Many Linux commands can be used to view processes running on a Linux system.
‘ps’ and ‘top’ command are widely used by many Linux administrators to view running processes and discover which processes consume more resources in the system.
In this tutorial, we will show you how to find out the processes running on Linux using the ‘ps’ command.
What is process?
A process is a command/running instance that is executed by a program or user.
In Linux, each process has a unique process ID (PID), which is automatically assigned to each process when it is created. It starts from 0 to 65535.
PID 1 is always assigned to the init process, which is the first process started at boot time.
Linux is a multitasking operating system that allows multiple processes to be executed simultaneously.
Each process has its own state, which shows what is currently happening in the process. The state of the process can be as follows:
- S (sleeping): The process is not running and waiting for a signal.
- R (running): Process is running
- T (traced or stopped): Process is stopped by signals
- Z (zombie or defunct): Processes marked “defunct” are dead processes, know as zombie processes.
- D (uninterruptible sleep): The process falls asleep and cannot be brought back until an event occurs.
What is ps command?
The ps command stands for process status. This is one of the most basic commands that shows the system running processes.
It will show a snapshot of current processes running with detailed information of the process ID (pid=PID), the terminal associated with the process (tname=TTY), the cumulated CPU time in [DD-]hh:mm:ss format (time=TIME), and the executable name (ucmd=CMD).
General Syntax of the ps command
The ps command comes with two syntax option. It’s UNIX and BSD style option.
For UNIX, preceded by a single dash
ps -[options] # ps -ef
For BSD, use without a dash.
ps [options] # ps aux
Note:
“ps aux” is not equivalent to “ps -aux”. This has a different meaning, so don’t be confused.
- -u: In UNIX style, It shows the process of a specific user.
- u: In BSD style, It shows detailed information of the process.
1) How to List all Processes Running in the Current Shell
When you run the ps command without any options, it will only display the processes of the current shell.
# ps PID TTY TIME CMD 1437 pts/0 00:00:00 bash 1465 pts/0 00:00:00 ps
2) How to List all Processes Running in the System
The following options show all user processes, which exclude processes associated with session leaders and terminals.
# ps -e or # ps -A or # ps -d PID TTY TIME CMD 1 ? 00:05:05 init 2 ? 00:01:07 kthreadd 3 ? 00:00:51 migration/0 4 ? 00:01:06 ksoftirqd/0 5 ? 00:00:00 migration/0 2217 ? 01:20:40 nagios 4550 ? 00:00:00 mysqld_safe 4633 ? 00:03:19 mysqld 4682 ? 00:00:00 pure-ftpd 4684 ? 00:00:00 pure-authd 5441 ? 00:00:00 dovecot 5451 ? 00:00:00 pop3-login 5452 ? 00:00:00 imap-login . . 32263 ? 00:00:38 httpd
Alternatively, you can use the following BSD style syntax.
# pa au or # pa aux USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.0 19356 1004 ? Ss Jun19 5:05 /sbin/init root 2 0.0 0.0 0 0 ? S Jun19 1:07 [kthreadd] root 3 0.0 0.0 0 0 ? S Jun19 0:51 [migration/0] root 4 0.0 0.0 0 0 ? S Jun19 1:06 [ksoftirqd/0] root 5 0.0 0.0 0 0 ? S Jun19 0:00 [migration/0] . . root 32237 0.0 0.0 110292 888 ? Ss Dec02 0:28 abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages root 32263 0.0 0.0 78432 7804 ? Ss Dec07 0:38 /usr/local/apache/bin/httpd -k start -DSSL
3) How to List all Processes Running in the System in Full Format
If you want to get a detailed output (full format) use the following option. This usually involves additional fields.
# ps -ef or # ps -eF or # ps -ely UID PID PPID C SZ RSS PSR STIME TTY TIME CMD root 1 0 0 4839 1004 3 Jun19 ? 00:05:05 /sbin/init root 2 0 0 0 0 1 Jun19 ? 00:01:07 [kthreadd] root 3 2 0 0 0 0 Jun19 ? 00:00:51 [migration/0] root 4 2 0 0 0 0 Jun19 ? 00:01:06 [ksoftirqd/0] root 5 2 0 0 0 0 Jun19 ? 00:00:00 [migration/0] root 6 2 0 0 0 0 Jun19 ? 00:00:12 [watchdog/0] root 7 2 0 0 0 1 Jun19 ? 00:01:08 [migration/1] root 8 2 0 0 0 1 Jun19 ? 00:00:00 [migration/1] . . root 32237 1 0 27573 888 0 Dec02 ? 00:00:28 abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages root 32263 1 0 19608 7804 0 Dec07 ? 00:00:38 /usr/local/apache/bin/httpd -k start -DSSL
4) How to Display a Specific User Processes on Linux Using the ps Command
If you need to display a specific user processes, use the following option with the ps command.
