Using ps Command

Using the ps Command

ps (process status) displays a snapshot of currently running processes. It reads from the /proc filesystem and presents the information in a structured way. Despite having seemingly redundant options (BSD-style vs UNIX-style flags), knowing a handful of key invocations covers 95% of what you need for process investigation.

ps output format options

# Most common: show all processes, user-oriented format
ps aux

ps aux column explanation

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
mysql     1234  2.5  5.3 1234567 89012 ?       Sl   Jun01  45:23 /usr/sbin/mysqld
#          ↑    ↑    ↑     ↑     ↑              ↑             ↑
#         PID  CPU  MEM  VIRT  RSS           STATE         CPU time used

Common ps invocations

# Show ALL processes on the system
ps aux
ps -ef    # Alternative: shows PPID too

# Show processes for a specific user
ps -u irfan
ps aux | grep "^irfan"

# Show a specific PID
ps -p 1234
ps -p 1234,5678,9012    # Multiple PIDs

# Show process tree (hierarchical)
ps auxf    # BSD style with forest view
ps -ef --forest    # UNIX style with tree

Custom output with -o

# Build exactly the output you need with -o
# Common field names: pid, ppid, user, group, comm, args, %cpu, %mem,
#                     rss, vsz, stat, lstart, etime, time, nice

# Show PID, parent PID, user, and command
ps -eo pid,ppid,user,comm

# Show processes with memory sorted by RSS
ps -eo pid,user,rss,vsz,comm --sort=-rss | head -10

# Show start time and elapsed time
ps -eo pid,user,lstart,etime,comm | head -10

# Show thread count
ps -eo pid,user,thcount,comm | sort -k3 -rn | head -10

ps with custom fields sorted by memory

  PID USER        RSS    VSZ COMMAND
 1234 mysql     89012 987654 mysqld
 5678 postgres  45678 456789 postgres
12345 root      23456 234567 java

Sorting and filtering

# Sort by CPU usage (highest first)
ps aux --sort=-%cpu | head -15

# Sort by memory usage (highest first)
ps aux --sort=-%mem | head -15

# Sort by start time (newest first)
ps aux --sort=-start | head -10

# Find processes by name
ps aux | grep nginx
ps -C nginx    # UNIX style, -C matches command name

# Find processes containing specific string in arguments
ps aux | grep "python.*manage.py"

# Exclude the grep itself
ps aux | grep "nginx" | grep -v grep

ps for specific investigations

# Investigation: which processes are using the most CPU?
ps aux --sort=-%cpu | head -10

# Investigation: what is PID 1234 doing?
ps -p 1234 -o pid,ppid,user,stat,start,time,etime,args

# Investigation: find all child processes of nginx (PPID = nginx PID)
NGINX_PID=$(pidof nginx | awk '{print $1}')
ps --ppid $NGINX_PID

# Investigation: how long has a process been running?
ps -p 1234 -o etime=

# Investigation: find processes using more than 1 GB of RAM
ps aux | awk '$6 > 1048576 {printf "%.1f GB  %s  %s
", $6/1024/1024, $2, $11}'

# Investigation: find processes that are zombie
ps aux | awk '$8 ~ /^Z/ {print $1, $2, $11}'

Conclusion

Know three ps invocations by heart: ps aux for a full snapshot, ps aux --sort=-%cpu | head -15 for top CPU consumers, and ps -p PID -o pid,ppid,user,stat,start,etime,args for investigating a specific process. Use -o to build custom output when you need specific fields. Combine with grep for filtering, but remember to use ps -C processname (UNIX style) or pgrep to find by name without filtering your own grep from the results.