The Unix and Linux ps command

Unix/Linux processes FAQ: Can you share some examples of the Linux ps command? (Or, how do I use theps command?)

The basic Linux ps command

If you run the ps command by itself, it only shows very basic information about the processes you are currently running. For example, if you issue the basic command like this without any arguments:

ps

you'll see output from this command looks something like this:

  PID TTY           TIME CMD
 4343 ttys000    0:00.35 -bash
 2617 ttys001    0:00.65 -bash
18201 ttys003    0:00.27 -bash

The PID column shows the process-id, the second column shows the TTY (terminal) the process is attached to, the TIME column shows how much CPU time the process has used, and the CMD column shows the command that is running. In this case I can tell (from experience) that I have three bash shells (terminals) running on my current system.

In practice I never run the ps command without any arguments like this, but I wanted to show this to help us get started.

There are many ways to customize the output of the ps command. For instance, I can add the f argument to get "full" information about each process. Used by itself, the f argument shows "full" information about just my processes. As an example, this command:

ps -f

leads to this output:

  UID   PID  PPID   C     STIME TTY           TIME CMD
  501  4343  4342   0   0:00.18 ttys000    0:00.35 -bash
  501  2617  2616   0   0:00.41 ttys001    0:00.66 -bash
  501 18201 18200   0   0:00.15 ttys003    0:00.27 -bash

As you can see this adds a few more columns of output to my ps command, including UID (user-id), PPID (parent process-id), and a couple of other columns I don't really look at.

Showing information about every process

As mentioned, those two ps command examples just show information about your processes. If you're a Linux system administrator, you're typically interested in information about all the processes running on the system. To show every process running on the system, we add the e argument to our previous ps command, like this:

ps -ef

This leads to much more output:

UID        PID  PPID  C STIME TTY          TIME CMD
root         1     0  0 Oct21 ?        00:00:01 init [3]                                              
root         2     1  0 Oct21 ?        00:00:00 [migration/0]
root         3     1  0 Oct21 ?        00:00:00 [ksoftirqd/0]
root         4     1  0 Oct21 ?        00:00:00 [watchdog/0]
root         5     1  0 Oct21 ?        00:00:00 [migration/1]
root         6     1  0 Oct21 ?        00:00:00 [ksoftirqd/1]
root         7     1  0 Oct21 ?        00:00:00 [watchdog/1]
root         8     1  0 Oct21 ?        00:00:00 [events/0]
root         9     1  0 Oct21 ?        00:00:00 [events/1]
root        10     1  0 Oct21 ?        00:00:00 [khelper]
root        11     1  0 Oct21 ?        00:00:00 [kthread]
root        15    11  0 Oct21 ?        00:00:00 [kblockd/0]
root        16    11  0 Oct21 ?        00:00:00 [kblockd/1]
root        17    11  0 Oct21 ?        00:00:00 [kacpid]
root        91    11  0 Oct21 ?        00:00:00 [cqueue/0]
root        92    11  0 Oct21 ?        00:00:00 [cqueue/1]
root        95    11  0 Oct21 ?        00:00:00 [khubd]
root        97    11  0 Oct21 ?        00:00:00 [kseriod]
root       158    11  0 Oct21 ?        00:00:00 [pdflush]

That was actually just the first 20 lines of output from this ps command on my CentOS Linux test system. This command actually generated 99 lines of output, and I cropped it to just show the first 20 lines (using ps -ef | head -20).

As mentioned, that's the older way to list processes on a Unix system (and it may still be preferred on Unix systems like HP-UX, AIX, and Solaris; I don't really know, I just use Linux and Mac OS X these days). I wanted to show these options to you (a) to help you learn about the ps command, and (b) see that there are other ps command options than what most people use on a day to day basis. Given that background, let's take a look at how the ps command is typically used on Linux systems.

How the Linux ps command is typically used

Now that you've seen some ps command arguments and sample output, here's how I run the ps command about 80% of the time:

ps auxwww | more

The first 20 lines of output from this command look like this:

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.0   2064   620 ?        Ss   Oct21   0:01 init [3]                                              
root         2  0.0  0.0      0     0 ?        S<   Oct21   0:00 [migration/0]
root         3  0.0  0.0      0     0 ?        SN   Oct21   0:00 [ksoftirqd/0]
root         4  0.0  0.0      0     0 ?        S<   Oct21   0:00 [watchdog/0]
root         5  0.0  0.0      0     0 ?        S<   Oct21   0:00 [migration/1]
root         6  0.0  0.0      0     0 ?        SN   Oct21   0:00 [ksoftirqd/1]
root         7  0.0  0.0      0     0 ?        S<   Oct21   0:00 [watchdog/1]
root         8  0.0  0.0      0     0 ?        S<   Oct21   0:00 [events/0]
root         9  0.0  0.0      0     0 ?        S<   Oct21   0:00 [events/1]
root        10  0.0  0.0      0     0 ?        S<   Oct21   0:00 [khelper]
root        11  0.0  0.0      0     0 ?        S<   Oct21   0:00 [kthread]
root        15  0.0  0.0      0     0 ?        S<   Oct21   0:00 [kblockd/0]
root        16  0.0  0.0      0     0 ?        S<   Oct21   0:00 [kblockd/1]
root        17  0.0  0.0      0     0 ?        S<   Oct21   0:00 [kacpid]
root        91  0.0  0.0      0     0 ?        S<   Oct21   0:00 [cqueue/0]
root        92  0.0  0.0      0     0 ?        S<   Oct21   0:00 [cqueue/1]
root        95  0.0  0.0      0     0 ?        S<   Oct21   0:00 [khubd]
root        97  0.0  0.0      0     0 ?        S<   Oct21   0:00 [kseriod]
root       158  0.0  0.0      0     0 ?        S    Oct21   0:00 [pdflush]

