Using the ps command in Linux

PS is the acronym for Process Status.
The utility is used for displaying, filtering and sorting the running processes, in this tutorial I would like to cover most of the use cases, but also I would like to keep it as short as possible, so if I missed something important please comment below.

The ps command accepts several types of parameters, I will use the standard syntax, the Unix format combined with GNU long options and in very few cases the BSD options.

Available option types:

1. UNIX options, which may be grouped and must be preceded by a dash.
2. BSD options, which may be grouped and without dash.
3. GNU long options, which are preceded by two dashes.

Display current shell processes

When using ps without any parameter the current shell instance will be displayed and also the processes started from the current shell.

ps

  PID TTY          TIME CMD
 6922 pts/3    00:00:00 bash
 7036 pts/3    00:00:00 ps

In my example the current shell is PID 6922, let’s demonstrate this by displaying $$ (PID of the current instance of shell).

echo $$

Display current user processes

ps -x

  PID TTY      STAT   TIME COMMAND
 1111 ?        Ss     0:00 /lib/systemd/systemd --user
 1112 ?        S      0:00 (sd-pam)
 1115 ?        Sl     0:01 /usr/bin/kwalletd5 --pam-login 15 3
 1116 ?        S      0:00 /bin/sh /usr/bin/startkde
 1151 ?        S      0:00 /usr/bin/dbus-launch --exit-with-session --sh-syntax
...

Display user processes

This will display all the processes started by a user, oueta in my example

ps -u oueta

  PID TTY          TIME CMD
 3182 ?        00:00:00 systemd
 3183 ?        00:00:00 (sd-pam)
 3202 ?        00:00:00 ssh-agent
 3552 ?        00:00:00 sshd
 3553 pts/4    00:00:00 bash
...

Display every processes

ps -e

  PID TTY          TIME CMD
    1 ?        00:00:04 systemd
    2 ?        00:00:00 kthreadd
    3 ?        00:00:22 ksoftirqd/0
    5 ?        00:00:00 kworker/0:0H
...

Display every processes in BSD format

ps aux

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.1 139088  6860 ?        Ss   Jan31   0:06 /sbin/init
root         2  0.0  0.0      0     0 ?        S    Jan31   0:00 [kthreadd]
root         3  0.0  0.0      0     0 ?        S    Jan31   0:31 [ksoftirqd/0]
root         5  0.0  0.0      0     0 ?        S<   Jan31   0:00 [kworker/0:0H]
root         7  0.1  0.0      0     0 ?        S    Jan31  13:25 [rcu_sched]
...

Display processes by PID

ps -p 48387

  PID TTY      STAT   TIME COMMAND
48387 ?        S      0:00 /usr/sbin/apache2 -k start

Multiple PID's can be selected

ps -p 36423 33223 56562

  PID TTY      STAT   TIME COMMAND
33223 ?        S      0:00 /usr/sbin/apache2 -k start
36423 ?        Ss     0:00 postgres: gitlab gitlabhq_production [local] idle
56562 ?        S      0:37 /usr/sbin/zabbix_agentd: listener #1 [waiting for connection]

Display processes by command

ps -C apache2,sshd

  PID TTY          TIME CMD
  878 ?        00:00:00 sshd
 1080 ?        00:00:17 apache2
 1846 ?        00:00:00 sshd
 2020 ?        00:00:00 sshd
 2068 ?        00:00:00 sshd
 2315 ?        00:00:17 apache2
30346 ?        00:00:00 apache2
30347 ?        00:00:00 apache2
...

Display by parent PID

ps --ppid 33963

  PID TTY          TIME CMD
38383 pts/3    00:00:00 sleep
38550 pts/3    00:00:00 ps

Display processes associated with terminals (ttys, or screens for text output)

ps -t tty1

  PID TTY          TIME CMD
  864 tty1     00:00:00 agetty

Display process thread information

ps -efL

UID        PID  PPID   LWP  C NLWP STIME TTY          TIME CMD
root         1     0     1  0    1 Jan31 ?        00:00:06 /sbin/init
root         2     0     2  0    1 Jan31 ?        00:00:00 [kthreadd]
root         3     2     3  0    1 Jan31 ?        00:00:31 [ksoftirqd/0]
root         5     2     5  0    1 Jan31 ?        00:00:00 [kworker/0:0H]
root         7     2     7  0    1 Jan31 ?        00:13:25 [rcu_sched]
...

Where NLWP (Number of Threads) and LWP (Thread ID).

Display every process scheduler information

ps -ec

  PID CLS PRI TTY          TIME CMD
    1 TS   19 ?        00:00:06 systemd
    2 TS   19 ?        00:00:00 kthreadd
    3 TS   19 ?        00:00:30 ksoftirqd/0
    5 TS   39 ?        00:00:00 kworker/0:0H
...

