10 ps command examples in Linux/Unix

Linux ps command

The ps command is a basic but important command because it is used to display information about processes running on the system. System administrators often rely on the ps command to monitor currently running processes. There are numerous options available to tweak the output of the ps command and we will be exploring many of them in this article.
The ps command obtains it’s information from the /proc virtual file system and displays it to the screen in a meaningful manner as per the options specified while executing the command.
It has two distinct modes of syntax: the UNIX style and the BSD style and we’ll cover both in this article.
To distinguish between using ps via either of the styles simply be mindful that when using the BSD style the options used with the ps command are not preceded with a dash.

With a basic understanding of what the ps command is and where it gets its information from, we now proceed to the examples to understand its usage.

Example 1:
When run without any options the ps command displays processes owned by the current shell.

[root@linuxnix ~]# ps
PID TTY TIME CMD
2585 pts/0 00:00:00 bash
9114 pts/0 00:00:00 ps

Given below is a brief description of the various fields reported in the output:

PID is the Process ID of the running command (CMD)
TTY is the place where the running command runs
TIME tells about how much time is used by the system CPU while running the command
CMD is the command being executed by the process

Example 2:
If we want ps to display information on all processes running on the system then we use the -e option.

[root@linuxnix ~]# ps -e | head
PID TTY TIME CMD
1 ? 00:00:01 init
2 ? 00:00:00 kthreadd
3 ? 00:00:00 migration/0
4 ? 00:00:00 ksoftirqd/0
5 ? 00:00:00 stopper/0
6 ? 00:00:00 watchdog/0
7 ? 00:00:20 events/0
8 ? 00:00:00 events/0
9 ? 00:00:00 events_long/0

Example 3:
To display extended information about processes we use the -l and -f options.
When used separately they display more verbose information but when used together they provide a more clearer picture.

[root@linuxnix ~]# ps -l
F S UID PID PPID C PRI NI ADDR SZ WCHAN TTY TIME CMD
4 S 0 2585 2577 0 80 0 - 27123 do_wai pts/0 00:00:00 bash
4 R 0 9243 2585 0 80 0 - 27037 - pts/0 00:00:00 ps
[root@linuxnix ~]#
[root@linuxnix ~]# ps -f
UID PID PPID C STIME TTY TIME CMD
root 2585 2577 0 12:46 pts/0 00:00:00 -bash
root 9244 2585 0 18:38 pts/0 00:00:00 ps -f
[root@linuxnix ~]# ps -fl
F S UID PID PPID C PRI NI ADDR SZ WCHAN STIME TTY TIME CMD
4 S root 2585 2577 0 80 0 - 27123 do_wai 12:46 pts/0 00:00:00 -bash
4 R root 9247 2585 0 80 0 - 27563 - 18:39 pts/0 00:00:00 ps -fl

To view detailed information on the different fields being reported please refer to the man page for the ps command.

Example 4:
We could use the -U option with the ps command to view processes owned by a particular user.

[root@linuxnix ~]# ps -fU apache
UID PID PPID C STIME TTY TIME CMD
apache 1901 1895 0 17:51 ? 00:00:00 /usr/sbin/httpd
apache 1902 1895 0 17:51 ? 00:00:00 /usr/sbin/httpd
apache 1903 1895 0 17:51 ? 00:00:00 /usr/sbin/httpd
apache 1904 1895 0 17:51 ? 00:00:00 /usr/sbin/httpd
apache 1905 1895 0 17:51 ? 00:00:00 /usr/sbin/httpd
apache 1906 1895 0 17:51 ? 00:00:00 /usr/sbin/httpd
apache 1907 1895 0 17:51 ? 00:00:00 /usr/sbin/httpd
apache 1908 1895 0 17:51 ? 00:00:00 /usr/sbin/httpd
apache 1909 1895 0 17:51 ? 00:00:00 /usr/sbin/httpd

The above command displays all processes owned by the apache user.
Note that with the -U option we would specify the real user id.
If you wish to use the effective user id then you would need to use the -u option followed by the username.

Example 5:
To display details about a single process we can use the -p option followed by the process id.
For example, with the below command I display information about the specified PID 1776 only.

[root@linuxnix ~]# ps -fp 1776
UID PID PPID C STIME TTY TIME CMD
root 1776 1 0 17:51 ? 00:00:00 /usr/sbin/sshd

Example 6:
We can display processes attached to a particular terminal (tty) using the -t option.