# ps -fu daygeek or # ps -fu uid
If you wish to display more than one UID process at a time, use the format below.
# ps -fu dbus,ntp,postfix UID PID PPID C STIME TTY TIME CMD dbus 1059 1 0 Mar16 ? 00:06:17 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation ntp 1084 1 0 Mar16 ? 00:00:34 /usr/sbin/ntpd -u ntp:ntp -g postfix 1732 1729 0 Mar16 ? 00:00:13 qmgr -l -t unix -u postfix 28780 1729 0 00:25 ? 00:00:00 pickup -l -t unix -u
5) How to Display a Specific Group Processes on Linux Using the ps Command
If you need to display a specific group processes, use the following option with the ps command.
# ps -fg apache or # ps -fg uid UID PID PPID C STIME TTY TIME CMD apache 19605 1495 0 Mar22 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND apache 19606 1495 0 Mar22 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND apache 19607 1495 0 Mar22 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND apache 19608 1495 0 Mar22 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND apache 19609 1495 0 Mar22 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND
6) How to Display a Process Using the Command Option
Instead of giving the process name, you can list the specific process using the command. For example, “Apache” is the actual process name, but you can list them as follows using the “httpd” command.
# ps -fC httpd UID PID PPID C STIME TTY TIME CMD root 1495 1 0 Mar16 ? 00:01:26 /usr/sbin/httpd -DFOREGROUND apache 19605 1495 0 Mar22 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND apache 19606 1495 0 Mar22 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND apache 19607 1495 0 Mar22 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND apache 19608 1495 0 Mar22 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND apache 19609 1495 0 Mar22 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND
7) How to Display a process tree in the ps command output
The below option will show the processes with the tree format.
# ps -ef --forest or # ps auxf UID PID PPID C STIME TTY TIME CMD root 2 0 0 Mar16 ? 00:00:01 [kthreadd] root 4 2 0 Mar16 ? 00:00:00 \_ [kworker/0:0H] root 6 2 0 Mar16 ? 00:00:14 \_ [ksoftirqd/0] root 7 2 0 Mar16 ? 00:00:00 \_ [migration/0] root 8 2 0 Mar16 ? 00:00:00 \_ [rcu_bh] root 9 2 0 Mar16 ? 00:03:38 \_ [rcu_sched] root 10 2 0 Mar16 ? 00:00:00 \_ [lru-add-drain] root 11 2 0 Mar16 ? 00:00:04 \_ [watchdog/0] root 12 2 0 Mar16 ? 00:00:05 \_ [watchdog/1] root 13 2 0 Mar16 ? 00:00:00 \_ [migration/1] root 14 2 0 Mar16 ? 00:00:15 \_ [ksoftirqd/1] root 16 2 0 Mar16 ? 00:00:00 \_ [kworker/1:0H] root 18 2 0 Mar16 ? 00:00:00 \_ [kdevtmpfs] root 19 2 0 Mar16 ? 00:00:00 \_ [netns] root 20 2 0 Mar16 ? 00:00:00 \_ [khungtaskd] root 21 2 0 Mar16 ? 00:00:00 \_ [writeback] root 22 2 0 Mar16 ? 00:00:00 \_ [kintegrityd] root 23 2 0 Mar16 ? 00:00:00 \_ [bioset] root 24 2 0 Mar16 ? 00:00:00 \_ [bioset]
If you want to show the process tree for a specific process, use the format below. In this example, we only check the Apache process tree instead of everything else.
# ps -f --forest -C httpd UID PID PPID C STIME TTY TIME CMD root 1495 1 0 Mar16 ? 00:01:26 /usr/sbin/httpd -DFOREGROUND apache 19605 1495 0 Mar22 ? 00:00:00 \_ /usr/sbin/httpd -DFOREGROUND apache 19606 1495 0 Mar22 ? 00:00:00 \_ /usr/sbin/httpd -DFOREGROUND apache 19607 1495 0 Mar22 ? 00:00:00 \_ /usr/sbin/httpd -DFOREGROUND apache 19608 1495 0 Mar22 ? 00:00:00 \_ /usr/sbin/httpd -DFOREGROUND apache 19609 1495 0 Mar22 ? 00:00:00 \_ /usr/sbin/httpd -DFOREGROUND
8) How to Customize the ps Command Output
By default the ps command output comes with standard format, which contains only a few fields, you can customize the output according to your needs using the -o or --format
option.
To do so, you need to know the field values, which can be found using the following option.
