Get a snapshot of the processes running in your Linux computer with the ps command. Locate processes by name, user, or even terminal with as much or as little detail as you need. We show you how.
Process Management on Linux
The beating heart of all Linux and Unix-like operating systems is the kernel. Amongst its many responsibilities is the allocation of system resources such as RAM and CPU time. These have to be juggled in real-time so that all running processes get their fair share, according to the priority of each task.
Sometimes tasks can lock-up, or enter a tight loop, or become unresponsive for other reasons. Or they may continue running, but gobble up too much CPU time or RAM, or behave in some equally anti-social way. Sometimes tasks need to be killed as a mercy to everyone involved. The first step. Of course, is to identify the process in question.
But maybe you don’t have any task or performance issues at all. Perhaps you’re just curious about which processes are running inside your computer, and you’d like to peek beneath the hood. The ps command satisfies both of these needs. It gives you a snapshot of what is happening inside your computer “right now.”
ps is flexible enough to give you precisely the information you need in exactly the format you’d like it. In fact, ps has a great many options. The options described here will cater for most commonplace needs. If you need to go deeper into ps than we’ve taken it in this article, you’ll find that our introduction makes the man page easier to digest.
Listing Processes
The easiest way to use ps is to fire it up with no parameters:
ps
ps displays a list of the processes started by the user who ran the command.
The four columns are:
- PID: The process ID number of the process.
- TTY: The name of the console that the user is logged in at.
- TIME: The amount of CPU processing time that the process has used.
- CMD: The name of the command that launched the process
Listing Process for All Users
by adding the -e (select all processes) we can make ps list the processes that have been started by all users, not just the user who is running the ps command. Because this is going to be a long list, we’re piping it into less.
ps -e | less
The process list is piped into less.
We’ve got many more entries in the list, but we see the same four columns as before. The entries with a question mark ? in the TTY column were not started from a terminal window.
Showing Process Hierarchy
Sometimes it can help to figure out an issue or identify a particular process if you can see which processes launched other processes. We use the -H (hierarchy) option to do so.
ps -eH | less
The indentation indicates which processes are parents of which other processes.
To add a little more clarity, we can ask ps to add some ASCII lines and to draw the hierarchy as a tree. The option to do this is the --forest option.
ps -eH --forest | less
This makes it easier to track which processes are the parents of other processes.
Listing Processes by Name
You can pipe the output from ps through grep to list entries that have names that match the search term. Here we’re looking for entries that match the “firefox” search term:
ps -e | grep firefox
In this case, the output is a single entry for the process we are interested in. Of course, if we’d launched several instances of Firefox, there’d be more than one item returned in the list.
Showing More Columns in the Output
To add more columns to the output, use the -f (full-format) option.
ps -ef | less
An extra set of columns are included in the output from ps.
The columns are:
- UID: The user ID of the owner of this process.
- PID: The process ID of the process.
- PPID: Parent process ID of the process.
- C: The number of children the process has.
- STIME: Start time. The time when the process commenced.
- TTY: The name of the console that the user is logged in at.
- TIME: The amount of CPU processing time that the process has used.
- CMD: The name of the command that launched the process.
By using the -F (extra full-format) option we can get even more columns:
ps -eF | less
The columns we get this time require the screen to be scrolled sideways to reveal them all.
Pressing the “Right Arrow” key shifts the display to the left.
The columns we now get are:
- UID: The user ID of the owner of this process.
- PID: The process ID of the process.
- PPID: Parent process ID of the process.
- C: The number of children the process has.
- SZ: Size in RAM pages of the process image.
- RSS: Resident set size. This is the non-swapped physical memory used by the process.
- PSR: The processor that the process is assigned to.
- STIME: Start time. The time when the process commenced.
- TTY: The name of the console that the user is logged in at.
- TIME: The amount of CPU processing time that the process has used.
- CMD: The name of the command that launched the process.
Listing Processes by Process ID
Once you have found the process ID for the process you’re interested in, you can use it with the ps command to list the details of that process. Use the -p (select by process ID) option to achieve this:
ps -p 3403
The details for this process are listed:
You are not restricted to one process ID. You can provide a list of process IDs, separated by spaces.
Listing Processes by Command
The -C (command) option lets you search for a process using the command name. That is, the name of the command that launched the process. This is subtly different from the command line, which might include path names and parameters or options.
ps -C shutter
The details for the shutter process are listed.
