PS Process Management - ryzendew/Linux-Tips-and-Tricks GitHub Wiki

PS (Process Status) Troubleshooting for Beginners

Table of Contents

  1. :pencil: What is ps?
  2. :zap: Basic Commands
  3. :mag: Viewing Processes
  4. :desktop: Finding Specific Processes
  5. :family: Process Trees
  1. :chart_with_upwards_trend: Sorting Processes
  1. :wrench: Custom Output Formats
  1. :bulb: Common Troubleshooting Scenarios
  1. :keyboard: Quick Reference
  1. :link: Related Commands
  1. Summary

:pencil: What is ps?

  • ps (Process Status) displays information about running processes
  • Shows what programs are currently running on your system
  • Essential for troubleshooting, monitoring, and managing processes
  • Part of the procps-ng package (usually pre-installed)

What ps can do:

  • List all running processes
  • Show process details (CPU, memory, PID, etc.)
  • Find specific processes
  • Display process trees (parent-child relationships)
  • Sort processes by resource usage
  • Filter processes by user, command, etc.

Process basics:

  • Every running program is a process
  • Each process has a unique Process ID (PID)
  • Processes have a parent process (PPID)
  • Processes use CPU and memory resources

:zap: Basic Commands

Getting Help

ps --help

Shows available ps options (note: ps has multiple syntax styles).

Check Version

ps --version

Shows the version of ps (procps-ng).

:mag: Viewing Processes

List All Processes (Standard Format)

ps aux

What this does:

  • Shows all processes for all users
  • Uses BSD-style syntax (a = all users, u = user format, x = processes without TTY)
  • Most commonly used ps command

Example output:

USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root           1  0.0  0.0  40280 25084 ?        Ss   07:33   0:05 /usr/lib/systemd/systemd --switched-root --system --deserialize=59 rhgb
root           2  0.0  0.0      0     0 ?        S    07:33   0:00 [kthreadd]
root           3  0.0  0.0      0     0 ?        S    07:33   0:00 [pool_workqueue_release]
matt        2024 71.3  1.3 2587856 862828 tty2   S<l+ 07:34 333:08 qs

What each column means:

  • USER: User who owns the process
  • PID: Process ID (unique identifier)
  • %CPU: CPU usage percentage
  • %MEM: Memory usage percentage
  • VSZ: Virtual memory size (KB)
  • RSS: Resident Set Size - physical memory used (KB)
  • TTY: Terminal associated with process (? = no terminal)
  • STAT: Process state (see below)
  • START: Time process started
  • TIME: CPU time used
  • COMMAND: Command that started the process

Process states (STAT):

  • R - Running or runnable
  • S - Interruptible sleep (waiting for event)
  • D - Uninterruptible sleep (usually I/O)
  • Z - Zombie (terminated but not reaped)
  • T - Stopped (by job control or debugger)
  • I - Idle kernel thread
  • Additional flags:
  • < - High priority
  • N - Low priority
  • L - Pages locked in memory
  • s - Session leader
  • l - Multi-threaded
  • + - Foreground process group

List All Processes (Unix Format)

ps -ef

What this does:

  • Shows all processes in Unix-style format
  • Different column layout than ps aux
  • Commonly used on some systems

Example output:

UID          PID    PPID  C STIME TTY          TIME CMD
root           1       0  0 07:33 ?        00:00:05 /usr/lib/systemd/systemd --switched-root --system --deserialize=59 rhgb
root           2       0  0 07:33 ?        00:00:00 [kthreadd]
root           3       2  0 07:33 ?        00:00:00 [pool_workqueue_release]

What each column means:

  • UID: User ID
  • PID: Process ID
  • PPID: Parent Process ID
  • C: CPU utilization
  • STIME: Start time
  • TTY: Terminal
  • TIME: CPU time
  • CMD: Command

List All Processes (Simple Format)

ps -e

What this does:

  • Shows all processes (every process)
  • Minimal output (PID and command)
  • Quick overview

With custom format:

ps -e --format=pid,comm,args

Example output:

    PID COMMAND         COMMAND
      1 systemd         /usr/lib/systemd/systemd --switched-root --system --deserialize=59 rhgb
      2 kthreadd        [kthreadd]
      3 pool_workqueue_ [pool_workqueue_release]

:desktop: Finding Specific Processes

Find Process by Name

ps aux | grep processname

What this does:

  • Searches for processes matching the name
  • Uses grep to filter ps output
  • Case-sensitive by default

Example:

ps aux | grep sshd

Case-insensitive:

ps aux | grep -i processname

Note: The grep command itself will appear in results. To exclude it:

ps aux | grep -v grep | grep processname

Or use pgrep (see below).

