UNIX / Linux: 7 Practical PS Command Examples for Process Monitoring

by Sasikala on April 12, 2011

Process is a running instance of a program. Linux is a multitasking operating system, which means that more than one process can be active at once. Use ps command to find out what processes are running on your system.

This article explains 7 practical usages of ps command and its options.

To monitor and control the processes, Linux provides lot of commands such as ps, kill, killall, nice, renice and top commands.

1. List Currently Running Processes (ps -ef, ps -aux)

Its a commonly used example with a ps command to list down all the process which are currently running in a machine. The following example shows the options of ps command to get all the processes.

$ ps -ef
root     26551     5  0 Feb10 ?        00:03:41 [pdflush]
root     26570     5  0 Feb10 ?        00:00:20 [pdflush]
root     30344  3382  0 Feb21 ?        00:00:11 sshd: root@pts/14
root     30365 30344  0 Feb21 pts/14   00:00:02 -bash
root     30393  3382  0 Feb21 ?        00:00:10 sshd: root@pts/15

Where:

-e to display all the processes.
-f to display full format listing.

In case of BSD machines, you can use ‘ps -aux’ will give the details about all the process as shown above.

$ ps -aux

2. List the Process based on the UID and Commands (ps -u, ps -C)

Use -u option to displays the process that belongs to a specific username. When you have multiple username, separate them using a comma. The example below displays all the process that are owned by user wwwrun, or postfix.

$ ps -f -u wwwrun,postfix
UID        PID  PPID  C STIME TTY          TIME CMD
postfix   7457  7435  0 Mar09 ?        00:00:00 qmgr -l -t fifo -u
wwwrun    7495  7491  0 Mar09 ?        00:00:00 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf
wwwrun    7496  7491  0 Mar09 ?        00:00:00 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf
wwwrun    7497  7491  0 Mar09 ?        00:00:00 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf
wwwrun    7498  7491  0 Mar09 ?        00:00:00 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf
wwwrun    7499  7491  0 Mar09 ?        00:00:00 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf
wwwrun   10078  7491  0 Mar09 ?        00:00:00 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf
wwwrun   10082  7491  0 Mar09 ?        00:00:00 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf
postfix  15677  7435  0 22:23 ?        00:00:00 pickup -l -t fifo -u

Often ps is used with grep like “ps -aux | grep command” to get the list of process with the given command.

But ps command itself has an option to achieve the same. The following example shows that all the processes which has tatad.pl in its command execution.

$ ps -f -C tatad.pl
UID        PID  PPID  C STIME TTY          TIME CMD
root      9576     1  0 Mar09 ?        00:00:00 /opt/tata/perl/bin/perl /opt/tata/bin/tatad.pl
root      9577  9576  0 Mar09 ?        00:00:00 /opt/tata/perl/bin/perl /opt/tata/bin/tatad.pl
root      9579  9576  0 Mar09 ?        00:00:00 /opt/tata/perl/bin/perl /opt/tata/bin/tatad.pl
root      9580  9576  0 Mar09 ?        00:00:00 /opt/tata/perl/bin/perl /opt/tata/bin/tatad.pl
root      9581  9576  0 Mar09 ?        00:00:00 /opt/tata/perl/bin/perl /opt/tata/bin/tatad.pl
root      9582  9576  0 Mar09 ?        00:00:00 /opt/tata/perl/bin/perl /opt/tata/bin/tatad.pl
root     12133  9576  0 Mar09 ?        00:00:00 /opt/tata/perl/bin/perl /opt/tata/bin/tatad.pl

Note: We can create aliases for ps command to list processes based on commands, users or groups.

3. List the processes based on PIDs or PPIDs (ps -p, ps –ppid)

Each process will be assigned with the unique Process ID (PID).

When you launch some application, it might fork number of processes and each sub process will have its own PID. So, each process will have its own process id and parent processid.

For all the processes that a process forks will have the same PPID (parent process identifier). The following method is used to get a list of processes with a particular PPID.