As you can see, this output is similar to the earlier output, but the columns are different. Before I talk about these ps command arguments, let me show a few more examples. Here's how I look at all httpd processes running on my Linux system:

$ ps auxwww | grep http

root      2928  0.0  0.6  17648  7120 ?        Ss   Oct21   0:00 /usr/local/apache2/bin/httpd -k start
nobody    2949  0.0  0.6  17648  6492 ?        S    Oct21   0:00 /usr/local/apache2/bin/httpd -k start
nobody    2950  0.0  0.6  17648  6492 ?        S    Oct21   0:00 /usr/local/apache2/bin/httpd -k start
nobody    2951  0.0  0.6  17648  6492 ?        S    Oct21   0:00 /usr/local/apache2/bin/httpd -k start
nobody    2952  0.0  0.6  17648  6492 ?        S    Oct21   0:00 /usr/local/apache2/bin/httpd -k start
nobody    2953  0.0  0.6  17648  6492 ?        S    Oct21   0:00 /usr/local/apache2/bin/httpd -k start
root     18508  0.0  0.0   3916   688 pts/0    S+   11:12   0:00 grep http

Here's how I list all my mysql processes:

$ ps auxwww | grep mysql

root      2837  0.0  0.1   4528  1236 ?        S    Oct21   0:00 /bin/sh /usr/bin/mysqld_safe --datadir=/var/lib/mysql --socket=/var/lib/mysql/mysql.sock --log-error=/var/log/mysqld.log --pid-file=/var/run/mysqld/mysqld.pid
mysql     2897  0.0  1.7 136700 17952 ?        Sl   Oct21   0:00 /usr/libexec/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql --pid-file=/var/run/mysqld/mysqld.pid --skip-external-locking --socket=/var/lib/mysql/mysql.sock
root     18510  0.0  0.0   3916   712 pts/0    S+   11:13   0:00 grep mysql

Now that you've seen a few ps command examples, this is what the arguments to this ps command mean:

  • The a argument means "show all processes", not just my processes. (There's a bit more to it than that, but this is usually close enough.)
  • The u argument adds "user information" columns to the output. (Try your ps command without the 'u', and you'll see a major difference in the columns that are displayed.)
  • The x lifts the BSD-style "must have a tty" restriction, meaning it will show processes that are not associated with a terminal (tty)>
  • The w means "wide output". Use this option twice for unlimited width.

Examples from the Linux ps command man page

My intention for this article was to help get a new Unix or Linux user get started with the ps command. Before going, there are two more things I want to share with you.

First, there are many different variations of the ps command that you can use if you want to. For instance, I just looked at the Linux ps man page, and found these examples:

EXAMPLES
To see every process on the system using standard syntax:
   ps -e
   ps -ef
   ps -eF
   ps -ely

To see every process on the system using BSD syntax:
   ps ax
   ps axu

To print a process tree:
   ps -ejH
   ps axjf

To get info about threads:
   ps -eLf
   ps axms

To get security info:
   ps -eo euser,ruser,suser,fuser,f,comm,label
   ps axZ
   ps -eM

To see every process running as root (real & effective ID) in user format:
   ps -U root -u root u

To see every process with a user-defined format:
   ps -eo pid,tid,class,rtprio,ni,pri,psr,pcpu,stat,wchan:14,comm
   ps axo stat,euid,ruid,tty,tpgid,sess,pgrp,ppid,pid,pcpu,comm
   ps -eopid,tt,user,fname,tmout,f,wchan

Print only the process IDs of syslogd:
   ps -C syslogd -o pid=

Print only the name of PID 42:
   ps -p 42 -o comm=

As you can see, there are a lot of different ways to issue a ps command, and I try to show some of those in this other tutorial on how to sort Linux ps command output.

The second thing I want to mention is the Linux top command.

The Unix and Linux top command

Unix and Linux systems now include a nice interactive utility for looking at process information. The Linux top command displays a character-based screen of all processes running on the current system. The screen updates itself every few seconds, and you can sort the screen contents by characteristics like CPU Usage or Memory Use.

I show how to use the top command in this Unix/Linux top command tutorial, which includes several screenshots of the top command running on a Linux system.