Find Process by PID

ps -p 1234

What this does:

  • Shows information about process with PID 1234
  • Useful when you know the PID

With custom format:

ps -p 1 -o pid,ppid,cmd

Example output:

    PID    PPID CMD
      1       0 /usr/lib/systemd/systemd --switched-root --system --deserialize=59 rhgb

Find Processes by User

ps -u username

What this does:

  • Shows all processes owned by a specific user
  • Useful for monitoring user activity

Example:

ps -u matt

Current user:

ps -u $(whoami)

Multiple users:

ps -u user1,user2

Find Process by Command

ps -C commandname

What this does:

  • Finds processes by command name
  • Exact match (not partial)

Example:

ps -C sshd

:family: Process Trees

Show Process Tree

ps --forest

What this does:

  • Shows processes in a tree format
  • Displays parent-child relationships
  • Visual representation of process hierarchy

Example output:

    PID TTY          TIME CMD
 782428 ?        00:00:02 nautilus
 772127 ?        00:00:00 bwrap
 772128 ?        00:00:00  \_ xdg-dbus-proxy
 772115 ?        00:00:00 bwrap
 772131 ?        00:00:00  \_ bwrap
 772132 ?        00:00:05      \_ github-desktop
 772139 ?        00:00:00      |   \_ github-desktop
 772332 ?        00:00:07      |   |   \_ github-desktop

What this shows:

  • Parent processes at the top
  • Child processes indented with \_
  • Process hierarchy relationships

With more details:

ps auxf

The f flag shows a forest (tree) view with full details.

Show Process Tree for Specific Process

ps --forest -p 1234

What this does:

  • Shows the process tree starting from PID 1234
  • Includes parent and child processes

:chart_with_upwards_trend: Sorting Processes

Sort by CPU Usage

ps aux --sort=-%cpu

What this does:

  • Sorts processes by CPU usage (highest first)
  • - before %cpu means descending order
  • Useful for finding CPU hogs

Top CPU users:

ps aux --sort=-%cpu | head -10

Example output:

USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
matt        2024 71.3  1.3 2587856 862828 tty2   S<l+ 07:34 333:08 qs
matt      768621 18.0  1.8 1480520040 1202296 ?  R<l  14:02  14:14 /usr/share/cursor/cursor --type=zygote
matt      774101  7.9  1.2 1445728428 810780 ?   S<l  14:13   5:22 /opt/microsoft/msedge-dev/msedge

Sort by Memory Usage

ps aux --sort=-%mem

What this does:

  • Sorts processes by memory usage (highest first)
  • Useful for finding memory hogs

Top memory users:

ps aux --sort=-%mem | head -10

Example output:

USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
matt      768621 18.0  1.8 1480520040 1200936 ?  R<l  14:02  14:14 /usr/share/cursor/cursor --type=zygote
matt        3030  5.8  1.4 1472409936 925732 ?   Sl   07:34  27:15 /proc/self/exe --type=renderer
matt        2024 71.3  1.3 2587856 862828 tty2   S<l+ 07:34 333:08 qs

Sort by PID

ps aux --sort=pid

What this does:

  • Sorts processes by Process ID (lowest first)
  • Useful for chronological ordering (PIDs are assigned sequentially)

Sort by Start Time

ps aux --sort=start

What this does:

  • Sorts processes by start time
  • Oldest processes first

:wrench: Custom Output Formats

Custom Columns

ps -e --format=pid,user,comm,%cpu,%mem,etime

What this does:

  • Shows only specified columns
  • Custom format for specific needs

Available format specifiers:

  • pid - Process ID
  • ppid - Parent Process ID
  • user - User name
  • comm - Command name
  • args - Full command with arguments
  • %cpu - CPU usage
  • %mem - Memory usage
  • rss - Resident Set Size
  • vsz - Virtual memory size
  • stat - Process state
  • etime - Elapsed time
  • start - Start time
  • time - CPU time

Example:

ps -e --format=pid,user,comm,%cpu,%mem

Show Full Command Line

ps auxww

What this does:

  • Shows full command line (no truncation)
  • ww = unlimited width
  • Useful when commands are truncated

:bulb: Common Troubleshooting Scenarios

Scenario 1: High CPU Usage

Problem: System is slow, CPU usage is high.