$ ps -f --ppid 9576
UID        PID  PPID  C STIME TTY          TIME CMD
root      9577  9576  0 Mar09 ?        00:00:00 /opt/tata/perl/bin/perl /opt/tata/bin/tatad.pl
root      9579  9576  0 Mar09 ?        00:00:00 /opt/tata/perl/bin/perl /opt/tata/bin/tatad.pl
root      9580  9576  0 Mar09 ?        00:00:00 /opt/tata/perl/bin/perl /opt/tata/bin/tatad.pl
root      9581  9576  0 Mar09 ?        00:00:00 /opt/tata/perl/bin/perl /opt/tata/bin/tatad.pl
root      9582  9576  0 Mar09 ?        00:00:00 /opt/tata/perl/bin/perl /opt/tata/bin/tatad.pl
root     12133  9576  0 Mar09 ?        00:00:00 /opt/tata/perl/bin/perl /opt/tata/bin/tatad.pl

The following example is to list the processes which has given PID.

$ ps -f  -p 25009,7258,2426
UID        PID  PPID  C STIME TTY          TIME CMD
root      2426     4  0 Mar09 ?        00:00:00 [reiserfs/0]
root      7258     1  0 Mar09 ?        00:00:00 /usr/sbin/nscd
postfix  25009  7435  0 00:02 ?        00:00:00 pickup -l -t fifo -u

4. List Processes in a Hierarchy (ps –forest)

The example below display the process Id and commands in a hierarchy. –forest is an argument to ps command which displays ASCII art of process tree. From this tree, we can identify which is the parent process and the child processes it forked in a recursive manner.

$ ps -e -o pid,args --forest
  468  \_ sshd: root@pts/7
  514  |   \_ -bash
17484  \_ sshd: root@pts/11
17513  |   \_ -bash
24004  |       \_ vi ./790310__11117/journal
15513  \_ sshd: root@pts/1
15522  |   \_ -bash
 4280  \_ sshd: root@pts/5
 4302  |   \_ -bash

Note: You can also use tree and pstree command to displays process in a nice tree structure.

5. List elapsed wall time for processes (ps -o pid,etime=)

If you want the get the elapsed time for the processes which are currently running ps command provides etime which provides the elapsed time since the process was started, in the form [[dd-]hh:]mm:ss.

The below command displays the elapsed time for the process IDs 1 (init) and process id 29675.

For example “10-22:13:29” in the output represents the process init is running for 10days, 22hours,13 minutes and 29seconds. Since init process starts during the system startup, this time will be same as the output of the ‘uptime’ command.

# ps -p 1,29675 -o pid,etime=
  PID
    1 10-22:13:29
29675  1-02:58:46

6. List all threads for a particular process (ps -L)

You can get a list of threads for the processes. When a process hangs, we might need to identify the list of threads running for a particular process as shown below.

 $ ps -C java -L -o pid,tid,pcpu,state,nlwp,args
  PID   TID %CPU S NLWP COMMAND
16992 16992  0.0 S   15 ../jre/bin/java -Djava.ext.dirs=../jre/lib/ext:../lib:../auto_lib -Xdebug -Xnoagent -Djava.compiler=NONE -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5006
16992 16993  0.0 S   15 ../jre/bin/java -Djava.ext.dirs=../jre/lib/ext:../lib:../auto_lib -Xdebug -Xnoagent -Djava.compiler=NONE -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5006
16992 16994  0.0 S   15 ../jre/bin/java -Djava.ext.dirs=../jre/lib/ext:../lib:../auto_lib -Xdebug -Xnoagent -Djava.compiler=NONE -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5006
16992 16995  0.0 S   15 ../jre/bin/java -Djava.ext.dirs=../jre/lib/ext:../lib:../auto_lib -Xdebug -Xnoagent -Djava.compiler=NONE -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5006
16992 16996  0.0 S   15 ../jre/bin/java -Djava.ext.dirs=../jre/lib/ext:../lib:../auto_lib -Xdebug -Xnoagent -Djava.compiler=NONE -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5006
16992 16997  0.0 S   15 ../jre/bin/java -Djava.ext.dirs=../jre/lib/ext:../lib:../auto_lib -Xdebug -Xnoagent -Djava.compiler=NONE -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5006
16992 16998  0.0 S   15 ../jre/bin/java -Djava.ext.dirs=../jre/lib/ext:../lib:../auto_lib -Xdebug -Xnoagent -Djava.compiler=NONE -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5006
16992 16999  0.0 S   15 ../jre/bin/java -Djava.ext.dirs=../jre/lib/ext:../lib:../auto_lib -Xdebug -Xnoagent -Djava.compiler=NONE -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5006
16992 17000  0.0 S   15 ../jre/bin/java -Djava.ext.dirs=../jre/lib/ext:../lib:../auto_lib -Xdebug -Xnoagent -Djava.compiler=NONE -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5006
16992 17001  0.0 S   15 ../jre/bin/java -Djava.ext.dirs=../jre/lib/ext:../lib:../auto_lib -Xdebug -Xnoagent -Djava.compiler=NONE -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5006
16992 17002  0.0 S   15 ../jre/bin/java -Djava.ext.dirs=../jre/lib/ext:../lib:../auto_lib -Xdebug -Xnoagent -Djava.compiler=NONE -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5006
16992 17003  0.0 S   15 ../jre/bin/java -Djava.ext.dirs=../jre/lib/ext:../lib:../auto_lib -Xdebug -Xnoagent -Djava.compiler=NONE -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5006
16992 17024  0.0 S   15 ../jre/bin/java -Djava.ext.dirs=../jre/lib/ext:../lib:../auto_lib -Xdebug -Xnoagent -Djava.compiler=NONE -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5006
16992 15753  0.0 S   15 ../jre/bin/java -Djava.ext.dirs=../jre/lib/ext:../lib:../auto_lib -Xdebug -Xnoagent -Djava.compiler=NONE -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5006
16992 15754  0.0 S   15 ../jre/bin/java -Djava.ext.dirs=../jre/lib/ext:../lib:../auto_lib -Xdebug -Xnoagent -Djava.compiler=NONE -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5006

