, you can use the following command syntax. In this example, we only list the processes that belong to root. The -U and -u options allow us to specify the user’s real and effective user ID, and the u option will list detailed info about each process.
$ ps -U root -u root u USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 1.4 0.5 102328 11616 ? Ss 12:44 0:02 /sbin/init splash root 2 0.0 0.0 0 0 ? S 12:44 0:00 [kthreadd] root 3 0.0 0.0 0 0 ? I< 12:44 0:00 [rcu_gp] root 4 0.0 0.0 0 0 ? I< 12:44 0:00 [rcu_par_gp] root 5 0.0 0.0 0 0 ? I 12:44 0:00 [kworker/0:0-cgroup_destroy]
List the header in ps grep command
When grepping with ps, it’s hard to remember what all these columns are. You can use the following command to grep for a running process, while also preserving the first line of the ps output.
$ ps aux | { head -1; grep nginx; }
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 2049 0.0 0.0 57328 1496 ? Ss 12:21 0:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
www-data 2050 0.0 0.2 57896 5288 ? S 12:21 0:00 nginx: worker process
Or…
$ ps -ef | { head -1; grep nginx; }
UID PID PPID C STIME TTY TIME CMD
root 2049 1 0 12:21 ? 00:00:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
www-data 2050 2049 0 12:21 ? 00:00:00 nginx: worker process
Sort ps output by column
By default, ps will list all processes in order of their PID, which typically isn’t that useful. Instead, we can sort processes by user, CPU usage, or any other column we want. For this, we get to use GNU syntax (double dashes) along with our BSD or UNIX syntax.
In the following example, we sort by memory usage in BSD syntax:
$ ps aux --sort=-%mem
Or, to sort by CPU usage in UNIX syntax:
$ ps -ef --sort=-c
Isolate columns in ps output
Our ps aux command breaks up data into a lot of different columns. Depending on what you’re looking for, some of these columns are likely to be irrelevant. We can drop the u option from our command and include o instead, which allows us to specify which columns we want to see.
The following command will only show us the PID, %CPU, and COMMAND columns. Notice we just separate each column name by a comma.
$ ps axo pid,%cpu,command
We can make this command even more helpful if we sort the processes by their CPU usage, and pipe to less so our screen doesn’t get flooded.
$ ps axo pid,%cpu,command --sort=-%cpu | less PID %CPU COMMAND 1219 2.4 /usr/bin/gnome-shell 953 0.7 /usr/lib/xorg/Xorg vt2 -displayfd 3 -auth /run/user/1000/gdm/Xauthority 1129 0.5 /usr/bin/VBoxClient --draganddrop 1634 0.3 /usr/libexec/gnome-terminal-server
Of course, we can also isolate columns in UNIX syntax. Instead of ps -ef, we’ll need to replace the -f option with -o. Check the following example where we instruct ps to only display UID, PID, PPID, and CMD.
$ ps -eo uid,pid,ppid,cmd
Let’s use the previous command, but sort the output by User ID and pipe to more to clean up the output.
$ ps -eo uid,pid,ppid,cmd --sort=-uid | more -20 UID PID PPID CMD 1000 928 1 /lib/systemd/systemd --user 1000 929 928 (sd-pam) 1000 934 928 /usr/bin/pulseaudio --daemonize=no --log-target=journal 1000 936 928 /usr/libexec/tracker-miner-fs 1000 939 1 /usr/bin/gnome-keyring-daemon --daemonize --login
Conclusion
The takeaway here is that the ps command is a powerful tool to show us what processes are running on our Linux system. And while it has many options, the only one you need to memorize is ps aux, or its near equivalent ps -ef. With these two commands, and a little grepping, you’ll obtain all the information you need to know. Still, some extra profeciency with ps can be convenient, and we’ve shown you how to accomplish that in this guide.
