Linux Command - ps
The Linux ps command will show a snapshot of the current running processes on a system.
The ps command has a lot of options. Many of these options are not important and we would be duplicating a lot of obscure documentation if we coverd them here. We are only covering the more useful options here. I am keeping some duplicate options if they are important to know. I’ve excluded some BSD sort keys and some extra format options ( ex: AIX ). If you want a full listing check the man page. This is mostly based off of the ps from the procps-ng package.
- Only keeping the most common and useful options to do most things.
ps # all procs with same ID and TTYs
ps -ef # all procs, full listing
ps aux # similar but BSD options and more useful cols
ps -eo pid,user,args --sort user # show all procs, select 3 cols, sort by user
ps -e -o user:50,pid,command:100,flags # adjust width of user column to 50, command column to 100
Using -o will override -f and since that is since that was grouped with -e they are both overridden:
ps -ef -o user:50,pid,command #
Lots of info, sorted by cpu and mem:
ps -e -o pid,ppid,euser,pri,ni,stat,wchan,thcount,%mem,vsz,rss,lstart,etime,time,args --sort %cpu
ps -e -o pid,ppid,euser,pri,ni,stat,wchan,thcount,%mem,vsz,rss,lstart,etime,time,args --sort %rss
Option types can be mixed, may have duplicate functionality:
- 1 UNIX options - have a dash, may be grouped
- 2 BSD options - no dash, may be grouped
-
3 GNU long options - two dashes.
- Default: Selects all procs with same effective user ID and same TTY.
- If using BSD options, will also include procs from other TTYs and will display the ‘stat’ field.
SIMPLE PROCESS SELECTION
a | all procs with tty |
-A | Select all processes. Identical to -e. |
-e | Select all processes. Identical to -A. |
T | Select all processes associated with this terminal. Identical to the t option without any argument. |
r | Restrict the selection to only running processes. |
x | include procs with tty ( Remove restriciton of procs with tty ) |
PROCESS SELECTION BY LIST
These options accept a single argument in the form of a blank-separated or comma-separated list. They can be used multiple times. For example: ps -p "1 2" -p 3,4
-C cmdlist | Select by command name. executable name not commmand line |
123 | Select by PID ( space separated ) |
-p pidlist | Select by PID ( space or comma separated ) |
–pid pidlist | Select by PID. |
–ppid pidlist | Select by parent PID. |
-U userlist | Select by real user ID (RUID) or name. |
-u userlist | Select by effective user ID (EUID) or name. |
OUTPUT FORMAT CONTROL
-f | Do full-format listing. Print command arguments. Show NLWP (number of threads) and LWP (thread ID) when combined with -L |
-F | Extra full format. Implies -f |
-M | Add a column of security data. Identical to Z (for SELinux). |
Z | Add a column of security data. Identical to -M (for SELinux). |
u | Display user-oriented format. |
v | Display virtual memory format. |
-o format | STANDARD FORMAT SPECIFIERS in comma or space separated list, ex: pid,user pid=Proc,comm=Command pid=x,comm=y user:50,pid,command |
OUTPUT MODIFIERS
e | Show the environment after the command. |
f | ASCII art process hierarchy (forest). |
–forest | ASCII art process tree. |
-H | Show process hierarchy (forest). |
n | Numeric output for WCHAN and USER (including all types of UID and GID). |
–sort spec | STANDARD FORMAT SPECIFIERS, + for increasing order - ofr decreasing ex: –sort=uid,-ppid,+pid |
THREAD DISPLAY
H | Show threads as if they were processes. |
-L | Show threads, possibly with LWP and NLWP columns. |
m | Show threads after processes. |
-m | Show threads after processes. |
-T | Show threads, possibly with SPID column. |
Some notes from the man page:
- CPU usage is currently expressed as the percentage of time spent running during the entire lifetime of a process. This is not ideal, and it does not conform to the standards that ps otherwise conforms to. CPU usage is unlikely to add up to exactly 100%.
- The SIZE and RSS fields don’t count some parts of a process including the page tables, kernel stack, struct thread_info, and struct task_struct. This is usually at least 20 KiB of memory that is always resident. SIZE is the virtual size of the process (code+data+stack).
- Processes marked ‘defunct’ are dead processes (so-called “zombies”) that remain because their parent has not destroyed them properly. These processes will be destroyed by init(8) if the parent process exits.