# ps L %cpu %CPU %mem %MEM _left LLLLLLLL _left2 L2L2L2L2 _right RRRRRRRR _right2 R2R2R2R2 _unlimited U _unlimited2 U2 alarm ALARM args COMMAND atime TIME blocked BLOCKED bsdstart START bsdtime TIME . .
For example, we are going to customize the ps command output with the user, pid, cpu%, mem% and command fields.
# ps -eo user,pid,%cpu,%mem,cmd USER PID %CPU %MEM CMD root 1 0.0 0.1 /usr/lib/systemd/systemd --switched-root --system --deserialize 22 root 2 0.0 0.0 [kthreadd] root 4 0.0 0.0 [kworker/0:0H] root 6 0.0 0.0 [ksoftirqd/0] root 7 0.0 0.0 [migration/0] root 8 0.0 0.0 [rcu_bh] root 9 0.0 0.0 [rcu_sched] root 10 0.0 0.0 [lru-add-drain] root 11 0.0 0.0 [watchdog/0] root 12 0.0 0.0 [watchdog/1] root 13 0.0 0.0 [migration/1] root 14 0.0 0.0 [ksoftirqd/1] root 16 0.0 0.0 [kworker/1:0H] root 18 0.0 0.0 [kdevtmpfs] root 19 0.0 0.0 [netns] root 20 0.0 0.0 [khungtaskd] root 21 0.0 0.0 [writeback] root 22 0.0 0.0 [kintegrityd] root 23 0.0 0.0 [bioset]
9) How to Check How Long a Process Has Been Running in Linux Using the ps Command
This can be achieved by using the “etime” and “etimes” options as follows.
etime:
elapsed time since the process was started, in the form of [[DD-]hh:]mm:ss.etimes:
elapsed time since the process was started, in seconds.
# ps -p 1 -o etime ELAPSED 11-10:05:36
- PID:1 It’s init process, the process has been running for 11 days, 10 hours, 05 minutes and 36 seconds.
If you want to view more than one process information, use the following format.
# ps -p 1,1495 -o pid,etime PID ELAPSED 1 11-10:07:33 1495 11-10:07:21
- PID:26510 It’s crond process, the process has been running for 11 days, 10 hours, 07 minutes and 21 seconds.
10) How to Find High CPU Consumption Processes in Linux Using the ps Command
This can be achieved using the --sort=-%cpu
option as follows.
Refer the following article for more details:
ps -eo pid,ppid,%mem,%cpu,cmd --sort=-%cpu | head or ps aux --sort=-%cpu | head PID PPID %MEM %CPU CMD 18527 1714 4.2 40.3 /usr/lib/firefox/firefox -contentproc -childID 18 -isForBrowser -prefsLen 10002 -prefMapSize 213431 -parentBuildID 20191031132559 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 1714 true tab 1714 1152 5.6 8.0 /usr/lib/firefox/firefox --new-window 18324 1714 4.9 6.3 /usr/lib/firefox/firefox -contentproc -childID 16 -isForBrowser -prefsLen 10002 -prefMapSize 213431 -parentBuildID 20191031132559 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 1714 true tab 3286 1714 2.0 5.1 /usr/lib/firefox/firefox -contentproc -childID 14 -isForBrowser -prefsLen 8078 -prefMapSize 213431 -parentBuildID 20191031132559 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 1714 true tab 1783 1714 3.0 4.5 /usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 1 -prefMapSize 213431 -parentBuildID 20191031132559 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 1714 true tab 1227 1152 2.3 2.5 /usr/bin/gnome-shell 1170 1168 3.5 2.2 /usr/lib/Xorg vt2 -displayfd 3 -auth /run/user/1000/gdm/Xauthority -nolisten tcp -background none -noreset -keeptty -verbose 3 16865 1714 2.5 2.1 /usr/lib/firefox/firefox -contentproc -childID 15 -isForBrowser -prefsLen 10002 -prefMapSize 213431 -parentBuildID 20191031132559 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 1714 true tab 2179 1714 2.7 1.8 /usr/lib/firefox/firefox -contentproc -childID 6 -isForBrowser -prefsLen 7821 -prefMapSize 213431 -parentBuildID 20191031132559 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 1714 true tab
11) How to Find Out Top Memory Consuming Processes in Linux Using the ps Command
This can be achieved using the --sort=-%mem
option as follows.
