Linux process memory usage: How to sort ‘ps’ command output

Unix/Linux ps command FAQ: Can you share some examples of how to sort the Linux ps command output?

Sure. In this article I’ll show how to sort the Linux ps command output, without using the Linux sort command.

The `ps --sort` option

Before I get into the examples, it’s important to note that the Linux ps command supports a --sort argument, and that argument takes a number of key values, and those keys allow you to sort the ps output.

Here’s a quick look at the --sort information from the ps command man page:

--sort spec  specify sorting order. Sorting syntax is [+|-]key[,[+|-]key[,...]] 
             Choose a multi-letter key from the STANDARD FORMAT SPECIFIERS section. 
             The "+" is optional since default direction is increasing numerical or 
             lexicographic order. Identical to k. For example:

             ps jax --sort=uid,-ppid,+pid

Sort Linux `ps` output by memory (RAM), from high to low

Given that little piece of background information, here's how we can sort the ps command output by memory usage:

ps aux --sort -rss

That ps command gives me this output:

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
mysql     2897  0.0  1.7 136700 17952 ?        Sl   Oct21   0:00 /usr/libexec/mysqld --basedir=/usr --datadir=/var/lib/mysq
root      2483  0.0  1.0  43540 11368 ?        Ssl  Oct21   0:00 /usr/bin/python -E /usr/sbin/setroubleshootd
root      3124  0.0  0.9  25816 10332 ?        SN   Oct21   0:00 /usr/bin/python -tt /usr/sbin/yum-updatesd
root      2406  0.0  0.9  11572 10004 ?        Ss   Oct21   0:00 /usr/sbin/restorecond
root      2928  0.0  0.6  17648  7120 ?        Ss   Oct21   0:00 /usr/local/apache2/bin/httpd -k start
nobody    2949  0.0  0.6  17648  6492 ?        S    Oct21   0:00 /usr/local/apache2/bin/httpd -k start
nobody    2950  0.0  0.6  17648  6492 ?        S    Oct21   0:00 /usr/local/apache2/bin/httpd -k start
nobody    2951  0.0  0.6  17648  6492 ?        S    Oct21   0:00 /usr/local/apache2/bin/httpd -k start
nobody    2952  0.0  0.6  17648  6492 ?        S    Oct21   0:00 /usr/local/apache2/bin/httpd -k start
nobody    2953  0.0  0.6  17648  6492 ?        S    Oct21   0:00 /usr/local/apache2/bin/httpd -k start
68        3115  0.0  0.3   5920  3912 ?        Ss   Oct21   0:01 hald
root     18453  0.0  0.2  10140  2884 ?        Ss   11:09   0:00 sshd: root@pts/0 
root      2801  0.0  0.2  10020  2328 ?        Ss   Oct21   0:00 cupsd
root      2959  0.0  0.1   9072  1876 ?        Ss   Oct21   0:00 sendmail: accepting connections
root       475  0.0  0.1   3004  1600 ?        S<s  Oct21   0:00 /sbin/udevd -d

As you can see, this prints the ps output with the largest RSS size at the top of the output. (There are also many more lines than this, I just trimmed the output.)

To reverse this output and show the largest RSS value at the bottom of the ps command output, just take the "-" sign off the rss sort argument, like this:

ps aux --sort rss

How to sort `ps` output by pid

To sort the output of the ps command by pid, we'd issue one of the following two commands. First, to sort by pid, in order from highest PID to lowest, we'd use this ps command:

ps aux --sort -pid

And to sort by pid, from low to high, again we remove the "-" from our argument:

ps aux --sort pid

GNU `ps` command sorting specifiers

There are many, many more ways to sort ps command output, and you can find all of them in the Linux ps command man page. I've trimmed down some of the output from the ps man page to show what I think the most important sort keys are. Here is that information, along with a little introductory information:

STANDARD FORMAT SPECIFIERS

Here are the different keywords that may be used to control the output format (e.g. with option -o) or to sort the
selected processes with the GNU-style --sort option.

For example:  ps -eo pid,user,args --sort user

This version of ps tries to recognize most of the keywords used in other implementations of ps.

