The ps command is a handy utility that allows us to view important process information. A process is simply a running instance of a program. Whenever we invoke a program, some processes are created. A thorough understanding of the process tree is mandatory if you want to have full control over your machine. This is where ps comes in. It is one of the most useful terminal commands in Linux yet offers tons of crucial information. SysAdmins can use them to find faulty programs or pinpoint resource usage. This guide will provide readers a practical introduction to the ps command in Linux.
Practical Linux PS Commands for Everyday Use
The ps command is a simple way of displaying all the active processes. However, the ps command only prints a snapshot of the selection of processes. If you want to have real-time updates on your selections, you should use the Linux top command or one of its successors. Check out the below examples to see what you can do with the Linux ps command.
1. Print Current Processes
By default, ps only display a few pieces of information. When you run the ps command without any arguments, it will print the processes that are associated with the current Linux shell. It finds the processes whose effective user ID (euid=EUID) is equal to that of the current user and is associated with the invoking terminal session.
$ ps
The output list will contain the process IDs (PID) of the processes, the terminal name associated with the processes, their cumulated CPU time, and the executable name.
2. Print All Active Processes
The above command only prints the current process list. If you want to display all the active processes, use one of the following commands instead.
$ ps -A $ ps -e
Actually, both of these ps commands are identical. The output should contain a large number of processes. These are the child processes invoked by high-level parent processes.
3. Print Processes in BSD Format
The Linux ps command can also display process statuses in a BSD format. This is suitable for admins who manage both Linux and BSD systems as parts of their job. The following examples display the processes using this format.
$ ps aux $ ps ax
Note that users must refrain from grouping the BSD options using dashes. The meaning of the following command is different from the one above.
$ ps -aux
4. Print Processes Using the Full Format
You can extend the output format of your ps commands and retrieve more detailed information. However, to do this, you need to use the -f or -F option. The following command displays all current processes using this full format.
$ ps -ef
Here, we are grouping the -e option with -f. This will provide some additional information like the parent process id(PPID) number and CPU utilization indicators. The -F option extends this format with slightly more data.
$ ps -eF
5. Print All Processes for Current User
The -x flag of ps allows us to display all the processes that belong to the current user. This is a simple way of determining the processes associated with your current user.
$ ps -x
This command produces a list of all active processes for the current user. It displays useful metrics like stat and time alongside PIDs and command names. A TTY value of “?” denotes that there is currently no terminal session associated with that particular process.
6. Print All Processes for Specific Users
We can also print the process list for a particular user using the -u or -U option. The following examples illustrate how they work. Simply replace the username with an existing user on your system.
$ ps -U ubuntupit $ ps --User ubuntupit
Both of these commands are identical, and they simply print the process for the user ubuntupit. The -U or –User option selects the processes by real user ID (RUID) or name.
$ ps -u ubuntupit $ ps --user ubuntupit
The above Linux ps commands are also identical, but contrary to the earlier examples, they select the processes by the effective user ID (EUID) or name.
7. Print All Processes for Root
You can use the ps command in Linux to find out which processes are owned by root and running with the root user’s privileges. Use the following command to find these processes using the real user ID (RUID).
$ ps -U root $ ps --User root
Use the -u or –user option to find them by their effective user ID (EUID), as demonstrated in the below examples.
$ ps -u root $ ps --user root
Admins can also combine both of these options in a single command. The following example prints all the processes owned by root using both their RUID and EUID.
$ ps -u root -U root
8. Print All Processes for Specific Group
The -G or -g flag of the ps command allows us to print the processes that are part of a group. For example, you can use them to pinpoint all the processes opened by anyone from a group of users. Groups in Linux refer to a set of users that have the same privileges for the particular Linux filesystem or resources.
$ ps -fG techsupport $ ps -fG 100
These commands print the processes owned by the group tech support. The -G option uses the real group ID (RGID) or name and has a long-form called –Group. The -g option selects the processes based on the effective group ID (EGID) or name.
$ ps -fg techsupport $ ps -fg 100
The long-form for -g is –group.
9. Print Processes Based on PID
As we have already discussed, the PID or process id is a unique identifier for each and every process on our systems. We can use this PID information for locating a specific process. The below command illustrates this using a simple example.
$ ps -p 2829 $ ps --pid 2829
This command will select the process whose PID is equal to 2829. You can also specify multiple PIDs using a comma-separated list or by using brace expansion.
$ ps -p 2890,2891,2892,2893,2894,2895
This example looks for six specific PIDs. On the other hand, the following Linux ps command looks for a range of process ids.
