Linux Command - 'ps'
Categories:
Mastering the 'ps' Command: Process Management in Linux

Learn how to use the 'ps' command to view, filter, and understand running processes on your Linux system, a fundamental skill for system administration and troubleshooting.
The ps (process status) command is a cornerstone utility for any Linux user or administrator. It provides a snapshot of the currently running processes, offering crucial insights into what your system is doing at any given moment. Understanding how to effectively use ps is vital for monitoring system health, troubleshooting performance issues, identifying rogue processes, and managing resources.
Basic Usage and Common Options
At its simplest, ps without any arguments will show processes owned by the current user in the current terminal. However, its true power comes from its various options, which allow you to display a wide range of process information.
ps
ps aux
ps -ef
Basic ps commands to view processes.
aux and -ef options are two of the most commonly used combinations. aux (BSD style) shows all processes, including those of other users, and processes not attached to a terminal. -ef (System V style) provides a full listing in a user-friendly format, showing process IDs, parent process IDs, CPU usage, and more.Understanding ps aux Output
The ps aux command is particularly useful for getting a comprehensive overview. Let's break down its typical output columns:
flowchart LR
A[USER] --> B[PID]
B --> C[%CPU]
C --> D[%MEM]
D --> E[VSZ]
E --> F[RSS]
F --> G[TTY]
G --> H[STAT]
H --> I[START]
I --> J[TIME]
J --> K[COMMAND]
subgraph Key Columns
B --"Process ID"--> PID_Desc(Unique identifier for the process)
C --"CPU Usage"--> CPU_Desc(Percentage of CPU time used)
D --"Memory Usage"--> MEM_Desc(Percentage of physical memory used)
K --"Command"--> CMD_Desc(The command that started the process)
endKey columns in ps aux output.
Here's a brief explanation of some critical columns:
- USER: The effective username of the process owner.
- PID: Process ID. A unique number assigned to each running process.
- %CPU: The CPU utilization of the process.
- %MEM: The percentage of physical memory used by the process.
- VSZ: Virtual memory size in kilobytes.
- RSS: Resident Set Size, the non-swapped physical memory a process has used.
- TTY: The controlling terminal of the process.
- STAT: The current state of the process (e.g., R for running, S for sleeping, Z for zombie).
- START: The time the command started.
- TIME: The cumulative CPU time the process has used.
- COMMAND: The command that launched the process, including its arguments.
Filtering and Customizing Output
The real power of ps comes from combining it with other Linux utilities like grep for filtering, and using its own formatting options. This allows you to pinpoint specific processes or display only the information you need.
ps aux | grep firefox
ps -eo pid,user,cmd,%cpu,%mem --sort=-%cpu | head -n 10
ps -p 12345 -o pid,cmd,etime
Examples of filtering and customizing ps output.
Let's break down these examples:
ps aux | grep firefox: This pipes the full process list togrepto find all lines containing "firefox". This is excellent for finding specific applications.ps -eo pid,user,cmd,%cpu,%mem --sort=-%cpu | head -n 10: This command uses the-ooption to specify custom output columns (PID, user, command, CPU usage, memory usage).--sort=-%cpusorts the output by CPU usage in descending order (the-sign).head -n 10then shows only the top 10 processes by CPU.ps -p 12345 -o pid,cmd,etime: This command displays information for a specific process ID (PID 12345), showing its PID, command, and elapsed time (etime) since it started.
grep with ps, you might see the grep command itself in the output. To avoid this, you can use grep -v grep to exclude the grep process, or a more elegant trick like grep '[f]irefox' which matches 'firefox' but not the grep command itself.