-L option is used to display the list of threads for a process which has the command given. And it also displays nlwp, which represents number of light weight processes. In the above example, a total of 15 java threads are running.

7. Finding memory Leak (ps –sort pmem)

A memory leak, technically, is an ever-increasing usage of memory by an application.

With common desktop applications, this may go unnoticed, because a process typically frees any memory it has used when you close the application.

However, In the client/server model, memory leakage is a serious issue, because applications are expected to be available 24×7. Applications must not continue to increase their memory usage indefinitely, because this can cause serious issues. To monitor such memory leaks, we can use the following commands.

$ ps aux --sort pmem

USER       PID %CPU %MEM   VSZ  RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.0  1520  508 ?        S     2005   1:27 init
inst  1309  0.0  0.4 344308 33048 ?      S     2005   1:55 agnt (idle)
inst  2919  0.0  0.4 345580 37368 ?      S     2005  20:02 agnt (idle)
inst 24594  0.0  0.4 345068 36960 ?      S     2005  15:45 agnt (idle)
root 27645  0.0 14.4 1231288 1183976 ?   S     2005   3:01 /TaskServer/bin/./wrapper-linux-x86-32

In the above ps command, –sort option outputs the highest %MEM at bottom. Just note down the PID for the highest %MEM usage. Then use ps command to view all the details about this process id, and monitor the change over time. You had to manually repeat ir or put it as a cron to a file.

$ ps ev --pid=27645
PID TTY STAT TIME MAJFL TRS DRS RSS %MEM COMMAND
27645 ? S 3:01 0 25 1231262 1183976 14.4 /TaskServer/bin/./wrapper-linux-x86-32

$ ps ev --pid=27645
PID TTY STAT TIME MAJFL TRS DRS RSS %MEM COMMAND
27645 ? S 3:01 0 25 1231262 1183976 14.4 /TaskServer/bin/./wrapper-linux-x86-32

Note: In the above output, if RSS (resident set size, in KB) increases over time (so would %MEM), it may indicate a memory leak in the application.

Previous articles in the Linux performance monitoring and tuning series:

Add your comment

If you enjoyed this article, you might also like..

Comments on this entry are closed.

Juan Pablo April 12, 2011, 12:14 am

Excelente, muy útil. Que buen blog definitivamente, todos los artículos muy interesantes

—Spanish to English translation—
Excellent, very useful. What a great blog definitely all very interesting articles

∞
OJay April 12, 2011, 12:59 am

It should be mentioned that you can (and should) leave out the “-” in most cases at ps command options, as it is depreceated. On Mac OSX it gives you errors, on Linux you get a warning message that is easily overlooked. Took me quite a few years till i realized it. 🙂

∞
Vimarsh April 12, 2011, 3:55 am

As usual, as expected from TGS, awesome post !!!

∞
parzival52 April 12, 2011, 7:04 am

Doesn’t the BSD style drop the dash, so ps aux, rather than the ps -ef of SysV.