$ ps -p 29{1..99}
10. Print Processes Based on PPID
If you want to display the processes based on their PPID, you should use the following command. The –ppid flag of the ps utility selects processes by PPID.
$ ps --ppid 1111,1122,1133
You can specify more than one PPIDs by using either brace expansions or a comma-separated list of processes.
$ ps --ppid 2890,2891,2892,2893,2894,2895
$ ps --pid 29{1..99}
11. Print Processes Using Quick Mode
The Linux ps command supports a quick mode for selecting processes by their PIDs. In this mode, ps only reads the essential data and doesn’t use any extra filtering rules. Moreover, the PIDs printed are not sorted or preserved.
$ ps -q 2480,2532,2533 $ ps --quick-pid 2480,2532,2533
Quick mode supports multiple PIDs as well as range expansions. This is a faster operation and is suitable for locating processes within milliseconds.
12. Print Processes Based on TTY
A TTY or TeleTYpewriter denotes a terminal session that is connected to the standard input. You can select processes based on TTY by using the -t flag of ps.
$ ps -t /dev/pts/0 $ ps --tty /dev/pts/0
As you can see, ps also supports a long-form for this option. In the above command, /dev/pts/0 is terminal for my current session. You need to replace this with the tty associated with your personal session. A simpler method is to interpolate the terminal name directly from your shell, as shown below.
$ ps -t $(tty)
This will replace the tty field for your terminal. You can also group multiple tty using the range expansion methods shown earlier.
13. Print Processes for Specific Commands
As you should already notice, processes are spawned as part of a command. Whenever you run one of your favorite Linux terminal commands, it invokes several processes to do its bidding. The -C option of the ps command allows us to select processes based on the name of executables they are a part of.
$ ps -C chrome
Like most flags, the -C option also allows admins to select processes multiple commands. The following examples show a simple list example.
$ ps -C chrome,apache,gedit
However, users must not use whitespaces between the list, or else ps will fail to parse the input.
14. Print the Process Tree
The process tree shows a visual connection between the running processes on your system. This makes it very easy to visualize process relationships and interconnections. The following example shows us how to do it.
$ ps -eH
The -e option selects all processes, and -H displays the process hierarchy. You may also use the -f or –forest options. An ASCII art process hierarchy is printed for the f option and a tree for –forest.
$ ps -e f
Note the space between -e and f. Also, there is no hyphen preceding the f flag.
$ ps -e --forest
15. Print Process Tree for Specific Commands
We can easily display the connection between a Linux command and the processes associated with it by combining the -C option with one of either one of -H, f, or –forest. The below commands shows some simple examples of this for our readers.
$ ps -H -C chrome $ ps f -C chrome
Since -C is used for process selection and -H/f for modifying the output format, these two options can not be combined.
$ ps --forest -C chrome
16. Print the Threads for a Process
The -L option of the Linux ps command allows us to display the threads associated with processes. The following example prints the threads for the process chrome.
$ ps -L -C chrome
This will provide the LWP (lightweight process) for the selected process, in this case, chrome. Use the -f option for getting more data.
$ ps -fL -C chrome
This command will display the NLWP (number of lightweight processes) alongside the LWP. You can select multiple processes by using their PID or command name.
17. Print the List of All Format Specifiers
The ps command supports a wide range of format specifiers other than PID, TTY, and CMD. You can print the entire list of all supported specifiers by using the L option.
$ ps L
Note that this option is similar to the option used for printing threads. The presence or absence of the dash symbol allows ps to parse which output you are looking for.
18. Print Specific Output Columns
The above command displays the output options available to us for ps. Now, we can select only specific information for a process by defining the output format ourselves. For example, the following commands will display the PPID, STATE, and CMD for the process chrome.
$ ps -o ppid,state,cmd -C chrome $ ps --format ppid,state,cmd -C chrome
So, the -o or –format option allows us to select specific columns for our output. The below example prints out only the PPID information for all processes.
$ ps -eo ppid
19. Print Specific Output Columns for Selected Processes
The following example will display the PPID, state, cmd, tty, and EUID information for a specific process. We are using the PID information to locate our target process in this command.
$ ps -p 2434 -o ppid,state,cmd,tty,euid
The next example will find the same information but for a set of processes.
$ ps -p 2424,2434,2444,2454,2464 -o ppid,state,cmd,tty,euid
Remember to not put any spaces between either the PID list or in the output specification list. If you want to use whitespaces, remove the commas and place them inside double-quotes.
$ ps -p "2424 2434 2444 2454 2464" -o "ppid state cmd tty euid"
20. Print Only Process Names
Let’s say you want to know the name of a process for a specific process id and don’t want any additional information. One way of doing this is to print the process status using the PID and cut the required column using either Linux cut commands or awk. However, there is a much simpler solution to this problem.
