30 Useful ‘ps Command’ Examples for Linux Process Monitoring

ps (processes status) is a native Unix/Linux utility for viewing information concerning a selection of running processes on a system: it reads this information from the virtual files in /proc filesystem. It is one of the important utilities for system administration specifically under process monitoring, to help you understand whats is going on a Linux system.

 

It has numerous options for manipulating its output, however, you’ll find a small number of them practically useful for daily usage.

 

Note that ps produces output with a heading line, which represents the meaning of each column of information, you can find the meaning of all the labels in the ps man page.

 

List All Processes in Current Shell

 

1. If you run ps command without any arguments, it displays processes for the current shell.

$ ps 

 

Print All Processes in Different Formats

 

2. Display every active process on a Linux system in generic (Unix/Linux) format.

$ ps -A
OR
$ ps -e

 

3. Display all processes in BSD format.

$ ps au
OR
$ ps axu

 

4. To perform a full-format listing, add the -f or -F flag.

$ ps -ef
OR
$ ps -eF

 

Display User Running Processes

 

5. You can select all processes owned by you (runner of the ps command, root in this case), type:

$ ps -x 

 

6. To display a user’s processes by real user ID (RUID) or name, use the -U flag.

$ ps -fU rootadminz
OR
$ ps -fu 1000

 

7. To select a user’s processes by effective user ID (EUID) or name, use the -u option.

$ ps -fu rootadminz
OR
$ ps -fu 1000

 

Print All Processes Running as Root (Real and Effecitve ID)

 

8. The command below enables you to view every process running with root user privileges (real & effective ID) in user format.

$ ps -U root -u root 

 

Display Group Processes

 

9. If you want to list all processes owned by a certain group (real group ID (RGID) or name), type.

$ ps -fG apache
OR
$ ps -fG 48

 

10. To list all processes owned by effective group name (or session), type.

$ ps -fg apache

 

Display Processes by PID and PPID

 

11. You can list processes by PID as follows.

$ ps -fp 1178

 

12. To select process by PPID, type.

$ ps -f --ppid 1154

 

13. Make selection using PID list.

$ ps -fp 2226,1154,1146

 

Display Processes by TTY

 

14. To select processes by tty, use the -t flag as follows.

$ ps -t pst/0
$ ps -t pst/1
$ ps -ft tty1

 

Print Process Tree

 

15. A process tree shows how processes on the system are linked to each other; processes whose parents have been killed are adopted by the init (or systemd).

$ ps -e --forest 

 

16. You can also print a process tree for a given process like this.

$ ps -f --forest -C sshd
OR
$ ps -ef --forest | grep -v grep | grep sshd 

 

Print Process Threads

 

17. To print all threads of a process, use the -H flag, this will show the LWP (light weight process) as well as NLWP (number of light weight process) columns.

$ ps -fL -C httpd

 

Specify Custom Output Format

 

Using the -o or –format options, ps allows you to build user-defined output formats as shown below.

 

18. To list all format specifiers, include the L flag.

$ ps L

 

19. The command below allows you to view the PID, PPID, user name and command of a process.

$ ps -eo pid,ppid,user,cmd

 

20. Below is another example of a custom output format showing file system group, nice value, start time and elapsed time of a process.

$ ps -p 1154 -o pid,ppid,fgroup,ni,lstart,etime

 

21. To find a process name using its PID.

$ ps -p 1154 -o comm=

 

Display Parent and Child Processes

 

22. To select a specific process by its name, use the -C flag, this will also display all its child processes.

$ ps -C sshd

 

23. Find all PIDs of all instances of a process, useful when writing scripts that need to read PIDs from a std output or file.

$ ps -C httpd -o pid=

 

24. Check execution time of a process.

$ ps -eo comm,etime,user | grep httpd

 

Troubleshoot Linux System Performance

 

If your system isn’t working as it should be, for instance if it’s unusually slow, you can perform some system troubleshooting as follows.

 

26. Find top running processes by highest memory and CPU usage in Linux.

$ ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%mem | head
OR
$ ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%cpu | head

 

27. To kill an Linux processes/unresponsive applications or any process that is consuming high CPU time.

 

First, find the PID of the unresponsive process or application.

$ ps -A | grep -i stress

 

Then use the kill command to terminate it immediately.

$ kill -9 2583 2584

 

Print Security Information

 

28. Show security context (specifically for SELinux) like this.

$ ps -eM
OR
$ ps --context

 

29. You can also display security information in user-defined format with this command.

$ ps -eo  euser,ruser,suser,fuser,f,comm,label

 

Perform Real-time Process Monitoring Using Watch Utility

 

30. Finally, since ps displays static information, you can employ the watch utility to perform real-time process monitoring with repetitive output, displayed after every second as in the command below (specify a custom ps command to achieve your objective).

$ watch -n 1 'ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%mem | head'

 

Was this answer helpful? 0 Users Found This Useful (0 Votes)