Listing Processes Owned by a User
To see the processes that are owned by a particular user, use the -u (user list) option:
ps -u mary
The processes owned by the user account mary are displayed.
Listing Processes by Terminal
To see the processes associated with a TTY, use the -t (select by TTY) option. Used without a TTY number, the -t option reports on processes associated with the current terminal window.
tty
ps -t
The tty command reports that this is pseudo-teletype 0. The processes listed by ps -t are all associated with TTY pts/0.
If we pass a TTY number on the command line, we should get a report of the processes associated with that TTY.
ps -t 1
This time the processes are all associated with TTY pts/1.
RELATED: What is a TTY on Linux? (and How to Use the tty Command)
Selecting Columns to Display
With the -o (format) option you can select which columns you want to have included in the output from ps. You specify the columns by name. The (long) list of column names can be seen on the man page in the section titled “Standard Format Specifiers.” In this example, we’re choosing to have the CPU time (pcpu) and the command line with arguments (args) included in the output.
ps -e -o pcpu,args | less
The output only includes our two requested columns.
Sorting The Output by Columns
You can have the output sorted for you by using the --sort option. Let’s sort the output by the CPU column:
ps -e -o pcpu,args --sort -pcpu| less
The hyphen “-” on the pcpu sort parameter gives a descending sort order.
To see the ten most CPU intensive processes, pipe the output through the head command:
ps -e -o pcpu,args --sort -pcpu | head -10
We get a sorted, truncated list.
If we add more columns to our display, we can sort by more columns. Let’s add the pmem column. This is the percentage of the computer’s memory that is being used by the process. Without a hyphen, or with a plus ” +“, the sort order is ascending.
ps -e -o pcpu,pmem,args --sort -pcpu,pmem | head -10
We get our extra column, and the new column is included in the sorting. The first column is sorted before the second column, and the second column is sorted in ascending order because we didn’t put a hyphen on pmem.
Let’s make it a bit more useful and add in the process ID column (pid) so we can see the process number of each process in our listing.
ps -e -o pid,pcpu,pmem,args --sort -pcpu,pmem | head -10
Now we can identify the processes.
Killing Processes by Process ID
We’ve covered a range of ways to identify processes, including name, command, user, and terminal. We’ve also covered ways to identify processes by their dynamic attributes, such as CPU usage and memory.
So, one way or another, we can identify the processes that are running. By knowing their process ID, we can (if we need to) kill any of those processes using the kill command. If we wanted to kill process 898, we’d use this format:
sudo kill 898
If all goes well, the process is silently terminated.
RELATED: How to Kill Processes From the Linux Terminal
Killing Processes by Name
The pkill command allows you to kill processes by name. Make sure you’ve identified the correct process! This command will terminate the top process.
sudo pkill top
Again, no news is good news. The process is silently terminated.
Killing Multiple Processes by Name
If you have multiple copies of a process running, or a process has spawned a number of child processes (like Google Chrome can do), how can you kill them off? That’s just as easy. We use the killall command.
We’ve got two copies of top running:
ps -e | grep top
We can terminate both of them with this command:
sudo killall top
No response means no problems, so both of those processes have been terminated.
Get a Dynamic View with top
The output from ps is a snapshot view. It doesn’t update. To get an updating view of the processes, use the top command. It provides a dynamic view of the processes running in your computer. The display is in two parts. There is a dashboard area at the top of the screen made up of lines of text, and a table in the lower part of the screen made up of columns.
Start top with this command:
top
The columns hold information on the processes:
- PID: Process ID
- USER: Name of the owner of the process
- PR: Process priority
- NI: The nice value of the process
- VIRT: Virtual memory used by the process
- RES: Resident memory used by the process
- SHR: Shared memory used by the process
- S: Status of the process. See the list below of the values this field can take
- %CPU: the share of CPU time used by the process since the last update
- %MEM: share of physical memory used
- TIME+: total CPU time used by the task in hundredths of a second
- COMMAND: command name or command line (name and command line parameters) If the command column cannot be seen, press the “Right Arrow” key.
The status of the process can be one of:
- D: Uninterruptible sleep
- R: Running
- S: Sleeping
- T: Traced (stopped)
- Z: Zombie
Press the “Q” key to exit from top.
RELATED: 37 Important Linux Commands You Should Know
Before You Kill a Process
Make sure it is the one you’re after, and check that it isn’t going to cause you any problems. In particular, it is worth checking with the -H (hierarchy) and --forest options to make sure it doesn’t have any important child processes that you’d forgotten about.