$ ps -q 2434 -o comm=
This command will only show the process name for the PID 2434. It utilizes the quick mode for selecting that PID. You can also use -p or –pid if you want.
21. Print All PIDs for a Process
If you are writing Linux shell scripts or performing system audits, you may need to find out all pids associated with a certain process. Luckily, this is very easy to do using the Linux ps command. The following command will display all PIDs for the process chrome.
$ ps -C chrome -o pid=
This command simply combines the -C option of ps with the output specifier -o. As you should see, the output contains just PID values, no additional data. Thus, it is suitable for use with shell scripts.
22. Print the Execution Time for a Process
The execution time of a process indicates how much time the CPU spends behind the task. It is a great way of finding faulty processes that are utilizing too much CPU time. The following command shows you how to find this execution time for a given process in Linux.
$ ps -eo etime,user,comm | grep chrome
This example utilizes the Linux grep command to filter out the specific process from the entire process list. You can also specify the process name using the -C option of ps.
$ ps -o etime,user,comm -C chrome
Since we are selecting the process by name, we do not need to provide the -e option.
23. Print CPU and Memory Usage Statistics
We can use the ps command to view the CPU and memory usage of our processes. This is very useful when determining faulty processes or troubleshooting resource usage. The following examples illustrate how to do this.
$ ps -eo pid,ppid,cmd,%mem,%cpu $ ps -eo "pid ppid cmd %mem %cpu"
These commands will display two additional columns for CPU and memory usage for the process list. If you want to see the resource usage for a particular process, use the -C option and omit -e.
$ ps -o pid,ppid,cmd,%mem,%cpu -C chrome
24. Print CPU and Memory Usage After Sorting
The above commands aren’t very neat on their own since the output contains a lot of processes. Plus, many of those do not affect the CPU resources heavily. Luckily, we can sort the output data to find out the processes using the highest resources.
$ ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%mem | head
This command sorts the output of ps and feeds the data to the head command. It produces the top processes responsible for the most CPU usage. If you want to find out processes causing your system to hang, this is the command to use.
25. Print Elapsed Time for Processes
The elapsed time for a Linux process indicates the time since it was started by your system. The ps utility can display this time using the [[dd-]hh:]mm:ss format. Check out the following example to see how this works.
$ ps -C chrome -o pid,etime=
This command will show the PIDs for the chrome process and the elapsed time information. We can also specify the process using its PID or PPID, as demonstrated below.
$ ps --ppid 1736 -o pid,etime=
26. Kill Hanged Processes with Linux PS Command
If you face CPU hanging issues, you may want to kill the processes that are using too much CPU resources. Check out our earlier guide on how to kill or terminate a Linux process to mitigate this problem. However, the below one-liner shell command is a handy way of doing this task.
$ ps aux | grep -e 'nano' | awk '{print $2}' | xargs kill -9
This command uses several useful Linux terminal commands to find out the frozen process and kill it. Check out our guide on the Linux awk command to learn how we filtered the data.
27. Monitor Process Usage in Real-Time
The Linux ps command provides only a static snapshot of the processes. The top utility is used for monitoring processes and resource usage in real-time. However, we can combine ps with the watch command to monitor processes in real-time.
$ watch -n 1 'ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%mem | head'
This command will provide a live view of process statuses and their resource consumption in every one second. The head command is used for reducing the number of output lines.
28. Locate Memory Leaks
Memory leaks are a common problem with many applications that use the client-server model. Technically, it means that the memory allocated to an app is not being freed when the app is closed. The following commands can help admins identify memory leaks.
$ ps -ef -o pid,pmem --sort pmem | tail -5 $ ps -ef -o pid,pmem --sort %mem | tail -5
Note that pmem is a synonym for %mem in Linux ps command. Now take note of the PID that is consuming the most memory and find detailed information on that process using the following command.
$ ps ev --pid=1776
Run this command multiple times or use the watch utility to monitor if the value of the RSS field increases. If it does, it is a sign of memory leak.
$ watch -n 1 'ps ev --pid=1776'
29. Print Child Processes for Specific Process
Multi-tasking operating systems like Linux allows processes to create their own child processes. This is usually done by one of two procedures, the system calls fork() or spawn(). Anyway, you can print the list of child processes created by a certain process using the Linux ps command.
$ ps -o pid,uname,comm -C chrome $ ps -o pid,uname,comm -C chrome --forest
These will display the child processes for the process chrome. Adding the –forest option helps to visualize the relationship between the processes.
