30 Useful Examples of Linux PS Command for Aspiring SysAdmins

The ps command is a handy utility that allows us to view important process information. A process is simply a running instance of a program. Whenever we invoke a program, some processes are created. A thorough understanding of the process tree is mandatory if you want to have full control over your machine. This is where ps comes in. It is one of the most useful terminal commands in Linux yet offers tons of crucial information. SysAdmins can use them to find faulty programs or pinpoint resource usage. This guide will provide readers a practical introduction to the ps command in Linux.

Linux PS Commands for Everyday Use

The ps command is a simple way of displaying all the active processes. However, the ps command only prints a snapshot of the selection of processes. If you want to have real-time updates on your selections, you should use the Linux top command or one of its successors. Check out the below examples to see what you can do with the Linux ps command.

1. Print Current Processes

$ ps

The output list will contain the process IDs (PID) of the processes, the terminal name associated with the processes, their cumulated CPU time, and the executable name.

2. Print All Active Processes

The above command only prints the current process list. If you want to display all the active processes, use one of the following commands instead.

$ ps -A
$ ps -e

Actually, both of these ps commands are identical. The output should contain a large number of processes. These are the child processes invoked by high-level parent processes.

3. Print Processes in BSD Format

The Linux ps command can also display process statuses in a BSD format. This is suitable for admins who manage both Linux and BSD systems as parts of their job. The following examples display the processes using this format.

$ ps aux
$ ps ax

Note that users must refrain from grouping the BSD options using dashes. The meaning of the following command is different from the one above.

$ ps -aux

4. Print Processes Using the Full Format

You can extend the output format of your ps commands and retrieve more detailed information. However, to do this, you need to use the -f or -F option. The following command displays all current processes using this full format.

$ ps -ef

Here, we are grouping the -e option with -f. This will provide some additional information like the parent process id(PPID) number and CPU utilization indicators. The -F option extends this format with slightly more data.

$ ps -eF

5. Print All Processes for Current User

The -x flag of ps allows us to display all the processes that belong to the current user. This is a simple way of determining the processes associated with your current user.

$ ps -x

This command produces a list of all active processes for the current user. It displays useful metrics like stat and time alongside PIDs and command names. A TTY value of “?” denotes that there is currently no terminal session associated with that particular process.

6. Print All Processes for Specific Users

We can also print the process list for a particular user using the -u or -U option. The following examples illustrate how they work. Simply replace the username with an existing user on your system.

$ ps -U ubuntupit
$ ps --User ubuntupit

Both of these commands are identical, and they simply print the process for the user ubuntupit. The -U or –User option selects the processes by real user ID (RUID) or name.

$ ps -u ubuntupit
$ ps --user ubuntupit

The above Linux ps commands are also identical, but contrary to the earlier examples, they select the processes by the effective user ID (EUID) or name.

7. Print All Processes for Root

You can use the ps command in Linux to find out which processes are owned by root and running with the root user’s privileges. Use the following command to find these processes using the real user ID (RUID).

$ ps -U root
$ ps --User root

Use the -u or –user option to find them by their effective user ID (EUID), as demonstrated in the below examples.

$ ps -u root
$ ps --user root

Admins can also combine both of these options in a single command. The following example prints all the processes owned by root using both their RUID and EUID.

$ ps -u root -U root

8. Print All Processes for Specific Group

The -G or -g flag of the ps command allows us to print the processes that are part of a group. For example, you can use them to pinpoint all the processes opened by anyone from a group of users. Groups in Linux refer to a set of users that have the same privileges for the particular Linux filesystem or resources.

$ ps -fG techsupport
$ ps -fG 100

These commands print the processes owned by the group tech support. The -G option uses the real group ID (RGID) or name and has a long-form called –Group. The -g option selects the processes based on the effective group ID (EGID) or name.

$ ps -fg techsupport
$ ps -fg 100

The long-form for -g is –group.

9. Print Processes Based on PID

As we have already discussed, the PID or process id is a unique identifier for each and every process on our systems. We can use this PID information for locating a specific process. The below command illustrates this using a simple example.

$ ps -p 2829
$ ps --pid 2829

This command will select the process whose PID is equal to 2829. You can also specify multiple PIDs using a comma-separated list or by using brace expansion.

$ ps -p 2890,2891,2892,2893,2894,2895

This example looks for six specific PIDs. On the other hand, the following Linux ps command looks for a range of process ids.

$ ps -p 29{1..99}

10. Print Processes Based on PPID

If you want to display the processes based on their PPID, you should use the following command. The –ppid flag of the ps utility selects processes by PPID.

$ ps --ppid 1111,1122,1133

You can specify more than one PPIDs by using either brace expansions or a comma-separated list of processes.