[root@linuxnix ~]# ps -ft pts/1
UID PID PPID C STIME TTY TIME CMD
root 6174 6166 0 20:59 pts/1 00:00:00 -bash
root 6206 6174 0 20:59 pts/1 00:00:00 bash
root 6217 6206 0 20:59 pts/1 00:00:00 bash
root 6228 6217 0 21:00 pts/1 00:00:00 bash
root 6277 6228 0 21:00 pts/1 00:00:00 sleep 1000

Note that you need to omit the /dev/ when you specify the terminal.
You may obtain the current terminal name with the tty command.

[root@linuxnix ~]# tty
/dev/pts/0

Example 7:
Similar to the pstree command, we can actually the ps command to print a process tree with the –forest option as shown below:

[root@linuxnix ~]# ps -ef --forest | grep bash
root 2651 2632 0 17:56 pts/0 00:00:00 | \_ -bash
root 2754 2651 0 18:00 pts/0 00:00:00 | \_ bash
root 2779 2754 0 18:00 pts/0 00:00:00 | \_ bash
root 6390 2779 0 21:05 pts/0 00:00:00 | \_ grep bash
root 6174 6166 0 20:59 pts/1 00:00:00 | \_ -bash
root 6206 6174 0 20:59 pts/1 00:00:00 | \_ bash
root 6217 6206 0 20:59 pts/1 00:00:00 | \_ bash
root 6228 6217 0 21:00 pts/1 00:00:00 | \_ bash
root 2609 2231 0 17:56 tty1 00:00:00 \_ -bash

You may observe from the above output that there are several bash processes originating from the bash shell process with PID 2651.

Example 8: We can use the ps command with the -o option to report on specifically mentioned fields.

In the below example we use the ps command along with the -e and -o options followed by the fields for which we would like to retrieve information for.

[root@linuxnix ~]# ps -eo pid,ppid,ni,pri,pcpu,pmem,stat,comm | head
PID PPID NI PRI %CPU %MEM STAT COMMAND
1 0 0 19 0.2 0.1 Ss init
2 0 0 19 0.0 0.0 S kthreadd
3 2 - 139 0.0 0.0 S migration/0
4 2 0 19 0.0 0.0 S ksoftirqd/0
5 2 - 139 0.0 0.0 S stopper/0
6 2 - 139 0.0 0.0 S watchdog/0
7 2 0 19 0.2 0.0 S events/0
8 2 0 19 0.0 0.0 S events/0
9 2 0 19 0.0 0.0 S events_long/0

Example 9: We can sort the ps output with reference to a particular field we use with the -o option.

In the below example we’ve sorted the output by CPU usage.

[root@linuxnix ~]# ps -eo pid,ppid,ni,pri,pcpu,pmem,stat,comm --sort=-pcpu | head
PID PPID NI PRI %CPU %MEM STAT COMMAND
1982 1967 0 19 0.4 3.3 Sl salt-master
7 2 0 19 0.1 0.0 S events/0
1990 1987 0 19 0.1 3.5 Sl salt-master
1993 1987 0 19 0.1 3.5 Sl salt-master
1994 1987 0 19 0.1 3.5 Sl salt-master
1997 1987 0 19 0.1 3.5 Sl salt-master
2004 1987 0 19 0.1 3.5 Sl salt-master
1 0 0 19 0.0 0.1 Ss init
2 0 0 19 0.0 0.0 S kthreadd

Example 10: The examples we’ve seen thus far cover the UNIX version of the ps command.
For the final example in this article, we’ll use the BSD version.

The BSD version presents more or less the same information as the UNIX version but with slightly different command line options.

root@linuxnix ~]# ps aux | head
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.1 19348 1556 ? Ss 13:57 0:01 /sbin/init
root 2 0.0 0.0 0 0 ? S 13:57 0:00 [kthreadd]
root 3 0.0 0.0 0 0 ? S 13:57 0:00 [migration/0]
root 4 0.0 0.0 0 0 ? S 13:57 0:00 [ksoftirqd/0]
root 5 0.0 0.0 0 0 ? S 13:57 0:00 [stopper/0]
root 6 0.0 0.0 0 0 ? S 13:57 0:00 [watchdog/0]
root 7 0.1 0.0 0 0 ? S 13:57 0:03 [events/0]
root 8 0.0 0.0 0 0 ? S 13:57 0:00 [events/0]
root 9 0.0 0.0 0 0 ? S 13:57 0:00 [events_long/0]

Conclusion:

In this article, we explained how we could use the ps command along with its different options to monitor processes in a variety of different ways.
We encourage you to go through the man page for the ps command to learn more about the other available options which we have not covered in this article.