30. Rename Column Labels
The default naming scheme of the output columns for ps is quite short and may confuse some users. However, it is very easy to rename these labels and set up custom names for them. The below command illustrates this using a simple example.
$ ps -e -o pid=PID,uname=USER,cpu=CPU,%mem=MEM%,comm=COMMAND
This makes it very easy to identify the respected columns and avoid confusion.
31. Print Security Information for Linux PS Command
Users can print out security context information for their processes using the –context, -N, or Z flags. Check out the following commands to see how they work.
$ ps -C chrome --context $ ps -C chrome Z $ ps -C chrome -M
These commands will display the SELinux context for the process chrome. However, SELinux should be enabled in your system for these Linux ps commands to work.
32. Print Every User Information
Users can retrieve every type of user information for a given process by selecting only the user modifiers for output. Check out the following command to understand how this works.
$ ps -C chrome -o pid,euser,ruser,suser,fuser $ ps -C chrome -o "pid euser ruser suser fuser"
Both of these commands are identical, and they will simply output all the user information available to ps for the chrome process. You can remove the -C option and add -e to get this data for all active processes on your system.
33. Print Signal Format for Processes
Signals are a fundamental way of inter-process communication or IPC. They are used for indicating when a process needs to be paused or when to free resources, and so on. The ps utility allows users to display the signal format for each process. Check out the following example to see how this works in practice.
$ ps s -C chrome
This will display a list of chrome processes alongside various signal information under the pending, blocked, ignored, and caught sections. This can become useful if you are debugging low-level system calls.
34. Print User-Oriented Format for Processes
The user-oriented format makes it easy to visualize process data for users. It is quite similar to the BSD style output format. Simply run the below command in your favorite Linux terminal emulator to see how the output looks like.
$ ps u -C chrome
Similar to the BSD format, the u option does not need any preceding dash symbol. The output is very concise and yet contains detailed information, including PID, CPU usage, Memory usage, status, elapsed time, and so on.
35. Print All but Some Processes
The Linux ps command offers a handy way of negating or complimenting process lists called deselect. This allows users to print all processes except those that fulfill certain requirements. Check out the below commands to see how this works.
$ ps -C chrome --deselect $ ps -C chrome -N
Both the -N and –deselect options are identical and thus produce the same output. The output of these commands will have a list of all processes except for chrome. They also work with every other option. For example, the following command will print all PIDs except those mentioned.
$ ps -p{1..100} --deselect
The output will contain a list of all the PIDs except from 1 to 100.
36. Print Processes Using the BSD Long Format
Using the long format for outputs allow users to retrieve more information using a single ps command. Simply use the -l option for setting the output mode to BSD long format.
$ ps -el
You can also use an additional option -y with this option. It will turn off the ADDR flag and use RSS instead.
$ ps -ely
The output of this command contains information like the PID, PPID, UID, CPU usage, process priority, memory usage, size, and so on.
37. Print Debugging Information
The following command will show the debugging information available to users for the ps command. This can become handy when you are debugging programs and processes.
$ ps --info
The output of this command contains a lot of useful information such as compilation flags, libraries, compiler, header data, version, and so on.
38. Display Version Information
The ps utility is one of the oldest process monitoring tools for Linux and BSD. It has evolved largely over time and has a number of major implementations. Since things often differ between version to version, you need to use some of the commands based on the exact version installed on your system.
$ ps --version $ ps -V $ ps V
All of the above commands are identical, and they simply display the version information for procps-ng. This is the process monitoring suite that contains the ps command.
39. Display Help Information
The help page contains a summarized list of useful information for Linux commands. The syntax for this in ps is the following.
$ pf --help section
Here, the section keyword refers to one of simple, list, output, threads, misc, and all. Moreover, they can be substituted with the initial letters like s, l, o, t, m, and a.
$ ps --help simple $ ps --help threads $ ps --help all
40. Display The Manual Page
The manual or man page of Linux commands contain detailed information on all the available options and their usage. This is the perfect place to start learning ps.
$ man ps
You can easily scroll through this documentation using the PageUP and PageDown keys of your keyboard. Press q to go back to your shell.
Ending Thoughts
The Linux ps command is a simple but versatile tool for admins. It allows users easily to find process information and perform tasks like monitoring, troubleshooting, and auditing. If you want to grab a high paying computer science job that leverage Linux, you should be more than adept at using ps. That is why our editors have curated this guide with lots of practical examples.
If you’re a complete beginner, then bookmark this guide for future references. Hopefully, we have provided you with the essential information you were looking for. Leave us a comment below if you have any further queries or tips.