See the following article for more details:
# ps -eo pid,ppid,%mem,%cpu,cmd --sort=-%mem | head PID PPID %MEM %CPU CMD 1064 1 5.4 3.2 /usr/sbin/mysqld 23396 23386 2.9 0.0 /usr/sbin/varnishd -P /var/run/varnish.pid -f /etc/varnish/default.vcl -a :82 -T 127.0.0.1:6082 -S /etc/varnish/secret -s malloc,256M 1105 1 2.7 0.0 /usr/sbin/named -u named -c /etc/named.conf 23377 23375 2.3 0.2 nginx: worker process 23376 23375 2.1 0.1 nginx: worker process 3625 977 1.9 0.0 /usr/local/bin/php-cgi /home/daygeekc/public_html/index.php 23375 1 1.7 0.0 nginx: master process /usr/sbin/nginx -c /etc/nginx/nginx.conf 23378 23375 1.6 0.0 nginx: cache manager process 1135 3034 0.9 0.0 cwpsrv: worker process
Similarly, you can find the same output using the following ps command format.
ps aux --sort -rss | head or ps aux --sort=-%mem | head USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND linuxge+ 3477 11.6 3.8 3835872 620284 ? Sl 07:54 2:42 /usr/lib64/firefox/firefox --new-window linuxge+ 4049 3.7 2.6 3268656 434344 ? Sl 07:55 0:51 /usr/lib64/firefox/firefox -contentproc -childID 5 -isForBrowser -prefsLen 6295 -prefMapSize 245122 -jsInit 285716 -parentBuildID 20211028170545 -appdir /usr/lib64/firefox/browser 3477 true tab linuxge+ 2153 7.3 2.4 3985780 397832 ? Ssl 07:53 1:45 /usr/bin/gnome-shell linuxge+ 3941 8.1 1.9 3213600 313528 ? Sl 07:55 1:51 /usr/lib64/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 5851 -prefMapSize 245122 -jsInit 285716 -parentBuildID 20211028170545 -appdir /usr/lib64/firefox/browser 3477 true tab linuxge+ 4104 2.8 1.6 3047316 267624 ? Sl 07:55 0:37 /usr/lib64/firefox/firefox -contentproc -childID 6 -isForBrowser -prefsLen 8541 -prefMapSize 245122 -jsInit 285716 -parentBuildID 20211028170545 -appdir /usr/lib64/firefox/browser 3477 true tab linuxge+ 3253 0.9 1.4 4966408 241280 ? Sl 07:54 0:13 /usr/share/atom/atom --executed-from=/home/linuxgeek --pid=3239 linuxge+ 6527 2.4 1.3 2901776 223236 ? Sl 08:12 0:08 /usr/lib64/firefox/firefox -contentproc -childID 8 -isForBrowser -prefsLen 9928 -prefMapSize 245122 -jsInit 285716 -parentBuildID 20211028170545 -appdir /usr/lib64/firefox/browser 3477 true tab linuxge+ 3318 0.3 1.3 4959780 210792 ? SLl 07:54 0:04 /usr/share/atom/atom --type=renderer --enable-experimental-web-platform-features --field-trial-handle=809270599112650712,8039275088346185529,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --enable-crash-reporter=ab152d6e-ff7d-4f42-a8c4-591e4c7f03b9,no_channel --global-crash-keys=ab152d6e-ff7d-4f42-a8c4-591e4c7f03b9,no_channel,_companyName=GitHub,_productName=Atom,_version=1.58.0 --app-path=/usr/share/atom/resources/app.asar --node-integration --node-integration-in-worker --webview-tag --no-sandbox --no-zygote --enable-remote-module --background-color=#fff --disable-blink-features=Auxclick --enable-spellcheck --enable-websql --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --shared-files=v8_snapshot_data:100 linuxge+ 2378 0.2 1.1 1162912 186100 ? Sl 07:54 0:02 /usr/bin/gnome-software --gapplication-service
12) How to find out when the process started on Linux using the ps command
You can find out when the process started on Linux using the lstart
option as follows.
# ps -p 1495 -o lstart STARTED Mon Mar 16 16:12:21 2020
The above process has launched on 16 March 2020 (Monday) at 4PM, 12 minutes, 21 seconds.
13) How to Find the Parent and Child of the Specific Process on Linux Using the ps Command
Use the following option to find the parent and child of a particular process on Linux.
# ps -C httpd or # ps -eu apache | grep httpd PID TTY TIME CMD 1495 ? 00:01:27 httpd 19605 ? 00:00:00 httpd 19606 ? 00:00:00 httpd 19607 ? 00:00:00 httpd 19608 ? 00:00:00 httpd 19609 ? 00:00:00 httpd
14) How To Find Only the PIDs of Specific Process in Linux
If you want to find only the PIDs of a particular process on Linux, use the following option with the ps command.
# ps -C sshd -o pid= 1505 30888 32656
15) Visit the ps Command Man Page
If you are looking for any other options not listed in this article, visit the ps Command man page.
# man ps