$ ps --ppid 2890,2891,2892,2893,2894,2895
$ ps --pid 29{1..99}

11. Print Processes Using Quick Mode

The Linux ps command supports a quick mode for selecting processes by their PIDs. In this mode, ps only reads the essential data and doesn’t use any extra filtering rules. Moreover, the PIDs printed are not sorted or preserved.

$ ps -q 2480,2532,2533
$ ps --quick-pid 2480,2532,2533

Quick mode supports multiple PIDs as well as range expansions. This is a faster operation and is suitable for locating processes within milliseconds.

12. Print Processes Based on TTY

A TTY or TeleTYpewriter denotes a terminal session that is connected to the standard input. You can select processes based on TTY by using the -t flag of ps.

$ ps -t /dev/pts/0
$ ps --tty /dev/pts/0

As you can see, ps also supports a long-form for this option. In the above command, /dev/pts/0 is terminal for my current session. You need to replace this with the tty associated with your personal session. A simpler method is to interpolate the terminal name directly from your shell, as shown below.

$ ps -t $(tty)

This will replace the tty field for your terminal. You can also group multiple tty using the range expansion methods shown earlier.

13. Print Processes for Specific Commands

As you should already notice, processes are spawned as part of a command. Whenever you run one of your favorite Linux terminal commands, it invokes several processes to do its bidding. The -C option of the ps command allows us to select processes based on the name of executables they are a part of.

$ ps -C chrome

Like most flags, the -C option also allows admins to select processes multiple commands. The following examples show a simple list example.

$ ps -C chrome,apache,gedit

However, users must not use whitespaces between the list, or else ps will fail to parse the input.

14. Print the Process Tree

The process tree shows a visual connection between the running processes on your system. This makes it very easy to visualize process relationships and interconnections. The following example shows us how to do it.

$ ps -eH

The -e option selects all processes, and -H displays the process hierarchy. You may also use the -f or –forest options. An ASCII art process hierarchy is printed for the f option and a tree for –forest.

$ ps -e f

Note the space between -e and f. Also, there is no hyphen preceding the f flag.

$ ps -e --forest

15. Print Process Tree for Specific Commands

We can easily display the connection between a Linux command and the processes associated with it by combining the -C option with one of either one of -H, f, or –forest. The below commands shows some simple examples of this for our readers.

$ ps -H -C chrome
$ ps f -C chrome

Since -C is used for process selection and -H/f for modifying the output format, these two options can not be combined.

$ ps --forest -C chrome

16. Print the Threads for a Process

The -L option of the Linux ps command allows us to display the threads associated with processes. The following example prints the threads for the process chrome.

$ ps -L -C chrome

This will provide the LWP (lightweight process) for the selected process, in this case, chrome. Use the -f option for getting more data.

$ ps -fL -C chrome

This command will display the NLWP (number of lightweight processes) alongside the LWP. You can select multiple processes by using their PID or command name.

17. Print the List of All Format Specifiers

The ps command supports a wide range of format specifiers other than PID, TTY, and CMD. You can print the entire list of all supported specifiers by using the L option.

$ ps L

Note that this option is similar to the option used for printing threads. The presence or absence of the dash symbol allows ps to parse which output you are looking for.

18. Print Specific Output Columns

The above command displays the output options available to us for ps. Now, we can select only specific information for a process by defining the output format ourselves. For example, the following commands will display the PPID, STATE, and CMD for the process chrome.

$ ps -o ppid,state,cmd -C chrome
$ ps --format ppid,state,cmd -C chrome

So, the -o or –format option allows us to select specific columns for our output. The below example prints out only the PPID information for all processes.

$ ps -eo ppid

19. Print Specific Output Columns for Selected Processes

The following example will display the PPID, state, cmd, tty, and EUID information for a specific process. We are using the PID information to locate our target process in this command.

$ ps -p 2434 -o ppid,state,cmd,tty,euid

The next example will find the same information but for a set of processes.

$ ps -p 2424,2434,2444,2454,2464 -o ppid,state,cmd,tty,euid

Remember to not put any spaces between either the PID list or in the output specification list. If you want to use whitespaces, remove the commas and place them inside double-quotes.

$ ps -p "2424 2434 2444 2454 2464" -o "ppid state cmd tty euid"

20. Print Only Process Names

Let’s say you want to know the name of a process for a specific process id and don’t want any additional information. One way of doing this is to print the process status using the PID and cut the required column using either Linux cut commands or awk. However, there is a much simpler solution to this problem.

$ ps -q 2434 -o comm=

This command will only show the process name for the PID 2434. It utilizes the quick mode for selecting that PID. You can also use -p or –pid if you want.