∞
Júlio Hoffimann Mendes April 12, 2011, 9:48 am

Hi,

Good tutorial! `ps` command is amazing for who knows how to use it.

Regards,
Júlio.

∞
Kuldeep April 12, 2011, 10:32 am

really very informative and very well explained !!!
Thank you so much for such great effort….

∞
shanil April 12, 2011, 2:57 pm

very well explained.. thanks mate

∞
Ashish Sood April 12, 2011, 2:57 pm

Thanks , For this interesting topic of process monitoring , great job.

∞
Leslie Satenstein April 17, 2011, 8:18 am

Wonderful article about the ps command.

∞
Andrew April 23, 2011, 6:08 am

Great article, thanks. But does all of those TN, Ss, S<, etc mean? I cannot find them in the ps command man page as well. They are under the STAT column.

∞
narcis April 27, 2011, 5:25 am

Print the process using the highest cpu:
ps -eo pid,%cpu,%mem,command,user | sort -k 2nr | head

or print the process using the highest mem %
ps -eo pid,%cpu,%mem,command,user | sort -k 3nr | head

∞
PaulN September 13, 2011, 4:17 am

Excellent article. It’s hard to find good examples like this, so thank you.

Good examples like this are much better than pages and pages of manuals.

∞
mannu February 25, 2012, 12:01 am

by using ps -ax on fedora getting

7788 T 0:00 ./f_name

what does this T stands for…??

∞
Anonymous March 25, 2012, 10:34 am

very good information placed in a very simple and clear language

∞
Saurabh May 10, 2012, 8:14 am

Nice way of presentation.

∞
sridhar August 30, 2012, 5:42 am

Reallu super

∞
Ajay October 16, 2012, 11:33 am

Really,clears all doubts and giving more knowledge.

∞
Mary November 1, 2012, 2:51 pm

Haw get all users from system order by number of process. Please help me!
Thanks

∞
Karunakar Reddy April 25, 2013, 10:11 pm

Well explanation helped me a lot, thank you:)

∞
saimon May 16, 2013, 9:20 am

excellent

∞
Thomas Sebastian July 4, 2013, 2:47 am

I always wanted to find out memory leak using ps command..also the sort command is very useful..thanks for the guide..very informative.

∞
dj November 6, 2013, 10:42 pm

I think you mean ps aux, not ps -aux in number 1. The BSD options do not have leading dashes.

It is easier for me to remember “ps ax u” because I have a picture in my head of “ps –help”.
In the upper left-hand corner is “a, x” — select what you want. Then in the lower left-hand is “u” — how do you want to format your selection. So select what you want to see, and then format it.

∞
harihara December 30, 2013, 12:45 am

I had used the command ” ps ev –pid=pidvalue ” and observed that RSS value keeps on increasing but no change in value of %MEM for one of the application. How can I go further to check memory leak ? plz help.

∞
Jake October 23, 2014, 11:00 am

This a nice tutorial but it’s missing the one tidbit I wanted: Man invocations shown here display a column heading C. Most of these are 0 but sometimes at my place I see a 1.

What is this column? I don’t see the explanation either here or in the official man page.

This became an issue because a script here runs ps -ef | grep ” 1 ” and I’m trying to understand that.

∞
Arindam Rakshit March 20, 2015, 8:01 pm

How can we display the nice value of a running process using ps command?

∞
Judy September 3, 2015, 2:42 pm

in the example in #6, 16992 is the parent, and it has 15 threads (including itself), all of which have 0.0 %CPU. Are the stats for the parent only for the parent thread, or the sum of all its threads? I’m looking for the Total %CPU and Memory used by a process (including its threads)

for example, based on #6, if thread 16993 is using 5% of the CPU, thread 16994 is using 15%, and all other threads are using 0%. What will be reported for the %CPU of thread 16992?

will we see
PID TID %CPU
16992 16992 0.0 <– use by the parent thread?
16992 16993 5.0
16992 16994 15.0
16992 16995 0.0
…
or
PID TID %CPU
16992 16992 20.0 <– sum of all the threads in the process?
16992 16993 5.0
16992 16994 15.0
16992 16995 0.0
…

∞

Next post: 5 Methods to Identify Your Linux File System Type (Ext2 or Ext3 or Ext4)

Previous post: Get Your Copy of Sed and Awk 101 Hacks eBook