Unix/Linux processes FAQ: Can you share some examples of the Linux ps command? (Or, how do I use theps command?)
The basic Linux ps command
If you run the ps command by itself, it only shows very basic information about the processes you are currently running. For example, if you issue the basic command like this without any arguments:
ps
you'll see output from this command looks something like this:
PID TTY TIME CMD 4343 ttys000 0:00.35 -bash 2617 ttys001 0:00.65 -bash 18201 ttys003 0:00.27 -bash
The PID column shows the process-id, the second column shows the TTY (terminal) the process is attached to, the TIME column shows how much CPU time the process has used, and the CMD column shows the command that is running. In this case I can tell (from experience) that I have three bash shells (terminals) running on my current system.
In practice I never run the ps command without any arguments like this, but I wanted to show this to help us get started.
There are many ways to customize the output of the ps command. For instance, I can add the f argument to get "full" information about each process. Used by itself, the f argument shows "full" information about just my processes. As an example, this command:
ps -f
leads to this output:
UID PID PPID C STIME TTY TIME CMD 501 4343 4342 0 0:00.18 ttys000 0:00.35 -bash 501 2617 2616 0 0:00.41 ttys001 0:00.66 -bash 501 18201 18200 0 0:00.15 ttys003 0:00.27 -bash
As you can see this adds a few more columns of output to my ps command, including UID (user-id), PPID (parent process-id), and a couple of other columns I don't really look at.
Showing information about every process
As mentioned, those two ps command examples just show information about your processes. If you're a Linux system administrator, you're typically interested in information about all the processes running on the system. To show every process running on the system, we add the e argument to our previous ps command, like this:
ps -ef
This leads to much more output:
UID PID PPID C STIME TTY TIME CMD root 1 0 0 Oct21 ? 00:00:01 init [3] root 2 1 0 Oct21 ? 00:00:00 [migration/0] root 3 1 0 Oct21 ? 00:00:00 [ksoftirqd/0] root 4 1 0 Oct21 ? 00:00:00 [watchdog/0] root 5 1 0 Oct21 ? 00:00:00 [migration/1] root 6 1 0 Oct21 ? 00:00:00 [ksoftirqd/1] root 7 1 0 Oct21 ? 00:00:00 [watchdog/1] root 8 1 0 Oct21 ? 00:00:00 [events/0] root 9 1 0 Oct21 ? 00:00:00 [events/1] root 10 1 0 Oct21 ? 00:00:00 [khelper] root 11 1 0 Oct21 ? 00:00:00 [kthread] root 15 11 0 Oct21 ? 00:00:00 [kblockd/0] root 16 11 0 Oct21 ? 00:00:00 [kblockd/1] root 17 11 0 Oct21 ? 00:00:00 [kacpid] root 91 11 0 Oct21 ? 00:00:00 [cqueue/0] root 92 11 0 Oct21 ? 00:00:00 [cqueue/1] root 95 11 0 Oct21 ? 00:00:00 [khubd] root 97 11 0 Oct21 ? 00:00:00 [kseriod] root 158 11 0 Oct21 ? 00:00:00 [pdflush]
That was actually just the first 20 lines of output from this ps command on my CentOS Linux test system. This command actually generated 99 lines of output, and I cropped it to just show the first 20 lines (using ps -ef | head -20).
As mentioned, that's the older way to list processes on a Unix system (and it may still be preferred on Unix systems like HP-UX, AIX, and Solaris; I don't really know, I just use Linux and Mac OS X these days). I wanted to show these options to you (a) to help you learn about the ps command, and (b) see that there are other ps command options than what most people use on a day to day basis. Given that background, let's take a look at how the ps command is typically used on Linux systems.
