s0sta
EN NL عربي
Filters
How to search
  • Plain words find names, texts and examples.
  • "two words" finds the exact phrase.
  • --name or -x finds an option.
  • #word looks only inside commands.
  • @grep finds lessons and labs that use grep.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Put ! before a word to leave it out. OR between words means one of them.
  • ↑ ↓ to move · Enter to open · Esc to close · / to search

ps

Show a snapshot of running processes: PID, user, CPU and memory use, state and command.

Level
RHCSA exam
Group
Processes and jobs
Needs root
No
Package
procps-ng

What it does

ps reads /proc once and prints a list. It accepts three option styles: UNIX (with a dash: ps -ef), BSD (without a dash: ps aux) and GNU long options (--sort). The two most used forms are ps aux and ps -ef.

With -o you choose the columns, with --sort the order — for example the processes that use the most memory.

How to write it

ps [OPTION]...

Options 51

Most used

Select processes

-e, -A
All processes.
a
All processes with a terminal (BSD), with x: all.
x
Also processes without a terminal (BSD).
-a
All with a terminal except session leaders.
-d
All except session leaders.
-N, --deselect
Everything except the selection.
r
Only running processes.
T
Processes of this terminal.
-C CMDLIST
By command name.
-p, p, --pid PIDLIST
By PID.
--ppid PIDLIST
By parent PID.
-u, U, --user USERLIST
By effective user.
-U USERLIST
By real user.
-g, -G, --group GRPLIST
By group.
-s, --sid SESSLIST
By session.
-t, t, --tty TTYLIST
By terminal.
-q, q, --quick-pid PIDLIST
Fast mode by PID.

Output format

-f
Full format (UID, PID, PPID, C, STIME, TTY, TIME, CMD).
-F
Extra full format.
u
User format (%CPU, %MEM, VSZ, RSS, STAT, START).
-l, l
Long format.
-o, o, --format FORMAT
Your own columns, like -o pid,user,%cpu,cmd.
-O, O FORMAT
Default columns plus these.
-j, j
Job format.
s
Signal format.
v
Virtual memory format.
X
Register format.
-y
With -l: RSS instead of ADDR.
-c
Scheduler data with -l.
-M, Z, --context
Add the SELinux context.
-P
Add the CPU each process last ran on.

Display

--sort SPEC, k SPEC
Sort, like --sort=-%mem (- = high first).
--forest, f, -H
Show the process tree.
-L
Show threads (LWP, NLWP columns).
-T
Show threads (SPID column).
H, -m, m
Threads as processes / after processes.
e
Show the environment after the command.
c
Only the program name.
-w, w
Wide output (twice = no limit).
--cols, --columns, --width N
Set the width.
--lines, --rows N
Set the screen height.
--no-headers, h
No header line.
--headers
Repeat the header every page.
n
Numbers for user and WCHAN.
S
Add the CPU time of dead children.
--cumulative
Same as S.
-D, --date-format FORMAT
Format of time columns.
--signames
Signal names in signal format.

Help

L
List all column names.
--help SECTION
Help (simple, list, output, threads, misc, all).
-V, V, --version
Show the version.

Examples 12

$ run as a normal user# run as root (or with sudo)

  1. 1All processes, BSD style

    ps aux | head -3
USER   PID %CPU %MEM    VSZ   RSS TTY  STAT START   TIME COMMAND
root     1  0.0  0.4 174876 16420 ?    Ss   07:58   0:02 /usr/lib/systemd/systemd --switched-root --system
root     2  0.0  0.0      0     0 ?    S    07:58   0:00 [kthreadd]

    Names in [ ] are kernel threads.

  2. 2All processes, UNIX style

    ps -ef | grep sshd

    Shows PPID: who started the process.

  3. 3Top memory users

    ps -eo pid,user,%mem,rss,cmd --sort=-%mem | head

    First check when a server swaps or the OOM killer acts.

  4. 4Top CPU users

    ps aux --sort=-%cpu | head -5

    Snapshot; use top for a live view.

  5. 5One process by name

    ps -C httpd -o pid,ppid,user,cmd

    httpd runs a root parent and apache children.

  6. 6The process tree

    ps -ef --forest | less

    Shows which child belongs to which parent.

  7. 7Processes of one user

    ps -u lisa -o pid,tty,stat,cmd

    What a user runs before you lock the account.

  8. 8Find zombies and stuck processes

    ps -eo pid,ppid,stat,cmd | awk '$3 ~ /^[ZD]/'

    Z = zombie, D = waiting for disk (often NFS or a bad disk).

  9. 9SELinux contexts of services

    ps -eZ | grep httpd
system_u:system_r:httpd_t:s0    1420 ?  00:00:00 httpd

    The type httpd_t confines the web server.

  10. 10Threads of a process

    ps -L -p $(pidof chronyd)

    One line per thread.

  11. 11Start time and run time

    ps -o pid,lstart,etime,cmd -p 1010

    When did the service start, how long does it run?

  12. 12Find processes started from /tmp (security)

    ps -eo pid,user,cmd | grep -E '(/tmp|/dev/shm)/'

    Malware often runs from these folders.

Watch out

  • ps -aux (with a dash) is not the same as ps aux; use the BSD form without a dash.
  • ps is a snapshot. Values like %CPU are averages over the life of the process.

Exit codes

0 :: Done. 1 :: Error, or no process matched a selection.

Full manual

This page explains the command in simple words. The original manual has every detail.

In your terminal: man ps

Open the man page (linux.die.net)man7.org