How to Find Out the Processes Running on Linux Using the ps Command

There are some commands that allow the Linux administrator to view processes running on the Linux system.

The top command, htop command, and ps command are widely used by many Linux administrators to view running processes.

What is Process?

A process is a command/running instance that is executed by a program or user.

In Linux, each process has a unique process ID (PID), which is automatically assigned to each process when it is created. It starts from 0 to 65535.

PID 1 is always assigned to the init process, which is the first process started at boot time.

Linux is a multitasking operating system that allows multiple processes to be executed simultaneously.

Each process has its own state, which shows what is currently happening in the process. The state of the process can be as follows:

  • S (sleeping): The process is not running and waiting for a signal.
  • R (running): Process is running
  • T (traced or stopped): Process is stopped by signals
  • Z (zombie or defunct): Processes marked “defunct” are dead processes, know as zombie processes.
  • D (uninterruptible sleep): The process falls asleep and cannot be brought back until an event occurs.

What is ps Command?

The ps command stands for process status. This is one of the most basic commands that shows the system running processes.

It will show a snapshot of current processes running with detailed information of the process ID (pid=PID), the terminal associated with the process (tname=TTY), the cumulated CPU time in [DD-]hh:mm:ss format (time=TIME), and the executable name (ucmd=CMD).

General Syntax of the ps Command

The ps command comes with two syntax option. It’s UNIX and BSD style option.

For UNIX, preceded by a single dash

ps -[options]

# ps -ef

For BSD, use without a dash.

ps [options]

# ps aux

Note: “ps aux” is not equivalent to “ps -aux”. This has a different meaning, so don’t be confused.

  • -u: In UNIX style, It shows the process of a specific user.
  • u: In BSD style, It shows detailed information of the process.

1) How to List all Processes Running in the Current Shell

When you run the ps command without any options, it will only display the processes of the current shell.

# ps

  PID TTY          TIME CMD
 1437 pts/0    00:00:00 bash
 1465 pts/0    00:00:00 ps

2) How to List all Processes Running in the System

The following options show all user processes, which exclude processes associated with session leaders and terminals.

# ps -e
or
# ps -A
or
# ps -d

  PID TTY          TIME CMD
    1 ?        00:05:05 init
    2 ?        00:01:07 kthreadd
    3 ?        00:00:51 migration/0
    4 ?        00:01:06 ksoftirqd/0
    5 ?        00:00:00 migration/0
 2217 ?        01:20:40 nagios
 4550 ?        00:00:00 mysqld_safe
 4633 ?        00:03:19 mysqld
 4682 ?        00:00:00 pure-ftpd
 4684 ?        00:00:00 pure-authd
 5441 ?        00:00:00 dovecot
 5451 ?        00:00:00 pop3-login
 5452 ?        00:00:00 imap-login
 .
 .
 32263 ?        00:00:38 httpd

Alternatively, you can use the following BSD style syntax.

# pa au
or
# pa aux

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.0  19356  1004 ?        Ss   Jun19   5:05 /sbin/init
root         2  0.0  0.0      0     0 ?        S    Jun19   1:07 [kthreadd]
root         3  0.0  0.0      0     0 ?        S    Jun19   0:51 [migration/0]
root         4  0.0  0.0      0     0 ?        S    Jun19   1:06 [ksoftirqd/0]
root         5  0.0  0.0      0     0 ?        S    Jun19   0:00 [migration/0]
.
.
root     32237  0.0  0.0 110292   888 ?        Ss   Dec02   0:28 abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
root     32263  0.0  0.0  78432  7804 ?        Ss   Dec07   0:38 /usr/local/apache/bin/httpd -k start -DSSL

3) How to List all Processes Running in the System in Full Format

If you want to get a detailed output (full format) use the following option. This usually involves additional fields.

