How to Use ps Command
The ps aux command is a tool for monitoring processes running on your Linux system. A process is associated with any program running on your system, and is used to manage and monitor its memory usage, processor time, and I/O resources. Since the ps aux command displays an overview of all running processes, it is a great tool for understanding and troubleshooting the health and state of your Linux system. This guide provides an introduction to the ps aux command with brief examples to help you interpret its output.
The ps command
The ps command without any options displays information about processes that are bound by the controlling terminal.
ps
The command returns a similar output:
PID TTY TIME CMD
285 pts/2 00:00:00 zsh
334 pts/2 00:00:00 ps
The default output of the ps command contains four columns that provide the following information:
PID: The process ID is your system’s tracking number for the process. ThePIDis useful when you need to use a command likekillornice, which take a PID as their input.TTY: The controlling terminal associated with the process. Processes that do not originate from a controlling terminal and were initiated by the system at boot are displayed with a question mark.TIME: The CPU usage of the process. Displays the amount of CPU time used by the process. This value is not the run time of the process.CMD: The name of the command or executable that is running. The output only includes the name of the command or executable and does not display any options that were passed in.
Command Options
The ps command accepts three different styles of options; UNIX, BSD, and GNU. You can use a mix of each style, however, you may notice inconsistent behavior across Linux distributions.
- When using UNIX-style options, your option(s) must be preceded by a dash (
-) and can be grouped together. For example, theauxoptions in theps -auxcommand is preceded by a dash when using the UNIX style. - When using BSD-style options with the
pscommand, you must exclude the dash (-), however, you can group your options. For example, notice theps auxcommand’s options;auxis formatted in the BSD style. - GNU-style options are preceded by two dashes (
-), and are reserved for long options. For example, theps --quick-pid 10946command uses the long option-quick-pidto display running process information by a specific PID. In the example,10946is the process PID.
View All of Your System’s Processes
By default, the ps command displays only the processes associated with your current terminal session. However, you may want to view all the processes that the current user owns, for example if you have multiple terminal sessions running for the same user. In that case, issue the ps x command. Also, notice that the command is using the BSD-style option.
The ps x command returns an additional column called sate information (STAT). This column can display a large number of possible values depending on the process it displays. For example, a lowercase s indicates that the process is a session leader (i.e., the root process). A capital S means that the process is in an interruptible sleep state, and is waiting for some event, like user input. R means that the command is actively running. T means that the process has stopped; like when you enter control-Z in the vi text editor. The + means it is a foreground process.
Take a look at the following example and notice the different states for each process displayed in the STAT column:
ps x
PID TTY STAT TIME COMMAND
285 pts/2 Ss 0:00 -zsh
343 pts/2 T 0:00 vi foo
351 pts/3 Ss+ 0:00 -zsh
439 pts/2 R+ 0:00 ps -x
Viewing the Process Hierarchy
The init process is the first process started by the Linux kernel when a system boots. Every other process on your system is a child of the init process. You can view this hierarchy using the ps command’s e and H options. The e option causes ps to list all processes in the system, regardless of the owner or controlling terminal. The H option formats the CMD column’s data to display the parent-child relationship between processes.
ps -He
PID TTY TIME CMD
1 ? 00:00:00 init
227 ? 00:00:00 init
228 ? 00:00:00 init
229 pts/0 00:00:15 docker
240 ? 00:00:00 init <defunct>
247 ? 00:00:00 init
248 pts/1 00:00:10 docker-desktop-
283 ? 00:00:00 init
284 ? 00:00:00 init
285 pts/2 00:00:00 zsh
343 pts/2 00:00:00 vi
528 pts/2 00:00:00 ps
349 ? 00:00:00 init
350 ? 00:00:00 init
351 pts/3 00:00:00 zsh
Alternatively, you can get a prettier output with a few more columns by using the ps -axjf command.
