# ps — Inspect Running Processes > Practical guide to ps — snapshot running processes, sort by CPU and memory, filter by user or PID and analyse them with custom output columns. Source: https://www.jpkc.com/db/en/cheatsheets/shell-system/ps/ ps reports a one-off snapshot of every process running on your system at that instant – process ID, owner, CPU and memory usage, parent relationships and the full command line. Unlike top or htop it doesn't refresh live; it freezes a single moment, which makes it perfect for scripts, logs and targeted analysis. The one early hurdle is its two syntax styles: BSD (`ps aux`, no leading dash) alongside UNIX/POSIX (`ps -ef`). This guide untangles both and shows you the invocations that matter day to day. ## Basic Usage `ps` — Show processes running in the current terminal session. ```bash ps ``` `ps aux` — Show all processes from all users with detailed information (BSD syntax). ```bash ps aux ``` `ps -ef` — Show all processes with full format listing (UNIX/POSIX syntax). ```bash ps -ef ``` `ps -eF` — Show all processes with extra full format (includes memory size). ```bash ps -eF ``` `ps aux --sort=-%mem` — Show all processes sorted by memory usage (highest first). ```bash ps aux --sort=-%mem | head -20 ``` `ps aux --sort=-%cpu` — Show all processes sorted by CPU usage (highest first). ```bash ps aux --sort=-%cpu | head -20 ``` ## Filtering Processes `ps -p ` — Show information about a specific process by PID. ```bash ps -p 1234 ``` `ps -u ` — Show all processes owned by a specific user. ```bash ps -u www-data ``` `ps -C ` — Show processes by command name. ```bash ps -C nginx ``` `ps aux | grep ` — Search for processes matching a pattern. ```bash ps aux | grep '[n]ginx' ``` `ps -g ` — Show all processes in a session or effective group. ```bash ps -g 1000 ``` `ps -t ` — Show processes attached to a specific terminal. ```bash ps -t pts/0 ``` ## Output Formatting `ps -eo ` — Show all processes with custom output columns. ```bash ps -eo pid,ppid,user,%cpu,%mem,cmd ``` `ps -eo pid,ppid,user,%cpu,%mem,vsz,rss,stat,start,time,cmd` — Comprehensive process listing with all key fields. ```bash ps -eo pid,ppid,user,%cpu,%mem,vsz,rss,stat,start,time,cmd --sort=-%mem ``` `ps -eo pid,cmd --sort=pid` — List all PIDs and their commands, sorted by PID. ```bash ps -eo pid,cmd --sort=pid ``` `ps -eo pid,ppid,pgid,sid,cmd` — Show process hierarchy IDs (parent, group, session). ```bash ps -eo pid,ppid,pgid,sid,cmd ``` `ps -o pid,ni,pri,cmd` — Show process priority and nice value. ```bash ps -eo pid,ni,pri,cmd --sort=-ni ``` ## Process Tree `ps axjf` — Show processes in a tree format (forest view). ```bash ps axjf ``` `ps -ef --forest` — Show process tree with full format (GNU ps). ```bash ps -ef --forest ``` `pstree` — Display processes as a tree (separate command, often pre-installed). ```bash pstree -p ``` `pstree -u ` — Show process tree for a specific user. ```bash pstree -u www-data ``` `pstree -p ` — Show the process tree rooted at a specific PID. ```bash pstree -p 1234 ``` ## Process States `R` — Running or runnable (on run queue). ```bash ps aux | awk '$8 ~ /R/' ``` `S` — Interruptible sleep (waiting for an event). ```bash ps aux | awk '$8 ~ /S/' ``` `D` — Uninterruptible sleep (usually waiting for I/O). Cannot be killed with SIGKILL. ```bash ps aux | awk '$8 ~ /D/' ``` `T` — Stopped (by a signal or being traced/debugged). ```bash ps aux | awk '$8 ~ /T/' ``` `Z` — Zombie process (terminated but not reaped by parent). ```bash ps aux | awk '$8 ~ /Z/' ``` `I` — Idle kernel thread. ```bash ps aux | awk '$8 ~ /I/' ``` ## Useful Patterns `ps aux | grep '[n]ginx'` — Find processes by name without showing the grep process itself. ```bash ps aux | grep '[p]hp-fpm' ``` `ps -eo pid,%cpu,%mem,cmd --sort=-%cpu | head -10` — Top 10 processes by CPU usage. ```bash ps -eo pid,%cpu,%mem,cmd --sort=-%cpu | head -10 ``` `ps -eo pid,%mem,rss,cmd --sort=-rss | head -10` — Top 10 processes by memory (RSS) usage. ```bash ps -eo pid,%mem,rss,cmd --sort=-rss | head -10 ``` `ps -eo stat | grep -c Z` — Count zombie processes. ```bash ps -eo stat | grep -c Z ``` `ps -eo user | sort | uniq -c | sort -rn` — Count processes per user. ```bash ps -eo user | sort | uniq -c | sort -rn ``` `ps -p -o etimes=` — Show elapsed time in seconds for a specific process. ```bash ps -p 1234 -o etimes= ``` `ps -eo pid,lstart,cmd | grep ` — Show the exact start time of a process. ```bash ps -eo pid,lstart,cmd | grep nginx ``` `ps -eo pid,ppid,cmd | awk '$2 == 1'` — Find all processes with init (PID 1) as parent. ```bash ps -eo pid,ppid,cmd | awk '$2 == 1' ``` ## Column Reference `pid` — Process ID. ```bash ps -eo pid,cmd ``` `ppid` — Parent process ID. ```bash ps -eo pid,ppid,cmd ``` `%cpu / %mem` — CPU and memory usage percentage. ```bash ps -eo pid,%cpu,%mem,cmd ``` `vsz / rss` — Virtual memory size / Resident Set Size (physical memory) in KB. ```bash ps -eo pid,vsz,rss,cmd ``` `stat` — Process state code (R, S, D, T, Z, etc.). ```bash ps -eo pid,stat,cmd ``` `start / lstart` — Short / full start time of the process. ```bash ps -eo pid,lstart,cmd ``` `time / etimes` — Cumulative CPU time / elapsed time in seconds. ```bash ps -eo pid,time,etimes,cmd ``` `ni` — Nice value (-20 to 19, lower = higher priority). ```bash ps -eo pid,ni,cmd ``` `tty` — Controlling terminal. ```bash ps -eo pid,tty,cmd ``` `args / cmd` — Full command with all arguments. ```bash ps -eo pid,args ``` ## Conclusion ps is a read-only command and therefore harmless: it changes nothing and only reports. For everyday work a handful of invocations cover most needs – `ps aux` for the full picture, `ps aux --sort=-%cpu` or `--sort=-%mem` to hunt down resource hogs, and `ps -o pid,ppid,cmd` for tailored columns. Keep the classic `ps aux | grep nginx` in your toolkit (with the `'[n]ginx'` trick so grep doesn't match itself), though `pgrep` is more precise for pure name lookups. And remember: ps only ever shows a snapshot – for a continuous live view reach for top or htop. ## Further Reading - [ps(1) manual page](https://man7.org/linux/man-pages/man1/ps.1.html) – the complete procps-ng reference with every option and format specifier - [Wikipedia: ps (Unix)](https://en.wikipedia.org/wiki/Ps_(Unix)) – background on the history and the BSD vs UNIX syntax styles ## Related Commands - [top](https://www.jpkc.com/db/en/cheatsheets/shell-system/top/) – monitor processes and resources live in the terminal - [htop](https://www.jpkc.com/db/en/cheatsheets/shell-system/htop/) – interactive, colourful process monitor and a comfortable top alternative - [kill](https://www.jpkc.com/db/en/cheatsheets/shell-system/kill/) – terminate processes by PID by sending them a signal