# ps -ef
or
# ps -eF
or
# ps -ely

UID        PID  PPID  C    SZ   RSS PSR STIME TTY          TIME CMD
root         1     0  0  4839  1004   3 Jun19 ?        00:05:05 /sbin/init
root         2     0  0     0     0   1 Jun19 ?        00:01:07 [kthreadd]
root         3     2  0     0     0   0 Jun19 ?        00:00:51 [migration/0]
root         4     2  0     0     0   0 Jun19 ?        00:01:06 [ksoftirqd/0]
root         5     2  0     0     0   0 Jun19 ?        00:00:00 [migration/0]
root         6     2  0     0     0   0 Jun19 ?        00:00:12 [watchdog/0]
root         7     2  0     0     0   1 Jun19 ?        00:01:08 [migration/1]
root         8     2  0     0     0   1 Jun19 ?        00:00:00 [migration/1]
.
.
root     32237     1  0 27573   888   0 Dec02 ?        00:00:28 abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
root     32263     1  0 19608  7804   0 Dec07 ?        00:00:38 /usr/local/apache/bin/httpd -k start -DSSL

4) How to Display a Specific User Processes on Linux Using the ps Command

If you need to display a specific user processes, use the following option with the ps command.

# ps -fu daygeek
or
# ps -fu uid

If you wish to display more than one UID process at a time, use the format below.

# ps -fu dbus,ntp,postfix

UID        PID  PPID  C STIME TTY          TIME CMD
dbus      1059     1  0 Mar16 ?        00:06:17 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation
ntp       1084     1  0 Mar16 ?        00:00:34 /usr/sbin/ntpd -u ntp:ntp -g
postfix   1732  1729  0 Mar16 ?        00:00:13 qmgr -l -t unix -u
postfix  28780  1729  0 00:25 ?        00:00:00 pickup -l -t unix -u

5) How to Display a Specific Group Processes on Linux Using the ps Command

If you need to display a specific group processes, use the following option with the ps command.

# ps -fg apache
or
# ps -fg uid

UID        PID  PPID  C STIME TTY          TIME CMD
apache   19605  1495  0 Mar22 ?        00:00:00 /usr/sbin/httpd -DFOREGROUND
apache   19606  1495  0 Mar22 ?        00:00:00 /usr/sbin/httpd -DFOREGROUND
apache   19607  1495  0 Mar22 ?        00:00:00 /usr/sbin/httpd -DFOREGROUND
apache   19608  1495  0 Mar22 ?        00:00:00 /usr/sbin/httpd -DFOREGROUND
apache   19609  1495  0 Mar22 ?        00:00:00 /usr/sbin/httpd -DFOREGROUND

6) How to Display a Process Using the Command Option

Instead of giving the process name, you can list the specific process using the command. For example, “Apache” is the actual process name, but you can list them as follows using the “httpd” command.

# ps -fC httpd

UID        PID  PPID  C STIME TTY          TIME CMD
root      1495     1  0 Mar16 ?        00:01:26 /usr/sbin/httpd -DFOREGROUND
apache   19605  1495  0 Mar22 ?        00:00:00 /usr/sbin/httpd -DFOREGROUND
apache   19606  1495  0 Mar22 ?        00:00:00 /usr/sbin/httpd -DFOREGROUND
apache   19607  1495  0 Mar22 ?        00:00:00 /usr/sbin/httpd -DFOREGROUND
apache   19608  1495  0 Mar22 ?        00:00:00 /usr/sbin/httpd -DFOREGROUND
apache   19609  1495  0 Mar22 ?        00:00:00 /usr/sbin/httpd -DFOREGROUND

7) How to Display a Process Tree in the ps Command Output

The below option will show the processes with the tree format.

# ps -ef --forest
or
# ps auxf

UID        PID  PPID  C STIME TTY          TIME CMD
root         2     0  0 Mar16 ?        00:00:01 [kthreadd]
root         4     2  0 Mar16 ?        00:00:00  \_ [kworker/0:0H]
root         6     2  0 Mar16 ?        00:00:14  \_ [ksoftirqd/0]
root         7     2  0 Mar16 ?        00:00:00  \_ [migration/0]
root         8     2  0 Mar16 ?        00:00:00  \_ [rcu_bh]
root         9     2  0 Mar16 ?        00:03:38  \_ [rcu_sched]
root        10     2  0 Mar16 ?        00:00:00  \_ [lru-add-drain]
root        11     2  0 Mar16 ?        00:00:04  \_ [watchdog/0]
root        12     2  0 Mar16 ?        00:00:05  \_ [watchdog/1]
root        13     2  0 Mar16 ?        00:00:00  \_ [migration/1]
root        14     2  0 Mar16 ?        00:00:15  \_ [ksoftirqd/1]
root        16     2  0 Mar16 ?        00:00:00  \_ [kworker/1:0H]
root        18     2  0 Mar16 ?        00:00:00  \_ [kdevtmpfs]
root        19     2  0 Mar16 ?        00:00:00  \_ [netns]
root        20     2  0 Mar16 ?        00:00:00  \_ [khungtaskd]
root        21     2  0 Mar16 ?        00:00:00  \_ [writeback]
root        22     2  0 Mar16 ?        00:00:00  \_ [kintegrityd]
root        23     2  0 Mar16 ?        00:00:00  \_ [bioset]
root        24     2  0 Mar16 ?        00:00:00  \_ [bioset]

