Linux ps Command

The ps command is a widely used utility in Linux that provides a snapshot of current processes and their status. It helps monitor running processes, identify process ID (PID), terminal type (TTY), CPU time usage, command name, user ID and other information. This article provides a comprehensive overview of the various use cases of the ps command in real life.

Syntax of ps Command

The basic syntax of the ps command is as follows

ps [OPTIONS]

The ps command supports three different syntax styles: Unix, BSD, and GNU. Unix-style syntax uses options preceded by a hyphen, BSD style uses options without hyphens, and GNU syntax uses long options preceded by double hyphens.

Common ps Command Options

Use Cases of ps Command

Let's explore practical use cases of the ps command that are helpful for system administrators and users.

List all Running Processes

To view all processes currently running on the system, use the following command

ps -ef

UID     PID  PPID  C STIME TTY          TIME CMD
root      1     0  0 Jan31 ?        00:00:01 /sbin/init splash
root      2     0  0 Jan31 ?        00:00:00 [kthreadd]
root      3     2  0 Jan31 ?        00:00:00 [rcu_gp]
root      4     2  0 Jan31 ?        00:00:00 [rcu_par_gp]
root      5     2  0 Jan31 ?        00:00:00 [kworker/0:0-events]

In this output, PID represents the process ID, PPID is the parent process ID, TTY is the terminal type, TIME shows CPU time consumed, and CMD is the command name.

List Processes with CPU and Memory Usage

To view processes with detailed CPU and memory information, use

ps aux

USER    PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root      1  0.0  0.1  19404  3116 ?        Ss   Jan31   0:01 /sbin/init splash
root      2  0.0  0.0      0     0 ?        S    Jan31   0:00 [kthreadd]
root      3  0.0  0.0      0     0 ?        I<   Jan31   0:00 [rcu_gp]
john   1234  2.1  1.5  95768 23844 pts/1    S+   14:30   0:05 python app.py

Here, %CPU shows current CPU usage, %MEM shows memory usage percentage, VSZ is virtual memory size, and RSS is resident set size (physical memory).

List Processes for a Specific User

To view processes running under a specific user account

ps -u root

USER    PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root      1  0.0  0.1  19404  3116 ?        Ss   Jan31   0:01 /sbin/init
root      2  0.0  0.0      0     0 ?        S    Jan31   0:00 [kthreadd]
root    456  0.1  0.5  12340  8192 ?        S    12:30   0:02 /usr/sbin/sshd

Find Processes by Command Name

To locate all instances of a specific command

ps -C python

  PID TTY          TIME CMD
 1234 pts/1    00:00:05 python
 5678 pts/2    00:00:12 python

Display Process by PID

To view information about a specific process using its PID

ps -p 1234

  PID TTY          TIME CMD
 1234 pts/1    00:00:05 python

Sort Processes by Memory Usage

To identify memory-intensive processes

ps aux --sort=-pmem | head -10

USER    PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
john   2345  1.2  8.5 245768 125844 ?      S    14:00   2:15 firefox
mysql  1567  0.5  4.2  95768  65432 ?      S    12:00   1:30 mysqld
apache 3456  0.3  2.1  45678  32156 ?      S    13:00   0:45 httpd

Advanced ps Usage

Custom Output Format

Use -o option to customize displayed columns

ps -eo pid,ppid,cmd,pmem,pcpu --sort=-pmem | head -5

  PID  PPID CMD                         %MEM %CPU
 2345     1 firefox                      8.5  1.2
 1567     1 mysqld                       4.2  0.5
 3456     1 httpd                        2.1  0.3
    1     0 /sbin/init splash            0.1  0.0

Real-time Process Monitoring

For continuous monitoring, combine ps with watch

watch -n 2 'ps aux --sort=-pcpu | head -10'

Conclusion

The ps command is an essential tool for Linux system administration and process monitoring. It provides detailed information about running processes, memory usage, CPU consumption, and process relationships. Combined with sorting and filtering options, ps enables effective system troubleshooting and performance analysis.