The ps command lists running processes with PID, owner, state, CPU and memory use, and the command line.
ps
processes of this terminal
ps aux
all processes, BSD style
ps -ef
all processes, with the parent PPID
ps aux --sort=-%cpu | head
most CPU
ps aux --sort=-%mem | head
most memory
ps -u student
a user's processes
ps -p 1234 -o pid,stat,etime,cmd
custom columns for a PID
ps -C nginx
by program name
ps -ef --forest
a tree: who started whom
pgrep -a nginx
PID and command line by name
A process is a running program. Each has a PID number, an owner, a
parent (PPID) and a state. ps (process status) prints a snapshot of processes at
the moment it runs; top keeps a live view.
With no options ps shows only the current terminal's processes:
Usually you want all processes. For historical reasons ps has two syntaxes, and
both work: ps aux (BSD, no dash) and ps -ef (UNIX, with a dash).
Columns: PPID — the parent's PID; STIME — start time; TTY — the terminal (?
means none, usually a service); TIME — processor time used so far; CMD — the
command. Names in square brackets are kernel threads.
Instead of PPID, ps aux shows %CPU and %MEM — share of processor and memory;
VSZ and RSS — virtual and actually used memory in KiB; and STAT — the state.
Options with a dash (-e, -f, -u) and without (a, u, x) are different sets,
and they can be mixed. Full list — man ps.
| Option | What it does | Example |
|---|---|---|
aux |
All processes of all users, with owner, CPU and memory (BSD syntax). | ps aux |
-ef |
All processes in full format, with the parent PPID (UNIX syntax). | ps -ef |
-u user |
Processes of the given user. | ps -u student |
-p PID |
Only processes with these PIDs (comma-separated). | ps -p 1,812 |
-C name |
Processes by program name. | ps -C nginx |
-o fields |
A custom set of columns — pid, ppid, user, stat, %cpu, %mem, etime, cmd. | ps -o pid,ppid,stat,cmd -p 1 |
--sort field |
Sort by a column; a minus sign sorts descending. | ps aux --sort=-%mem |
--forest |
Draw the parent–child tree. | ps -ef --forest |
ww |
Don't cut the command line to the window width. | ps auxww |
Nothing found. Try a shorter query.
| Letter | State |
|---|---|
R |
running or waiting for a CPU |
S |
sleeping, waiting for an event |
D |
waiting on disk or network, signals can't interrupt |
T |
stopped (Ctrl+Z or a STOP signal) |
Z |
zombie: exited, the parent hasn't collected it |
s, +, l |
session leader, foreground, multithreaded |
ps aux | grep nginx also finds the line of grep nginx itself — hence the "extra"
process in the output.
etime is how long the process has run, ppid is the parent's PID: use it to find
who started a process or who isn't reaping a zombie.
%CPU in ps is the average over the process's lifetime, not "right now". top
shows the current load (P sorts by CPU).
ps -u expects an existing name or UID. Check the name: id name.
ps fits output to the window width. For the full line: ps auxww or ps -o args= -p
PID.
jobs, fg, bg.Found an inaccuracy? Report an error in the article