ps

Updated

September 4, 2026

Overview

ps snapshots processes. Linux ps accepts both BSD-style (ps aux) and UNIX-style (ps -ef) option sets — mixing styles works but confuses readers; pick one family per invocation. For a live view use top/htop; for PID selection by name prefer pgrep.

Syntax

ps [options]

Common Invocations

Form Description
ps aux BSD: all users, CPU/MEM columns
ps -ef UNIX: full listing
ps -u USER One user’s processes
ps -p PID Specific PID(s)
ps -C name By command name
ps --forest / f Tree view
ps -eo … Custom columns

Useful selectors: -o pid,ppid,user,pcpu,pmem,stat,etime,cmd, --sort=-%mem.

Key Use Cases

  1. Identify heavy CPU/memory consumers
  2. Find PIDs before signaling
  3. Inspect command lines and parentage
  4. Script process inventory / monitoring checks

Examples with Explanations

Classic full lists

ps aux | head
ps -ef | head

aux is the muscle-memory form on Linux; -ef is common in SysV docs.

Top memory and CPU

ps aux --sort=-%mem | head -n 15
ps aux --sort=-%cpu | head -n 15

Snapshot only — a process can spike between samples.

Custom columns

ps -eo pid,ppid,user,%cpu,%mem,stat,etime,cmd --sort=-%cpu | head

etime is elapsed runtime; handy for spotting stuck long jobs.

By user / name

ps -u www-data -o pid,cmd
ps -C nginx -o pid,cmd
pgrep -a nginx          # often clearer for name → PID

Tree view

ps auxf | less
ps -ejH | less
pstree -ap | less

Shows parent/child relationships (workers under a master, shells under sshd).

One PID in detail

ps -p 1 -o pid,user,cmd,lstart,etime
tr '\0' ' ' < /proc/1/cmdline; echo

/proc/PID is the source of truth when ps columns are not enough.

Threads

ps -eLf | head
ps -p "$(pgrep -n nginx)" -L -o pid,tid,pcpu,cmd

-L / lwp shows threads; high thread counts can matter for ulimits.

Full command line (no truncation)

ps -eo pid,args | less
ps auxww | less          # wide; ww avoids early wrap on BSD style

Default width may truncate CMD; widen the terminal or use args/ww.

Zombies and D-state

ps aux | awk '$8 ~ /Z/ {print}'     # zombies (STAT has Z)
ps aux | awk '$8 ~ /D/ {print}'     # uninterruptible sleep (often I/O)

Zombies need parent reaping; D state often means storage/NFS pain.

Script: fail if process missing

ps -C mydaemon >/dev/null || { echo "mydaemon not running" >&2; exit 1; }
pgrep -x mydaemon >/dev/null

Understanding Output

  • STAT: R running, S interruptible sleep, D uninterruptible, Z zombie, T stopped; extras like + (foreground), l (multi-threaded), < (high priority).
  • %CPU: not identical to top’s averaged view.
  • VSZ vs RSS: virtual size vs resident RAM.
  • USER: effective user; real UID can differ for setuid binaries.

Notes & Pitfalls

  • ps is a point in time; loops need watch or a real monitor.
  • Prefer pgrep/pkill over ps \| grep (avoids matching the grep itself).
  • Kernel threads appear as [kthreadd]-style names.
  • Container views may only show processes in the same PID namespace.

Additional Resources

  • man ps
  • man proc