How the Linux ps command is typically used
Now that you've seen some ps command arguments and sample output, here's how I run the ps command about 80% of the time:
ps auxwww | more
The first 20 lines of output from this command look like this:
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.0 2064 620 ? Ss Oct21 0:01 init [3] root 2 0.0 0.0 0 0 ? S< Oct21 0:00 [migration/0] root 3 0.0 0.0 0 0 ? SN Oct21 0:00 [ksoftirqd/0] root 4 0.0 0.0 0 0 ? S< Oct21 0:00 [watchdog/0] root 5 0.0 0.0 0 0 ? S< Oct21 0:00 [migration/1] root 6 0.0 0.0 0 0 ? SN Oct21 0:00 [ksoftirqd/1] root 7 0.0 0.0 0 0 ? S< Oct21 0:00 [watchdog/1] root 8 0.0 0.0 0 0 ? S< Oct21 0:00 [events/0] root 9 0.0 0.0 0 0 ? S< Oct21 0:00 [events/1] root 10 0.0 0.0 0 0 ? S< Oct21 0:00 [khelper] root 11 0.0 0.0 0 0 ? S< Oct21 0:00 [kthread] root 15 0.0 0.0 0 0 ? S< Oct21 0:00 [kblockd/0] root 16 0.0 0.0 0 0 ? S< Oct21 0:00 [kblockd/1] root 17 0.0 0.0 0 0 ? S< Oct21 0:00 [kacpid] root 91 0.0 0.0 0 0 ? S< Oct21 0:00 [cqueue/0] root 92 0.0 0.0 0 0 ? S< Oct21 0:00 [cqueue/1] root 95 0.0 0.0 0 0 ? S< Oct21 0:00 [khubd] root 97 0.0 0.0 0 0 ? S< Oct21 0:00 [kseriod] root 158 0.0 0.0 0 0 ? S Oct21 0:00 [pdflush]
As you can see, this output is similar to the earlier output, but the columns are different. Before I talk about these ps command arguments, let me show a few more examples. Here's how I look at all httpd processes running on my Linux system:
$ ps auxwww | grep http root 2928 0.0 0.6 17648 7120 ? Ss Oct21 0:00 /usr/local/apache2/bin/httpd -k start nobody 2949 0.0 0.6 17648 6492 ? S Oct21 0:00 /usr/local/apache2/bin/httpd -k start nobody 2950 0.0 0.6 17648 6492 ? S Oct21 0:00 /usr/local/apache2/bin/httpd -k start nobody 2951 0.0 0.6 17648 6492 ? S Oct21 0:00 /usr/local/apache2/bin/httpd -k start nobody 2952 0.0 0.6 17648 6492 ? S Oct21 0:00 /usr/local/apache2/bin/httpd -k start nobody 2953 0.0 0.6 17648 6492 ? S Oct21 0:00 /usr/local/apache2/bin/httpd -k start root 18508 0.0 0.0 3916 688 pts/0 S+ 11:12 0:00 grep http
Here's how I list all my mysql processes:
$ ps auxwww | grep mysql root 2837 0.0 0.1 4528 1236 ? S Oct21 0:00 /bin/sh /usr/bin/mysqld_safe --datadir=/var/lib/mysql --socket=/var/lib/mysql/mysql.sock --log-error=/var/log/mysqld.log --pid-file=/var/run/mysqld/mysqld.pid mysql 2897 0.0 1.7 136700 17952 ? Sl Oct21 0:00 /usr/libexec/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql --pid-file=/var/run/mysqld/mysqld.pid --skip-external-locking --socket=/var/lib/mysql/mysql.sock root 18510 0.0 0.0 3916 712 pts/0 S+ 11:13 0:00 grep mysql
Now that you've seen a few ps command examples, this is what the arguments to this ps command mean:
- The
aargument means "show all processes", not just my processes. (There's a bit more to it than that, but this is usually close enough.) - The
uargument adds "user information" columns to the output. (Try your ps command without the 'u', and you'll see a major difference in the columns that are displayed.) - The
xlifts the BSD-style "must have a tty" restriction, meaning it will show processes that are not associated with a terminal (tty)> - The
wmeans "wide output". Use this option twice for unlimited width.
Examples from the Linux ps command man page
My intention for this article was to help get a new Unix or Linux user get started with the ps command. Before going, there are two more things I want to share with you.
First, there are many different variations of the ps command that you can use if you want to. For instance, I just looked at the Linux ps man page, and found these examples:
EXAMPLES To see every process on the system using standard syntax: ps -e ps -ef ps -eF ps -ely To see every process on the system using BSD syntax: ps ax ps axu To print a process tree: ps -ejH ps axjf To get info about threads: ps -eLf ps axms To get security info: ps -eo euser,ruser,suser,fuser,f,comm,label ps axZ ps -eM To see every process running as root (real & effective ID) in user format: ps -U root -u root u To see every process with a user-defined format: ps -eo pid,tid,class,rtprio,ni,pri,psr,pcpu,stat,wchan:14,comm ps axo stat,euid,ruid,tty,tpgid,sess,pgrp,ppid,pid,pcpu,comm ps -eopid,tt,user,fname,tmout,f,wchan Print only the process IDs of syslogd: ps -C syslogd -o pid= Print only the name of PID 42: ps -p 42 -o comm=
As you can see, there are a lot of different ways to issue a ps command, and I try to show some of those in this other tutorial on how to sort Linux ps command output.
The second thing I want to mention is the Linux top command.
The Unix and Linux top command
Unix and Linux systems now include a nice interactive utility for looking at process information. The Linux top command displays a character-based screen of all processes running on the current system. The screen updates itself every few seconds, and you can sort the screen contents by characteristics like CPU Usage or Memory Use.
I show how to use the top command in this Unix/Linux top command tutorial, which includes several screenshots of the top command running on a Linux system.
books by alvin
 |
 |
 |
 |