Linux Command - 'ps'
Categories:
Mastering the 'ps' Command: Process Management in Linux

Learn how to use the 'ps' command to view, filter, and understand running processes on your Linux system, a fundamental skill for system administration and troubleshooting.
The ps
(process status) command is a cornerstone utility for any Linux user or administrator. It provides a snapshot of the currently running processes, offering crucial insights into what your system is doing at any given moment. Understanding how to effectively use ps
is vital for monitoring system health, troubleshooting performance issues, identifying rogue processes, and managing resources.
Basic Usage and Common Options
At its simplest, ps
without any arguments will show processes owned by the current user in the current terminal. However, its true power comes from its various options, which allow you to display a wide range of process information.
ps
ps aux
ps -ef
Basic ps
commands to view processes.
aux
and -ef
options are two of the most commonly used combinations. aux
(BSD style) shows all processes, including those of other users, and processes not attached to a terminal. -ef
(System V style) provides a full listing in a user-friendly format, showing process IDs, parent process IDs, CPU usage, and more.Understanding ps aux
Output
The ps aux
command is particularly useful for getting a comprehensive overview. Let's break down its typical output columns:
flowchart LR A[USER] --> B[PID] B --> C[%CPU] C --> D[%MEM] D --> E[VSZ] E --> F[RSS] F --> G[TTY] G --> H[STAT] H --> I[START] I --> J[TIME] J --> K[COMMAND] subgraph Key Columns B --"Process ID"--> PID_Desc(Unique identifier for the process) C --"CPU Usage"--> CPU_Desc(Percentage of CPU time used) D --"Memory Usage"--> MEM_Desc(Percentage of physical memory used) K --"Command"--> CMD_Desc(The command that started the process) end
Key columns in ps aux
output.
Here's a brief explanation of some critical columns:
- USER: The effective username of the process owner.
- PID: Process ID. A unique number assigned to each running process.
- %CPU: The CPU utilization of the process.
- %MEM: The percentage of physical memory used by the process.
- VSZ: Virtual memory size in kilobytes.
- RSS: Resident Set Size, the non-swapped physical memory a process has used.
- TTY: The controlling terminal of the process.
- STAT: The current state of the process (e.g., R for running, S for sleeping, Z for zombie).
- START: The time the command started.
- TIME: The cumulative CPU time the process has used.
- COMMAND: The command that launched the process, including its arguments.
Filtering and Customizing Output
The real power of ps
comes from combining it with other Linux utilities like grep
for filtering, and using its own formatting options. This allows you to pinpoint specific processes or display only the information you need.
ps aux | grep firefox
ps -eo pid,user,cmd,%cpu,%mem --sort=-%cpu | head -n 10
ps -p 12345 -o pid,cmd,etime
Examples of filtering and customizing ps
output.
Let's break down these examples:
ps aux | grep firefox
: This pipes the full process list togrep
to find all lines containing "firefox". This is excellent for finding specific applications.ps -eo pid,user,cmd,%cpu,%mem --sort=-%cpu | head -n 10
: This command uses the-o
option to specify custom output columns (PID, user, command, CPU usage, memory usage).--sort=-%cpu
sorts the output by CPU usage in descending order (the-
sign).head -n 10
then shows only the top 10 processes by CPU.ps -p 12345 -o pid,cmd,etime
: This command displays information for a specific process ID (PID 12345), showing its PID, command, and elapsed time (etime
) since it started.
grep
with ps
, you might see the grep
command itself in the output. To avoid this, you can use grep -v grep
to exclude the grep
process, or a more elegant trick like grep '[f]irefox'
which matches 'firefox' but not the grep
command itself.