ps -axjf
PPID PID PGID SID TTY TPGID STAT UID TIME COMMAND
0 1 0 0 ? -1 Sl 0 0:00 /init
1 227 227 227 ? -1 Ss 0 0:00 /init
227 228 227 227 ? -1 S 0 0:00 \_ /init
228 229 229 229 pts/0 229 Ssl+ 1000 0:15 | \_ docker
227 240 227 227 ? -1 Z 0 0:00 \_ [init] <defunct>
227 247 227 227 ? -1 S 0 0:00 \_ /init
247 248 248 248 pts/1 248 Ssl+ 0 0:10 \_ /mnt/wsl/docker-desktop/docker-desktop-proxy
1 283 283 283 ? -1 Ss 0 0:00 /init
283 284 283 283 ? -1 S 0 0:00 \_ /init
284 285 285 285 pts/2 559 Ss 1000 0:00 \_ -zsh
285 343 343 285 pts/2 559 T 1000 0:00 \_ vi foo
285 559 559 285 pts/2 559 R+ 1000 0:00 \_ ps axjf
1 349 349 349 ? -1 Ss 0 0:00 /init
349 350 349 349 ? -1 S 0 0:00 \_ /init
350 351 351 351 pts/3 351 Ss+ 1000 0:00 \_ -zsh
The additional columns provide the following information:
PPID: Displays the parent process ID. In the above example, thevicommand has aPPIDof285, which matches thePIDof the Z shell process running above it.SID: This column displays the session ID. The value is usually the same as the PID of the process that started the chain.PGID: This ID shows the parent group process ID.TPGID: This is the terminal sessions ID with which the process is associated. If there is no terminal that is associated, then1is displayed.UID: The user ID associated with the process is displayed in this column.
The aux shortcut
Now that you understand the basics of the ps command, this section covers the benefits to the ps aux command. The ps aux displays the most amount of information a user usually needs to understand the current state of their system’s running processes. Take a look at the following example:
ps aux
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.0 892 572 ? Sl Nov28 0:00 /init
root 227 0.0 0.0 900 80 ? Ss Nov28 0:00 /init
root 228 0.0 0.0 900 88 ? S Nov28 0:00 /init
zaphod 229 0.0 0.1 749596 31000 pts/0 Ssl+ Nov28 0:15 docker
root 240 0.0 0.0 0 0 ? Z Nov28 0:00 [init] <defunct>
root 247 0.0 0.0 900 88 ? S Nov28 0:00 /init
root 248 0.0 0.1 1758276 31408 pts/1 Ssl+ Nov28 0:10 /mnt/wsl/docker-desktop/docker-desktop-proxy
root 283 0.0 0.0 892 80 ? Ss Dec01 0:00 /init
root 284 0.0 0.0 892 80 ? R Dec01 0:00 /init
zaphod 285 0.0 0.0 11964 5764 pts/2 Ss Dec01 0:00 -zsh
zaphod 343 0.0 0.0 23764 9836 pts/2 T 17:44 0:00 vi foo
root 349 0.0 0.0 892 80 ? Ss 17:45 0:00 /init
root 350 0.0 0.0 892 80 ? S 17:45 0:00 /init
zaphod 351 0.0 0.0 11964 5764 pts/3 Ss+ 17:45 0:00 -zsh
zaphod 601 0.0 0.0 10612 3236 pts/2 R+ 18:24 0:00 ps aux
The ps aux command displays more useful information than other similar options. For example, the UID column is replaced with a human-readable username column. ps aux also provides statistics about your Linux system, such as the percentage of CPU and memory usage by the process. The VSZ column displays the amount of virtual memory being consumed, while RSS displays the actual physical memory being used. The START column shows the date or time when the process was started, which is different from the CPU time reported by the TIME column.
Next Steps
The ps command has many other options available. For example, you can customize output columns to view system data in a preferred format. You can filter based on the user, process name, or terminal. You can also tell ps to print its output more verbosely and to ignore your screen width. To learn more about ps and its capabilities, read its man-page on your Linux system.
man ps
Use top as an Alternative to the ps Command
The top command is a useful tool for monitoring your system’s processes. One benefit of the top command is that it updates its values and statistics in real time. You can also sort its output by CPU usage and use its semi-graphical UI to kill a process. To learn more about the top command, check out the “Using top to Monitor Server Performance” guide.