If you want to show the process tree for a specific process, use the format below. In this example, we only check the Apache process tree instead of everything else.

# ps -f --forest -C httpd

UID        PID  PPID  C STIME TTY          TIME CMD
root      1495     1  0 Mar16 ?        00:01:26 /usr/sbin/httpd -DFOREGROUND
apache   19605  1495  0 Mar22 ?        00:00:00  \_ /usr/sbin/httpd -DFOREGROUND
apache   19606  1495  0 Mar22 ?        00:00:00  \_ /usr/sbin/httpd -DFOREGROUND
apache   19607  1495  0 Mar22 ?        00:00:00  \_ /usr/sbin/httpd -DFOREGROUND
apache   19608  1495  0 Mar22 ?        00:00:00  \_ /usr/sbin/httpd -DFOREGROUND
apache   19609  1495  0 Mar22 ?        00:00:00  \_ /usr/sbin/httpd -DFOREGROUND

8) How to Customize the ps Command Output

By default the ps command output comes with standard format, which contains only a few fields, you can customize the output according to your needs using the -o or --format option.

To do so, you need to know the field values, which can be found using the following option.

# ps L

%cpu         %CPU
%mem         %MEM
_left        LLLLLLLL
_left2       L2L2L2L2
_right       RRRRRRRR
_right2      R2R2R2R2
_unlimited   U
_unlimited2  U2
alarm        ALARM
args         COMMAND
atime        TIME
blocked      BLOCKED
bsdstart     START
bsdtime      TIME
.
.

For example, we are going to customize the ps command output with the user, pid, cpu%, mem% and command fields.

# ps -eo user,pid,%cpu,%mem,cmd

USER       PID %CPU %MEM CMD
root         1  0.0  0.1 /usr/lib/systemd/systemd --switched-root --system --deserialize 22
root         2  0.0  0.0 [kthreadd]
root         4  0.0  0.0 [kworker/0:0H]
root         6  0.0  0.0 [ksoftirqd/0]
root         7  0.0  0.0 [migration/0]
root         8  0.0  0.0 [rcu_bh]
root         9  0.0  0.0 [rcu_sched]
root        10  0.0  0.0 [lru-add-drain]
root        11  0.0  0.0 [watchdog/0]
root        12  0.0  0.0 [watchdog/1]
root        13  0.0  0.0 [migration/1]
root        14  0.0  0.0 [ksoftirqd/1]
root        16  0.0  0.0 [kworker/1:0H]
root        18  0.0  0.0 [kdevtmpfs]
root        19  0.0  0.0 [netns]
root        20  0.0  0.0 [khungtaskd]
root        21  0.0  0.0 [writeback]
root        22  0.0  0.0 [kintegrityd]
root        23  0.0  0.0 [bioset]

9) How to Check How Long a Process Has Been Running in Linux Using the ps Command

This can be achieved by using the “etime” and “etimes” options as follows.

  • etime: elapsed time since the process was started, in the form of [[DD-]hh:]mm:ss.
  • etimes: elapsed time since the process was started, in seconds.
# ps -p 1 -o etime

    ELAPSED
11-10:05:36
  • PID:1 It’s init process, the process has been running for 11 days, 10 hours, 05 minutes and 36 seconds.

If you want to view more than one process information, use the following format.

# ps -p 1,1495 -o pid,etime

  PID     ELAPSED
    1 11-10:07:33
 1495 11-10:07:21
  • PID:26510 It’s crond process, the process has been running for 11 days, 10 hours, 07 minutes and 21 seconds.

