Using the ps Command in Linux to List Processes

March 20, 2021 | 6 min read

The ps command in Linux is our best asset for listing running processes on a system. But do you know how to use it effectively? ps comes with a small learning curve, thanks to its varying syntax and plethora of (overlapping) options. In this guide, we'll go over the most useful ps commands that Linux users should know.

Command syntax for ps can be confusing because it accepts UNIX, BSD, and GNU formatted options. These various syntaxes also produce differing output. As long as you know some of the most common and useful options to supply with your ps command, then you don't need to worry about the tool's extensive and intertwined past. We'll just show you what you need to know.

List all running processes

There's one ps command that all Linux users need to know, maybe even the only one that you really need. The following command uses BSD syntax (no dashes) to list all the running processes on our system. The a option will list processes from all users, u lists detailed information for each process, and x will include processes that aren't tied to any tty.

$ ps aux

Have you committed that one to memory yet? Because that is the one you really need. It will produce output like the following:

kernoops     735  0.0  0.0  11264   448 ?        Ss   11:48   0:00 /usr/sbin/kerneloops
root         903  0.0  0.4 239484  8752 ?        Ssl  11:49   0:00 /usr/sbin/gdm3
root         908  0.0  0.1 295424  2692 ?        Sl   11:49   0:00 /usr/sbin/VBoxService --pidfile /var/run/
root         921  0.0  0.4 166944  9248 ?        Sl   11:49   0:00 gdm-session-worker [pam/gdm-autologin]
linuxni+     928  0.7  0.5  19272 10524 ?        Ss   11:49   0:01 /lib/systemd/systemd --user
linuxni+     934  0.4  0.9 1146112 18556 ?       S<sl 11:49   0:00 /usr/bin/pulseaudio --daemonize=no --log-target=journal
linuxni+     936  0.2  1.1 511464 23880 ?        SNsl 11:49   0:00 /usr/libexec/tracker-miner-fs
linuxni+     939  0.0  0.3 240028  7112 ?        Sl   11:49   0:00 /usr/bin/gnome-keyring-daemon --daemonize --login
linuxni+     943  0.5  0.2   8508  5700 ?        Ss   11:49   0:00 /usr/bin/dbus-daemon --session --address=systemd: --nofork --
linuxni+     946  0.0  0.3 164020  6408 tty2     Ssl+ 11:49   0:00 /usr/lib/gdm3/gdm-x-session --run-script env GNOME_SHELL_SESS

This is just an excerpt. In reality, the command flooded our whole screen. But that's because ps lists each running process on a new line. If you're going to use the command without grepping for anything specifically, then do yourself a favor by piping to less or more.

$ ps aux | less


$ ps aux | more -20

As you can see from our output above, the ps aux command has given us very detailed information about the processes running on our system. Maybe a little too detailed. But we'll learn how to deal with that later. For now, let's go over a quick rundown of what each column represents.

  • USER - User that owns the running process.
  • PID - The process ID.
  • %CPU - Amount of CPU the process is utilizing.
  • %MEM - Amount of RAM the process is utilizing.
  • VSZ - Amount of virtual memory the process it utilizing.
  • RSS - Amount of physical memory the process is utilizing.
  • TTY - Which tty (terminal screen) the process belongs to.
  • STAT - Status code of the process (detailed list of meanings is in the man page).
  • START - What time the process began.
  • TIME - Total amount of CPU time the process has used.
  • COMMAND - The full command used to spawn the process.

In case you're not overwhelmed yet, we can also use UNIX syntax (dashes) with ps! This will produce different, but very similar output.

You're likely to see this command about as often as the BSD equivalent. Here's how to list all running processes through UNIX syntax. The -e option lists processes from all users, and -f displays detailed information about each running process.

$ ps -ef

And here's an excerpt of the output, listing the same processes as the ps aux command earlier.

UID          PID    PPID  C STIME TTY          TIME CMD
kernoops     735       1  0 11:48 ?        00:00:00 /usr/sbin/kerneloops
root         903       1  0 11:49 ?        00:00:00 /usr/sbin/gdm3
root         908       1  0 11:49 ?        00:00:00 /usr/sbin/VBoxService --pidfile /var/run/
root         921     903  0 11:49 ?        00:00:00 gdm-session-worker [pam/gdm-autologin]
linuxni+     928       1  0 11:49 ?        00:00:01 /lib/systemd/systemd --user
linuxni+     934     928  0 11:49 ?        00:00:00 /usr/bin/pulseaudio --daemonize=no --log-target=journal
linuxni+     936     928  0 11:49 ?        00:00:00 /usr/libexec/tracker-miner-fs
linuxni+     939       1  0 11:49 ?        00:00:00 /usr/bin/gnome-keyring-daemon --daemonize --login
linuxni+     943     928  0 11:49 ?        00:00:01 /usr/bin/dbus-daemon --session --address=systemd: --nofork --
linuxni+     946     921  0 11:49 tty2     00:00:00 /usr/lib/gdm3/gdm-x-session --run-script env GNOME_SHELL_SESS

That looks pretty similar, but we have one new column (PPID) and some of the others have been renamed. Quick rundown:

  • UID - User ID, same as USER.
  • PPID - Parent process ID. In other words, what process owns this process?
  • C - CPU Utilization, same as %CPU.
  • STIME - Start time, same as START.