PROCESS FLAGS
The sum of these values is displayed in the “F” column, which is provided by the flags output specifier:
1 | forked but didn’t exec |
4 | used super-user privileges |
PROCESS STATE CODES
Here are the different values that the s, stat and state output specifiers (header “STAT” or “S”) will display to describe the state of a process:
D | uninterruptible sleep (usually IO) |
I | Idle kernel thread |
R | running or runnable (on run queue) |
S | interruptible sleep (waiting for an event to complete) |
T | stopped by job control signal |
t | stopped by debugger during the tracing |
W | paging (not valid since the 2.6.xx kernel) |
X | dead (should never be seen) |
Z | defunct (“zombie”) process, terminated but not reaped by its parent |
For BSD formats and when the stat keyword is used, additional characters may be displayed:
< | high-priority (not nice to other users) |
N | low-priority (nice to other users) |
L | has pages locked into memory (for real-time and custom IO) |
s | is a session leader |
l | is multi-threaded (using CLONE_THREAD, like NPTL pthreads do) |
+ | is in the foreground process group |
STANDARD FORMAT SPECIFIERS
This version of ps includes format specifiers from many other implementations of this tool. There are about 125 of them. See the man page for the full list. I’m just putting what I think is most useful here.
CODE HEADER DESCRIPTION
%cpu | %CPU | cpu utilization of the process in “##.#” format. cpu time divided by time proc running (cputime/realtime ratio), as percent (alias pcpu). |
numa | NUMA | The node associated with the most recently used processor. A -1 means that NUMA information is unavailable. |
args | COMMAND | command with all its arguments as a string. |
comm | COMMAND | command name (only the executable name). |
euid | EUID | effective user ID (alias uid). |
euser | EUSER | effective user name. |
egid | EGID | effective group ID number of the process as a decimal integer. (alias gid). |
egroup | EGROUP | effective group ID of the process. |
lstart | STARTED | time the command started. See also bsdstart, start, start_time, and stime. ( better than start and start_time ) |
time | TIME | cumulative CPU time, “[DD-]HH:MM:SS” format. (alias cputime). |
etime | ELAPSED | elapsed time since the process was started, in the form [[DD-]hh:]mm:ss. |
lwp | LWP | light weight process (thread) ID of the dispatchable entity (alias spid, tid). See tid for additional information. |
lxc | LXC | The name of the lxc container within which a task is running. If a process is not running inside a container, a dash (‘-‘) will be shown. |
cgroup | CGROUP | display control groups to which the process belongs. |
label | LABEL | security label, most commonly used for SELinux context data. This is for the Mandatory Access Control (“MAC”) found on high-security systems. |
Process / Thread Info:
pid | PID | a number representing the process ID (alias tgid). |
ppid | PPID | parent process ID. |
pri | PRI | priority of the process. Higher number means lower priority. |
ni | NI | nice value. This ranges from 19 (nicest) to -20 (not nice to others), see nice(1). (alias nice). |
psr | PSR | processor that process is currently assigned to. |
sgi_p | P | processor that the process is currently executing on. Displays “*” if the process is not currently running or runnable. |
thcount | THCNT | number of kernel threads owned by the process - number of lwps (threads) |
tid | TID | the unique number representing a dispatchable entity (alias lwp, spid). |
stat | STAT | multi-character process state. See section PROCESS STATE CODES for the different values meaning. See also s and state if you just want the first character displayed. |
f | F | flags associated with the process, see the PROCESS FLAGS section. (alias flag, flags). |
wchan | WCHAN | name of the kernel function in which the process is sleeping, a “-“ if the process is running, or a “*” if the process is multi-threaded and ps is not displaying threads. |
Memory Info:
%mem | %MEM | ratio of the process’s resident set size to the physical memory on the machine, expressed as a percentage. (alias pmem). |
rss | RSS | resident set size, the non-swapped physical memory that a task has used (in kilobytes). (alias rssize, rsz). |
vsz | VSZ | virtual memory size of the process in KiB (1024-byte units). Device mappings are currently excluded; this is subject to change. (alias vsize). |
size | SIZE | approximate amount of swap space that would be required if the process were to dirty all writable pages and then be swapped out. This number is very rough! |
sz | SZ | size in physical pages of the core image of the process. This includes text, data, and stack space. Device mappings are currently excluded; this is subject to change. See vsz and rss. |
trs | TRS | text resident set size, the amount of physical memory devoted to executable code. |
drs | DRS | data resident set size, the amount of physical memory devoted to other than executable code. |
maj_flt | MAJFLT | The number of major page faults that have occurred with this process. |
min_flt | MINFLT | The number of minor page faults that have occurred with this process. |