ps — Inspect Running Processes

ps reports a one-off snapshot of every process running on your system at that instant – process ID, owner, CPU and memory usage, parent relationships and the full command line. Unlike top or htop it doesn't refresh live; it freezes a single moment, which makes it perfect for scripts, logs and targeted analysis. The one early hurdle is its two syntax styles: BSD (ps aux, no leading dash) alongside UNIX/POSIX (ps -ef). This guide untangles both and shows you the invocations that matter day to day.

Basic Usage

ps — Show processes running in the current terminal session.

ps

ps aux — Show all processes from all users with detailed information (BSD syntax).

ps aux

ps -ef — Show all processes with full format listing (UNIX/POSIX syntax).

ps -ef

ps -eF — Show all processes with extra full format (includes memory size).

ps -eF

ps aux --sort=-%mem — Show all processes sorted by memory usage (highest first).

ps aux --sort=-%mem | head -20

ps aux --sort=-%cpu — Show all processes sorted by CPU usage (highest first).

ps aux --sort=-%cpu | head -20

Filtering Processes

ps -p <pid> — Show information about a specific process by PID.

ps -p 1234

ps -u <user> — Show all processes owned by a specific user.

ps -u www-data

ps -C <name> — Show processes by command name.

ps -C nginx

ps aux | grep <pattern> — Search for processes matching a pattern.

ps aux | grep '[n]ginx'

ps -g <group> — Show all processes in a session or effective group.

ps -g 1000

ps -t <tty> — Show processes attached to a specific terminal.

ps -t pts/0

Output Formatting

ps -eo <columns> — Show all processes with custom output columns.

ps -eo pid,ppid,user,%cpu,%mem,cmd

ps -eo pid,ppid,user,%cpu,%mem,vsz,rss,stat,start,time,cmd — Comprehensive process listing with all key fields.

ps -eo pid,ppid,user,%cpu,%mem,vsz,rss,stat,start,time,cmd --sort=-%mem

ps -eo pid,cmd --sort=pid — List all PIDs and their commands, sorted by PID.

ps -eo pid,cmd --sort=pid

ps -eo pid,ppid,pgid,sid,cmd — Show process hierarchy IDs (parent, group, session).

ps -eo pid,ppid,pgid,sid,cmd

ps -o pid,ni,pri,cmd — Show process priority and nice value.

ps -eo pid,ni,pri,cmd --sort=-ni

Process Tree

ps axjf — Show processes in a tree format (forest view).

ps axjf

ps -ef --forest — Show process tree with full format (GNU ps).

ps -ef --forest

pstree — Display processes as a tree (separate command, often pre-installed).

pstree -p

pstree -u <user> — Show process tree for a specific user.

pstree -u www-data

pstree -p <pid> — Show the process tree rooted at a specific PID.

pstree -p 1234

Process States

R — Running or runnable (on run queue).

ps aux | awk '$8 ~ /R/'

S — Interruptible sleep (waiting for an event).

ps aux | awk '$8 ~ /S/'

D — Uninterruptible sleep (usually waiting for I/O). Cannot be killed with SIGKILL.

ps aux | awk '$8 ~ /D/'

T — Stopped (by a signal or being traced/debugged).

ps aux | awk '$8 ~ /T/'

Z — Zombie process (terminated but not reaped by parent).

ps aux | awk '$8 ~ /Z/'

I — Idle kernel thread.

ps aux | awk '$8 ~ /I/'

Useful Patterns

ps aux | grep '[n]ginx' — Find processes by name without showing the grep process itself.

ps aux | grep '[p]hp-fpm'

ps -eo pid,%cpu,%mem,cmd --sort=-%cpu | head -10 — Top 10 processes by CPU usage.

ps -eo pid,%cpu,%mem,cmd --sort=-%cpu | head -10

ps -eo pid,%mem,rss,cmd --sort=-rss | head -10 — Top 10 processes by memory (RSS) usage.

ps -eo pid,%mem,rss,cmd --sort=-rss | head -10

ps -eo stat | grep -c Z — Count zombie processes.

ps -eo stat | grep -c Z

ps -eo user | sort | uniq -c | sort -rn — Count processes per user.

ps -eo user | sort | uniq -c | sort -rn

ps -p <pid> -o etimes= — Show elapsed time in seconds for a specific process.

ps -p 1234 -o etimes=

ps -eo pid,lstart,cmd | grep <pattern> — Show the exact start time of a process.

ps -eo pid,lstart,cmd | grep nginx

ps -eo pid,ppid,cmd | awk '$2 == 1' — Find all processes with init (PID 1) as parent.

ps -eo pid,ppid,cmd | awk '$2 == 1'

Column Reference

pid — Process ID.

ps -eo pid,cmd

ppid — Parent process ID.

ps -eo pid,ppid,cmd

%cpu / %mem — CPU and memory usage percentage.

ps -eo pid,%cpu,%mem,cmd

vsz / rss — Virtual memory size / Resident Set Size (physical memory) in KB.

ps -eo pid,vsz,rss,cmd

stat — Process state code (R, S, D, T, Z, etc.).

ps -eo pid,stat,cmd

start / lstart — Short / full start time of the process.

ps -eo pid,lstart,cmd

time / etimes — Cumulative CPU time / elapsed time in seconds.

ps -eo pid,time,etimes,cmd

ni — Nice value (-20 to 19, lower = higher priority).

ps -eo pid,ni,cmd

tty — Controlling terminal.

ps -eo pid,tty,cmd

args / cmd — Full command with all arguments.

ps -eo pid,args

Conclusion

ps is a read-only command and therefore harmless: it changes nothing and only reports. For everyday work a handful of invocations cover most needs – ps aux for the full picture, ps aux --sort=-%cpu or --sort=-%mem to hunt down resource hogs, and ps -o pid,ppid,cmd for tailored columns. Keep the classic ps aux | grep nginx in your toolkit (with the '[n]ginx' trick so grep doesn't match itself), though pgrep is more precise for pure name lookups. And remember: ps only ever shows a snapshot – for a continuous live view reach for top or htop.