ps Command
Beginner Process Management man(1)Report a snapshot of current running processes
👁 8 views
📅 Updated: Mar 16, 2026
SYNTAX
ps [OPTION]...
What Does ps Do?
The ps command displays information about active processes. It provides a snapshot of current processes at the moment you run it, showing process IDs, CPU/memory usage, command names, states, and more.
ps supports two main syntax styles: BSD (ps aux) and UNIX (ps -ef). Both show similar information but with different formatting. ps aux is the most commonly used form, showing all processes with user, CPU, memory, and command information.
ps is essential for identifying running processes, troubleshooting resource usage, finding zombie processes, and building the foundation for process management with kill, nice, and other commands.
ps supports two main syntax styles: BSD (ps aux) and UNIX (ps -ef). Both show similar information but with different formatting. ps aux is the most commonly used form, showing all processes with user, CPU, memory, and command information.
ps is essential for identifying running processes, troubleshooting resource usage, finding zombie processes, and building the foundation for process management with kill, nice, and other commands.
Options & Flags
| Option | Description | Example |
|---|---|---|
| aux | Show all processes with user info (BSD style) | ps aux |
| -ef | Show all processes with full format (UNIX style) | ps -ef |
| -u | Show processes for a specific user | ps -u www-data |
| -p | Show info for specific PID | ps -p 1234 |
| --sort | Sort output by field | ps aux --sort=-%mem |
| -o | Custom output format | ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%mem |
| --forest | Show process tree | ps -ef --forest |
| -C | Select by command name | ps -C nginx |
| -L | Show threads | ps -eLf |
Practical Examples
#1 Show all processes
Lists all running processes with user, PID, CPU%, MEM%, and command.
$ ps aux
Output:
USER PID %CPU %MEM COMMAND
root 1 0.0 0.1 /sbin/init
www 234 2.3 1.5 nginx: worker
#2 Find a specific process
Searches for nginx processes.
$ ps aux | grep nginx#3 Top memory consumers
Shows the 10 processes using the most memory.
$ ps aux --sort=-%mem | head -10#4 Top CPU consumers
Shows the 10 processes using the most CPU.
$ ps aux --sort=-%cpu | head -10#5 Process tree
Shows parent-child relationships between processes.
$ ps -ef --forest#6 Custom format
Custom columns showing PID, parent PID, user, CPU, memory, elapsed time, and command.
$ ps -eo pid,ppid,user,%cpu,%mem,etime,cmd --sort=-%cpu | head#7 Count processes by user
Shows how many processes each user is running.
$ ps -eo user= | sort | uniq -c | sort -rn
Output:
45 root\n 12 www-data
#8 Find zombie processes
Lists zombie processes (state Z) that need cleanup.
$ ps aux | awk '$8=="Z"'Tips & Best Practices
ps aux vs ps -ef: Both show all processes. ps aux (BSD) shows %CPU, %MEM columns. ps -ef (UNIX) shows PPID (parent PID). Most admins prefer ps aux for resource info.
Snapshot vs real-time: ps shows a single snapshot. For real-time monitoring, use top or htop instead.
grep includes itself: ps aux | grep nginx also matches the grep process. Fix: ps aux | grep [n]ginx or use pgrep nginx.
Frequently Asked Questions
How do I find a process by name?
Use ps aux | grep process_name or pgrep -a process_name. pgrep is cleaner as it doesn't match itself.
How do I see which process uses the most memory?
Use ps aux --sort=-%mem | head -10 to see the top 10 memory consumers.
What do the process states (R, S, Z, D) mean?
R=Running, S=Sleeping (interruptible), D=Sleeping (uninterruptible, usually I/O), Z=Zombie (terminated but not reaped), T=Stopped.
Related Commands
More Process Management Commands
Master Linux with Professional eBooks
Curated IT eBooks covering Linux, DevOps, Cloud, and more
Browse Books →