21. Print All PIDs for a Process

If you are writing Linux shell scripts or performing system audits, you may need to find out all pids associated with a certain process. Luckily, this is very easy to do using the Linux ps command. The following command will display all PIDs for the process chrome.

$ ps -C chrome -o pid=

This command simply combines the -C option of ps with the output specifier -o. As you should see, the output contains just PID values, no additional data. Thus, it is suitable for use with shell scripts.

22. Print the Execution Time for a Process

The execution time of a process indicates how much time the CPU spends behind the task. It is a great way of finding faulty processes that are utilizing too much CPU time. The following command shows you how to find this execution time for a given process in Linux.

$ ps -eo etime,user,comm | grep chrome

This example utilizes the Linux grep command to filter out the specific process from the entire process list. You can also specify the process name using the -C option of ps.

$ ps -o etime,user,comm -C chrome

Since we are selecting the process by name, we do not need to provide the -e option.

23. Print CPU and Memory Usage Statistics

We can use the ps command to view the CPU and memory usage of our processes. This is very useful when determining faulty processes or troubleshooting resource usage. The following examples illustrate how to do this.

$ ps -eo pid,ppid,cmd,%mem,%cpu
$ ps -eo "pid ppid cmd %mem %cpu"

These commands will display two additional columns for CPU and memory usage for the process list. If you want to see the resource usage for a particular process, use the -C option and omit -e.

$ ps -o pid,ppid,cmd,%mem,%cpu -C chrome

24. Print CPU and Memory Usage After Sorting

The above commands aren’t very neat on their own since the output contains a lot of processes. Plus, many of those do not affect the CPU resources heavily. Luckily, we can sort the output data to find out the processes using the highest resources.

$ ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%mem | head

This command sorts the output of ps and feeds the data to the head command. It produces the top processes responsible for the most CPU usage. If you want to find out processes causing your system to hang, this is the command to use.

25. Print Elapsed Time for Processes

The elapsed time for a Linux process indicates the time since it was started by your system. The ps utility can display this time using the [[dd-]hh:]mm:ss format. Check out the following example to see how this works.

$ ps -C chrome -o pid,etime=

This command will show the PIDs for the chrome process and the elapsed time information. We can also specify the process using its PID or PPID, as demonstrated below.

$ ps --ppid 1736 -o pid,etime=

26. Kill Hanged Processes with Linux PS Command

If you face CPU hanging issues, you may want to kill the processes that are using too much CPU resources. Check out our earlier guide on how to kill or terminate a Linux process to mitigate this problem. However, the below one-liner shell command is a handy way of doing this task.

$ ps aux | grep -e 'nano' | awk '{print $2}' | xargs kill -9

This command uses several useful Linux terminal commands to find out the frozen process and kill it. Check out our guide on the Linux awk command to learn how we filtered the data.

27. Monitor Process Usage in Real-Time

The Linux ps command provides only a static snapshot of the processes. The top utility is used for monitoring processes and resource usage in real-time. However, we can combine ps with the watch command to monitor processes in real-time.

$ watch -n 1 'ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%mem | head'

This command will provide a live view of process statuses and their resource consumption in every one second. The head command is used for reducing the number of output lines.

28. Locate Memory Leaks

Memory leaks are a common problem with many applications that use the client-server model. Technically, it means that the memory allocated to an app is not being freed when the app is closed. The following commands can help admins identify memory leaks.

$ ps -ef -o pid,pmem --sort pmem | tail -5
$ ps -ef -o pid,pmem --sort %mem | tail -5

Note that pmem is a synonym for %mem in Linux ps command. Now take note of the PID that is consuming the most memory and find detailed information on that process using the following command.

$ ps ev --pid=1776

Run this command multiple times or use the watch utility to monitor if the value of the RSS field increases. If it does, it is a sign of memory leak.

$ watch -n 1 'ps ev --pid=1776'

29. Print Child Processes for Specific Process

Multi-tasking operating systems like Linux allows processes to create their own child processes. This is usually done by one of two procedures, the system calls fork() or spawn(). Anyway, you can print the list of child processes created by a certain process using the Linux ps command.

$ ps -o pid,uname,comm -C chrome
$ ps -o pid,uname,comm -C chrome --forest

These will display the child processes for the process chrome. Adding the –forest option helps to visualize the relationship between the processes.

30. Rename Column Labels

The default naming scheme of the output columns for ps is quite short and may confuse some users. However, it is very easy to rename these labels and set up custom names for them. The below command illustrates this using a simple example.

$ ps -e -o pid=PID,uname=USER,cpu=CPU,%mem=MEM%,comm=COMMAND

This makes it very easy to identify the respected columns and avoid confusion.

If you’re a complete beginner, then bookmark this guide for future references. Hopefully, we have provided you with the essential information you were looking for. Leave us a comment below if you have any further queries or tips.