The following user-defined format specifiers may contain spaces: args, cmd, comm, command, fname, ucmd, ucomm, lstart,
bsdstart, start.

Some keywords may not be available for sorting.

CODE       HEADER   DESCRIPTION

%cpu       %CPU     cpu utilization of the process in "##.#" format. Currently, it is the CPU time used divided by the
                    time the process has been running (cputime/realtime ratio), expressed as a percentage. It will not
                    add up to 100% unless you are lucky. (alias pcpu).

%mem       %MEM     ratio of the process’s resident set size  to the physical memory on the machine, expressed as a
                    percentage. (alias pmem).

bsdstart   START    time the command started. If the process was started less than 24 hours ago, the output format is
                    " HH:MM", else it is "mmm dd" (where mmm is the three letters of the month).

bsdtime    TIME     accumulated cpu time, user + system. The display format is usually "MMM:SS", but can be shifted to
                    the right if the process used more than 999 minutes of cpu time.

c          C        processor utilization. Currently, this is the integer value of the percent usage over the lifetime
                    of the process. (see %cpu).

comm       COMMAND  command name (only the executable name). Modifications to the command name will not be shown.
                    A process marked <defunct> is partly dead, waiting to be fully destroyed by its parent. The output
                    in this column may contain spaces. (alias ucmd, ucomm). See also the args format keyword, the -f
                    option, and the c option.
                    When specified last, this column will extend to the edge of the display. If ps can not determine
                    display width, as when output is redirected (piped) into a file or another command, the output
                    width is undefined. (it may be 80, unlimited, determined by the TERM variable, and so on) The
                    COLUMNS environment variable or --cols option may be used to exactly determine the width in this
                    case. The w or -w option may be also be used to adjust width.

command    COMMAND  see args. (alias args, cmd).

cp         CP       per-mill (tenths of a percent) CPU usage. (see %cpu).

cputime    TIME     cumulative CPU time, "[dd-]hh:mm:ss" format. (alias time).

egroup     EGROUP   effective group ID of the process. This will be the textual group ID, if it can be obtained and
                    the field width permits, or a decimal representation otherwise. (alias group).

etime      ELAPSED  elapsed time since the process was started, in the form [[dd-]hh:]mm:ss.

euid       EUID     effective user ID. (alias uid).

euser      EUSER    effective user name. This will be the textual user ID, if it can be obtained and the field width
                    permits, or a decimal representation otherwise. The n option can be used to force the decimal
                    representation. (alias uname, user).

gid        GID      see egid. (alias egid).

lstart     STARTED  time the command started.

ni         NI       nice value. This ranges from 19 (nicest) to -20 (not nice to others), see nice(1). (alias nice).

pcpu       %CPU     see %cpu. (alias %cpu).

pgid       PGID     process group ID or, equivalently, the process ID of the process group leader. (alias pgrp).

pid        PID      process ID number of the process.

pmem       %MEM     see %mem. (alias %mem).

ppid       PPID     parent process ID.

rss        RSS      resident set size, the non-swapped physical memory that a task has used (in kiloBytes).
                    (alias rssize, rsz).

ruid       RUID     real user ID.

size       SZ       approximate amount of swap space that would be required if the process were to dirty all writable
                    pages and then be swapped out. This number is very rough!

start      STARTED  time the command started. If the process was started less than 24 hours ago, the output format is
                    "HH:MM:SS", else it is "  mmm dd" (where mmm is a three-letter month name).

sz         SZ       size in physical pages of the core image of the process. This includes text, data, and stack
                    space. Device mappings are currently excluded; this is subject to change. See vsz and rss.

time       TIME     cumulative CPU time, "[dd-]hh:mm:ss" format. (alias cputime).

tname      TTY      controlling tty (terminal). (alias tt, tty).

vsz        VSZ      virtual memory size of the process in KiB (1024-byte units). Device mappings are currently
                    excluded; this is subject to change. (alias vsize).

As you can see, there are a lot of sorting options with the ps command, even though I've trimmed down this list significantly.