Low Orbit Flux Logo 2 F

Linux Command - ps

The Linux ps command will show a snapshot of the current running processes on a system.

The ps command has a lot of options. Many of these options are not important and we would be duplicating a lot of obscure documentation if we coverd them here. We are only covering the more useful options here. I am keeping some duplicate options if they are important to know. I’ve excluded some BSD sort keys and some extra format options ( ex: AIX ). If you want a full listing check the man page. This is mostly based off of the ps from the procps-ng package.

ps       # all procs with same ID and TTYs
ps -ef   # all procs, full listing
ps aux   # similar but BSD options and more useful cols

ps -eo pid,user,args --sort user                   # show all procs, select 3 cols, sort by user
ps -e  -o user:50,pid,command:100,flags            # adjust width of user column to 50, command column to 100

Using -o will override -f and since that is since that was grouped with -e they are both overridden:

ps -ef  -o user:50,pid,command                  #

Lots of info, sorted by cpu and mem:

ps -e -o pid,ppid,euser,pri,ni,stat,wchan,thcount,%mem,vsz,rss,lstart,etime,time,args --sort %cpu
ps -e -o pid,ppid,euser,pri,ni,stat,wchan,thcount,%mem,vsz,rss,lstart,etime,time,args --sort %rss

Option types can be mixed, may have duplicate functionality:


a all procs with tty
-A Select all processes. Identical to -e.
-e Select all processes. Identical to -A.
T Select all processes associated with this terminal. Identical to the t option without any argument.
r Restrict the selection to only running processes.
x include procs with tty ( Remove restriciton of procs with tty )


   These options accept a single argument in the form of a blank-separated or comma-separated list.  They can be used multiple times.  For example: ps -p "1 2" -p 3,4
-C cmdlist Select by command name. executable name not commmand line
123 Select by PID ( space separated )
-p pidlist Select by PID ( space or comma separated )
–pid pidlist Select by PID.
–ppid pidlist Select by parent PID.
-U userlist Select by real user ID (RUID) or name.
-u userlist Select by effective user ID (EUID) or name.


-f Do full-format listing. Print command arguments. Show NLWP (number of threads) and LWP (thread ID) when combined with -L
-F Extra full format. Implies -f
-M Add a column of security data. Identical to Z (for SELinux).
Z Add a column of security data. Identical to -M (for SELinux).
u Display user-oriented format.
v Display virtual memory format.
-o format STANDARD FORMAT SPECIFIERS in comma or space separated list, ex: pid,user pid=Proc,comm=Command pid=x,comm=y user:50,pid,command


e Show the environment after the command.
f ASCII art process hierarchy (forest).
–forest ASCII art process tree.
-H Show process hierarchy (forest).
n Numeric output for WCHAN and USER (including all types of UID and GID).
–sort spec STANDARD FORMAT SPECIFIERS, + for increasing order - ofr decreasing ex: –sort=uid,-ppid,+pid


H Show threads as if they were processes.
-L Show threads, possibly with LWP and NLWP columns.
m Show threads after processes.
-m Show threads after processes.
-T Show threads, possibly with SPID column.

Some notes from the man page:


The sum of these values is displayed in the “F” column, which is provided by the flags output specifier:

1 forked but didn’t exec
4 used super-user privileges


Here are the different values that the s, stat and state output specifiers (header “STAT” or “S”) will display to describe the state of a process:

D uninterruptible sleep (usually IO)
I Idle kernel thread
R running or runnable (on run queue)
S interruptible sleep (waiting for an event to complete)
T stopped by job control signal
t stopped by debugger during the tracing
W paging (not valid since the 2.6.xx kernel)
X dead (should never be seen)
Z defunct (“zombie”) process, terminated but not reaped by its parent

For BSD formats and when the stat keyword is used, additional characters may be displayed:

< high-priority (not nice to other users)
N low-priority (nice to other users)
L has pages locked into memory (for real-time and custom IO)
s is a session leader
l is multi-threaded (using CLONE_THREAD, like NPTL pthreads do)
+ is in the foreground process group


This version of ps includes format specifiers from many other implementations of this tool. There are about 125 of them. See the man page for the full list. I’m just putting what I think is most useful here.


%cpu %CPU cpu utilization of the process in “##.#” format. cpu time divided by time proc running (cputime/realtime ratio), as percent (alias pcpu).
numa NUMA The node associated with the most recently used processor. A -1 means that NUMA information is unavailable.
args COMMAND command with all its arguments as a string.
comm COMMAND command name (only the executable name).
euid EUID effective user ID (alias uid).
euser EUSER effective user name.
egid EGID effective group ID number of the process as a decimal integer. (alias gid).
egroup EGROUP effective group ID of the process.
lstart STARTED time the command started. See also bsdstart, start, start_time, and stime. ( better than start and start_time )
time TIME cumulative CPU time, “[DD-]HH:MM:SS” format. (alias cputime).
etime ELAPSED elapsed time since the process was started, in the form [[DD-]hh:]mm:ss.
lwp LWP light weight process (thread) ID of the dispatchable entity (alias spid, tid). See tid for additional information.
lxc LXC The name of the lxc container within which a task is running. If a process is not running inside a container, a dash (‘-‘) will be shown.
cgroup CGROUP display control groups to which the process belongs.
label LABEL security label, most commonly used for SELinux context data. This is for the Mandatory Access Control (“MAC”) found on high-security systems.

Process / Thread Info:

pid PID a number representing the process ID (alias tgid).
ppid PPID parent process ID.
pri PRI priority of the process. Higher number means lower priority.
ni NI nice value. This ranges from 19 (nicest) to -20 (not nice to others), see nice(1). (alias nice).
psr PSR processor that process is currently assigned to.
sgi_p P processor that the process is currently executing on. Displays “*” if the process is not currently running or runnable.
thcount THCNT number of kernel threads owned by the process - number of lwps (threads)
tid TID the unique number representing a dispatchable entity (alias lwp, spid).
stat STAT multi-character process state. See section PROCESS STATE CODES for the different values meaning. See also s and state if you just want the first character displayed.
f F flags associated with the process, see the PROCESS FLAGS section. (alias flag, flags).
wchan WCHAN name of the kernel function in which the process is sleeping, a “-“ if the process is running, or a “*” if the process is multi-threaded and ps is not displaying threads.

Memory Info:

%mem %MEM ratio of the process’s resident set size to the physical memory on the machine, expressed as a percentage. (alias pmem).
rss RSS resident set size, the non-swapped physical memory that a task has used (in kilobytes). (alias rssize, rsz).
vsz VSZ virtual memory size of the process in KiB (1024-byte units). Device mappings are currently excluded; this is subject to change. (alias vsize).
size SIZE approximate amount of swap space that would be required if the process were to dirty all writable pages and then be swapped out. This number is very rough!
sz SZ size in physical pages of the core image of the process. This includes text, data, and stack space. Device mappings are currently excluded; this is subject to change. See vsz and rss.
trs TRS text resident set size, the amount of physical memory devoted to executable code.
drs DRS data resident set size, the amount of physical memory devoted to other than executable code.
maj_flt MAJFLT The number of major page faults that have occurred with this process.
min_flt MINFLT The number of minor page faults that have occurred with this process.