ps Command in Linux/Unix: A quick easy guide in 5 minutes

Introduction

The ps command in Linux is a fundamental utility that is used to view information about active processes. It provides insight into system performance, and resource usage, and helps with process management. Here’s a comprehensive guide to using ps in Linux.

Basic Syntax and Usage of the ps command

The basic syntax for the ps command is straightforward:

ps [options]
# use the below command to know more about its usage
ps –help
man ps

Running ps without any options will show processes in the current shell session. This default behavior can vary based on the environment, but commonly it shows the PID, TTY, TIME, and CMD columns.
Use sudo if you want to know information on root processes.

Key Options and Examples

To enhance the usefulness of ps, multiple options are available:

• ps aux
  This command displays all running processes on the system, regardless of their association with a terminal:ps aux The columns displayed include:
  • USER: The owner of the process.
  • PID: Process ID.
  • %CPU and %MEM: CPU and memory usage percentages.
  • VSZ and RSS: Virtual memory size and resident set size.
  • STAT: Process state.
  • START, TIME, and COMMAND: Start time, CPU time used, and command used to start the process.

• ps -ef
  This alternative format provides additional detail:
  ps -ef
-e lists all processes, while -f provides a “full” format output.
  This format is useful for examining parent-child relationships using the PPID (parent process ID) column.
  See the below screenshot for the same. Note that we have used head command to limit the result to 10 processes only.

Sorting Process List

You can combine ps with sorting commands to view processes based on resource usage. For instance:

ps aux --sort=-%mem | head

This command lists the top memory-consuming processes. Sorting by - before %mem or %cpu inverts the order for descending results.

Filtering by User

If you want to view processes for a specific user, use the -u flag:

ps -u username

This is useful for tracking processes related to particular users, especially on multi-user systems.

Displaying Process Trees

To understand process hierarchies, the --forest option (sometimes used as pstree) is ideal:

ps -ef --forest

This helps visualize relationships between processes, such as which child processes were spawned by a parent.

Detailed Process Information

If you need to see more comprehensive data for a specific process, ps allows filtering by PID:

ps -p <PID> -o <output_format>

For example:

ps -p 1234 -o pid,user,comm,etime

Here, -o lets you specify output fields, and etime shows elapsed time since the process started.

Filter processes using grep in the ps command

We can pass ps command output to the grep command to filter processes.

ps aux | grep root

This command displays processes started by the root user, helping with system management tasks.

Finding and Killing Processes

Often, system administrators need to terminate problematic processes. Use ps with grep to locate the process ID, then terminate it with kill:

ps aux | grep process_name
kill <PID>

Alternatively, you can automate this by chaining commands:

pkill process_name

Analyzing CPU and Memory Usage

3Process monitoring for system health involves checking CPU and memory. Combine ps with sorting:

ps -u root aux --sort=-%cpu,-%mem | head -n 10
# sort in ascending order with respect to cpu and descending order wrt memory
ps -u root aux --sort=%cpu,-%mem | head -n 10

These commands list the top 10 processes by CPU or memory usage, respectively.

Advanced Options and Custom Output

ps can be customized to show only specific fields. For example:

ps -e -o pid,user,%cpu,%mem,command

This command shows only the PID, user, CPU, memory usage, and command columns. This customization is helpful in scripting and process monitoring.

Conclusion

The ps command is a versatile tool for Linux process management, providing options to monitor, filter, and control processes. By combining it with commands like grep, sort, and kill using pipe in Linux (denoted by |), you can perform various tasks essential for system administration.

Editorial Team