PRI: Priority of the process. Higher number means lower priority.
CLS: Scheduling class of the process.
Field's possible values are:

-   not reported
TS  SCHED_OTHER
FF  SCHED_FIFO
RR  SCHED_RR
B   SCHED_BATCH
ISO SCHED_ISO
IDL SCHED_IDLE
?   unknown value

Display security data

ps -eM

LABEL                             PID TTY          TIME CMD
-                                   1 ?        00:00:06 systemd
-                                   2 ?        00:00:00 kthreadd
-                                   3 ?        00:00:31 ksoftirqd/0
-                                   5 ?        00:00:00 kworker/0:0H
...

Full-format listing

ps -ef

UID        PID  PPID  C STIME TTY          TIME CMD
root         1     0  0 Jan31 ?        00:00:06 /sbin/init
root         2     0  0 Jan31 ?        00:00:00 [kthreadd]
root         3     2  0 Jan31 ?        00:00:30 [ksoftirqd/0]
...

Long-format listing

ps -el

F S   UID   PID  PPID  C PRI  NI ADDR SZ WCHAN  TTY          TIME CMD
4 S     0     1     0  0  80   0 - 34796 -      ?        00:00:01 systemd
1 S     0     2     0  0  80   0 -     0 -      ?        00:00:00 kthreadd
1 S     0     3     2  0  80   0 -     0 -      ?        00:00:00 ksoftirqd/0
1 S     0     5     2  0  60 -20 -     0 -      ?        00:00:00 kworker/0:0H
...

Display hierarchy view

ps -eH

...
 1521 ?        00:00:00   lxc-autostart
 1592 ?        00:00:01     systemd
 1707 ?        00:00:03       systemd-journal
 1785 ?        00:00:00       cron
 1881 ?        00:00:00       dhclient
 1933 pts/3    00:00:00       agetty
 1937 pts/2    00:00:00       agetty
 1938 pts/0    00:00:00       agetty
 1939 pts/1    00:00:00       agetty
 1940 pts/2    00:00:00       agetty
 1944 ?        00:00:00       vsftpd
 2020 ?        00:00:00       sshd
 3182 ?        00:00:00   systemd
 3183 ?        00:00:00     (sd-pam)
 3202 ?        00:00:00   ssh-agent
 6540 ?        00:00:00   screen
 6541 pts/5    00:00:00     bash
...

Display forest view

ps -e --forest

 1521 ?        00:00:00 lxc-autostart
 1592 ?        00:00:01  \_ systemd
 1707 ?        00:00:03      \_ systemd-journal
 1785 ?        00:00:00      \_ cron
 1881 ?        00:00:00      \_ dhclient
 1933 pts/3    00:00:00      \_ agetty
 1937 pts/2    00:00:00      \_ agetty
 1938 pts/0    00:00:00      \_ agetty
 1939 pts/1    00:00:00      \_ agetty
 1940 pts/2    00:00:00      \_ agetty
 1944 ?        00:00:00      \_ vsftpd
 2020 ?        00:00:00      \_ sshd
 3182 ?        00:00:00 systemd
 3183 ?        00:00:00  \_ (sd-pam)
...

Display header every page

ps -e --headers

...
52833 ?        00:00:15 kworker/1:2
52958 ?        00:00:16 kworker/0:0
54104 ?        00:00:00 gitlab-logrotat
  PID TTY          TIME CMD
55548 ?        00:00:00 sleep
56558 ?        00:00:00 zabbix_agentd
...

Don't display the header

ps -e --no-headers

    1 ?        00:00:06 systemd
    2 ?        00:00:00 kthreadd
    3 ?        00:00:30 ksoftirqd/0
    5 ?        00:00:00 kworker/0:0H
    7 ?        00:13:17 rcu_sched
...

Sort by column ascending

In this example we will sort by the command column.

ps -e --sort command

Sort by column descending

ps -e --sort -command

Display user-customized format

This is the most customizable and powerful feature of ps, you can display the desired columns.

ps -e -o pid,pcpu,pmem,command:5,user --sort -pcpu

  PID %CPU %MEM COMMAND USER
 2428  1.0  8.3 sidek 998
 1315  0.9  0.0 [kwor root
61974  0.8  0.0 [kwor root
61973  0.6  0.0 [kwor root
 2414  0.5  0.1 /opt/ 997
...

In my example I displayed five columns, the names are self explanatory also I restricted the command column to 5 characters and sorted by pcpu, as you already learned above, descending.
Note: This option can be combined with many options to add additional columns.

List all format specifiers

Display all the format specifiers which can be used with the -o flag, some keywords may not be available for sorting.

ps L

%cpu         %CPU    
%mem         %MEM    
_left        LLLLLLLL
_left2       L2L2L2L2
_right       RRRRRRRR
_right2      R2R2R2R2
_unlimited   U       
_unlimited2  U2      
alarm        ALARM   
args         COMMAND
...

Using the `ps` command in Linux