How often are you actually going to want to see every running process? (hint: the answer is never). Usually, if you're using either the ps aux or ps -ef commands, you're probably checking to see if a particular process is running. In that case, just pipe to grep.

$ ps aux | grep nginx

root        2049  0.0  0.0  57328  1496 ?        Ss   12:21   0:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
www-data    2050  0.0  0.2  57896  5288 ?        S    12:21   0:00 nginx: worker process
linuxni+    2445  0.0  0.0   8908   664 pts/0    S+   12:21   0:00 grep --color=auto nginx


$ ps -ef | grep nginx

root        2049       1  0 12:21 ?        00:00:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
www-data    2050    2049  0 12:21 ?        00:00:00 nginx: worker process
linuxni+    2447    1642  0 12:21 pts/0    00:00:00 grep --color=auto nginx

Note that the last process listed (this one: grep --color=auto nginx) is actually the process of us grepping for nginx. So, that one can be ignored. What we really wanted to see is that the root user is running the nginx master process, and the www-data user is running the nginx worker process. We also see, at a glance, how many resources the process is using, and its PID in case we want to issue a kill command, for example.

Now that you have the most essential ps usage examples out of the way, you can either stop here, or keep reading if you want to torture yourself by learning about some other handy options.

List processes for a particular user

To see a list of processes being run under a particular user, you can use the following command syntax. In this example, we only list the processes that belong to root. The -U and -u options allow us to specify the user's real and effective user ID, and the u option will list detailed info about each process.

$ ps -U root -u root u

root           1  1.4  0.5 102328 11616 ?        Ss   12:44   0:02 /sbin/init splash
root           2  0.0  0.0      0     0 ?        S    12:44   0:00 [kthreadd]
root           3  0.0  0.0      0     0 ?        I<   12:44   0:00 [rcu_gp]
root           4  0.0  0.0      0     0 ?        I<   12:44   0:00 [rcu_par_gp]
root           5  0.0  0.0      0     0 ?        I    12:44   0:00 [kworker/0:0-cgroup_destroy]

List the header in ps grep command

When grepping with ps, it's hard to remember what all these columns are. You can use the following command to grep for a running process, while also preserving the first line of the ps output.

$ ps aux | { head -1; grep nginx; }

root        2049  0.0  0.0  57328  1496 ?        Ss   12:21   0:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
www-data    2050  0.0  0.2  57896  5288 ?        S    12:21   0:00 nginx: worker process


$ ps -ef | { head -1; grep nginx; }

UID          PID    PPID  C STIME TTY          TIME CMD
root        2049       1  0 12:21 ?        00:00:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
www-data    2050    2049  0 12:21 ?        00:00:00 nginx: worker process

Sort ps output by column

By default, ps will list all processes in order of their PID, which typically isn't that useful. Instead, we can sort processes by user, CPU usage, or any other column we want. For this, we get to use GNU syntax (double dashes) along with our BSD or UNIX syntax.

In the following example, we sort by memory usage in BSD syntax:

$ ps aux --sort=-%mem

Or, to sort by CPU usage in UNIX syntax:

$ ps -ef --sort=-c

Isolate columns in ps output

Our ps aux command breaks up data into a lot of different columns. Depending on what you're looking for, some of these columns are likely to be irrelevant. We can drop the u option from our command and include o instead, which allows us to specify which columns we want to see.

The following command will only show us the PID, %CPU, and COMMAND columns. Notice we just separate each column name by a comma.

$ ps axo pid,%cpu,command

We can make this command even more helpful if we sort the processes by their CPU usage, and pipe to less so our screen doesn't get flooded.

$ ps axo pid,%cpu,command --sort=-%cpu | less

1219  2.4 /usr/bin/gnome-shell
953  0.7 /usr/lib/xorg/Xorg vt2 -displayfd 3 -auth /run/user/1000/gdm/Xauthority
1129  0.5 /usr/bin/VBoxClient --draganddrop
1634  0.3 /usr/libexec/gnome-terminal-server

Of course, we can also isolate columns in UNIX syntax. Instead of ps -ef, we'll need to replace the -f option with -o. Check the following example where we instruct ps to only display UID, PID, PPID, and CMD.

$ ps -eo uid,pid,ppid,cmd

Let's use the previous command, but sort the output by User ID and pipe to more to clean up the output.

$ ps -eo uid,pid,ppid,cmd --sort=-uid | more -20

1000     928       1 /lib/systemd/systemd --user
1000     929     928 (sd-pam)
1000     934     928 /usr/bin/pulseaudio --daemonize=no --log-target=journal
1000     936     928 /usr/libexec/tracker-miner-fs
1000     939       1 /usr/bin/gnome-keyring-daemon --daemonize --login


The takeaway here is that the ps command is a powerful tool to show us what processes are running on our Linux system. And while it has many options, the only one you need to memorize is ps aux, or its near equivalent ps -ef. With these two commands, and a little grepping, you'll obtain all the information you need to know. Still, some extra profeciency with ps can be convenient, and we've shown you how to accomplish that in this guide.