ps command in Linux

Back

It's important to know what you are running on a Linux computer. To help with that task, the ps command has number of critical switches. When trying to diagnose a problem, it's common to get the fullest possible list of running processes, and then look for a specific program.


A common and convenient way of using ps to obtain much more complete information about the processes currently on the system is to use the following:

# ps -aux | less

The -a option tells ps to list the processes of all users on the system rather than just those of the current user, with the exception of group leaders and processes not associated with a terminal. A group leader is the first member of a group of related processes.

The -u option tells ps to provide detailed information about each process. The -x option adds to the list processes that have no controlling terminal, such as daemons, which are programs that are launched during booting (i.e., computer start-up) and run unobtrusively in the background until they are activated by a particular event or condition.

As the list of processes can be quite long and occupy more than a single screen, the output of ps -aux can be piped (i.e., transferred) to the less command, which lets it be viewed one screen-full at a time. The output can be advanced one screen forward by pressing the SPACE bar and one screen backward by pressing the b key.

In contrast to most commands, the hyphen preceding ps's options is optional, not mandatory. Thus, the following could be (and sometimes is) used in place of the above command:

# ps aux | less

An alternative set of options for viewing all the processes running on a system is

# ps -ef | less

The -e option generates a list of information about every process currently running. The -f option generates a listing that contains fewer items of information for each process than the -l option.

Among the columns displayed by ps -ef, UID contains the username of the account that owns the process which is usually the same user that started the process . 

Process can be organized in a tree format. Specially, the first process, with a PID of 1, is init. That process is the base of the tree, which may be shown with the pstree command. 

In a few cases, it's not possible to use standard kill command. In such cases, it may be possible to kill a process by killing it's parent in the tree. To that end, the following command identify the parent of a process, known as the PIPD;

# ps axl

The l switch is not compatible with u switch in other words, you can't set up the output of the ps command to include both the user who started the process and the PIPD.