10) How to Find High CPU Consumption Processes in Linux Using the ps Command

This can be achieved using the --sort=-%cpu option as follows.

Refer the following article for more details:

# ps -eo pid,ppid,%mem,%cpu,cmd --sort=-%cpu | head

  PID  PPID %MEM %CPU CMD
18527  1714  4.2 40.3 /usr/lib/firefox/firefox -contentproc -childID 18 -isForBrowser -prefsLen 10002 -prefMapSize 213431 -parentBuildID 20191031132559 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 1714 true tab
 1714  1152  5.6  8.0 /usr/lib/firefox/firefox --new-window
18324  1714  4.9  6.3 /usr/lib/firefox/firefox -contentproc -childID 16 -isForBrowser -prefsLen 10002 -prefMapSize 213431 -parentBuildID 20191031132559 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 1714 true tab
 3286  1714  2.0  5.1 /usr/lib/firefox/firefox -contentproc -childID 14 -isForBrowser -prefsLen 8078 -prefMapSize 213431 -parentBuildID 20191031132559 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 1714 true tab
 1783  1714  3.0  4.5 /usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 1 -prefMapSize 213431 -parentBuildID 20191031132559 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 1714 true tab
 1227  1152  2.3  2.5 /usr/bin/gnome-shell
 1170  1168  3.5  2.2 /usr/lib/Xorg vt2 -displayfd 3 -auth /run/user/1000/gdm/Xauthority -nolisten tcp -background none -noreset -keeptty -verbose 3
16865  1714  2.5  2.1 /usr/lib/firefox/firefox -contentproc -childID 15 -isForBrowser -prefsLen 10002 -prefMapSize 213431 -parentBuildID 20191031132559 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 1714 true tab
 2179  1714  2.7  1.8 /usr/lib/firefox/firefox -contentproc -childID 6 -isForBrowser -prefsLen 7821 -prefMapSize 213431 -parentBuildID 20191031132559 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 1714 true tab

11) How to Find Out Top Memory Consuming Processes in Linux Using the ps Command

This can be achieved using the --sort=-%mem option as follows.

See the following article for more details:

# ps -eo pid,ppid,%mem,%cpu,cmd --sort=-%mem | head

  PID  PPID %MEM %CPU CMD
 1064     1  5.4  3.2 /usr/sbin/mysqld
23396 23386  2.9  0.0 /usr/sbin/varnishd -P /var/run/varnish.pid -f /etc/varnish/default.vcl -a :82 -T 127.0.0.1:6082 -S /etc/varnish/secret -s malloc,256M
 1105     1  2.7  0.0 /usr/sbin/named -u named -c /etc/named.conf
23377 23375  2.3  0.2 nginx: worker process
23376 23375  2.1  0.1 nginx: worker process
 3625   977  1.9  0.0 /usr/local/bin/php-cgi /home/daygeekc/public_html/index.php
23375     1  1.7  0.0 nginx: master process /usr/sbin/nginx -c /etc/nginx/nginx.conf
23378 23375  1.6  0.0 nginx: cache manager process
 1135  3034  0.9  0.0 cwpsrv: worker process

12) How to find out when the process started on Linux using the ps command

You can find out when the process started on Linux using the lstart option as follows.

# ps -p 1495 -o lstart

                 STARTED
Mon Mar 16 16:12:21 2020

The above process has launched on 16 March 2020 (Monday) at 4PM, 12 minutes, 21 seconds.

13) How to Find the Parent and Child of the Specific Process on Linux Using the ps Command

Use the following option to find the parent and child of a particular process on Linux.

# ps -C httpd
or
# ps -eu apache | grep httpd

  PID TTY          TIME CMD
 1495 ?        00:01:27 httpd
19605 ?        00:00:00 httpd
19606 ?        00:00:00 httpd
19607 ?        00:00:00 httpd
19608 ?        00:00:00 httpd
19609 ?        00:00:00 httpd

14) How To Find Only the PIDs of Specific Process in Linux

If you want to find only the PIDs of a particular process on Linux, use the following option with the ps command.

# ps -C sshd -o pid=

 1505
30888
32656

15) Visit the ps Command Man Page

If you are looking for any other options not listed in this article, visit the ps Command man page.

# man ps

Magesh Maruthamuthu

Love to play with all Linux distribution

You may also like...