Solution:

  1. Find top CPU users:

    ps aux --sort=-%cpu | head -10

  2. Check specific process:

    ps -p 1234 -o pid,%cpu,%mem,cmd

  3. Monitor in real-time:

    watch -n 1 'ps aux --sort=-%cpu | head -10'

Scenario 2: High Memory Usage

Problem: System is running out of memory.

Solution:

  1. Find top memory users:

    ps aux --sort=-%mem | head -10

  2. Check total memory usage:

    ps aux --sort=-%mem | awk '{sum+=$6} END {print sum/1024 " MB"}'

  3. Find processes using most memory:

    ps aux --sort=-%mem | head -20

Scenario 3: Find Process Using Port

Problem: Port is in use, need to find the process.

Solution:

  1. Find process using port (combine with ss):

    sudo ss -tlnp | grep :80

  2. Or use lsof:

    sudo lsof -i :80

  3. Then check the process:

    ps -p $(sudo lsof -t -i :80)

Scenario 4: Process Won't Die

Problem: Process is stuck, kill command doesn't work.

Solution:

  1. Check process state:

    ps -p 1234 -o pid,stat,cmd

  2. Check if it's a zombie:

    ps aux | grep -i zombie

  3. Find parent process:

    ps -p 1234 -o pid,ppid,cmd

  4. Kill parent if needed:

    kill -9 1234

Scenario 5: Find All Processes for a User

Problem: Need to see all processes owned by a user.

Solution:

ps -u username

With details:

ps aux -u username

Count processes:

ps -u username | wc -l

Scenario 6: Monitor Process Over Time

Problem: Need to watch a process's resource usage.

Solution:

watch -n 1 'ps -p 1234 -o pid,%cpu,%mem,etime,cmd'

Updates every second.

Or use a loop:

while true; do clear; ps -p 1234 -o pid,%cpu,%mem,etime,cmd; sleep 1; done

Scenario 7: Find Process by Partial Name

Problem: Need to find processes with similar names.

Solution:

ps aux | grep -i partialname

Exclude grep itself:

ps aux | grep -v grep | grep -i partialname

Or use pgrep:

pgrep -a partialname

Scenario 8: Process Tree for Troubleshooting

Problem: Need to understand process relationships.

Solution:

ps --forest -u username

Shows all processes for user in tree format.

For specific process:

ps --forest -p 1234

:keyboard: Quick Reference

Basic Commands

ps aux                    # All processes (BSD style)
ps -ef                    # All processes (Unix style)
ps -e                     # All processes (simple)
ps -e --format=pid,comm   # Custom format

Finding Processes

ps aux | grep name        # Find by name
ps -p 1234                # Find by PID
ps -u username            # Find by user
ps -C commandname         # Find by command

Process Trees

ps --forest               # Tree view
ps auxf                   # Tree with details
ps --forest -p 1234      # Tree for specific process

Sorting

ps aux --sort=-%cpu       # Sort by CPU (high to low)
ps aux --sort=-%mem       # Sort by memory (high to low)
ps aux --sort=pid         # Sort by PID
ps aux --sort=start       # Sort by start time

Top Processes

ps aux --sort=-%cpu | head -10    # Top 10 CPU users
ps aux --sort=-%mem | head -10    # Top 10 memory users

Custom Output

ps -e --format=pid,user,comm,%cpu,%mem
ps auxww                    # Full command line (no truncation)

:link: Related Commands

pgrep - Find Process by Name

pgrep processname

What this does:

  • Finds PIDs of processes matching the name
  • Returns only PIDs (useful for scripts)

With process names:

pgrep -a processname

Shows PID and command.

pkill - Kill Process by Name

pkill processname

What this does:

  • Kills processes by name
  • Sends TERM signal by default

Force kill:

pkill -9 processname

kill - Kill Process by PID

kill 1234

Force kill:

kill -9 1234

See kill signals:

kill -l

top / htop - Interactive Process Monitor

top

What this does:

  • Interactive real-time process monitor
  • Updates continuously
  • Can sort, filter, and kill processes

htop (if installed):

htop

More user-friendly version of top.

Summary

This guide covered:

  1. Basic Commands:
  • ps aux - Most common format
  • ps -ef - Unix format
  • ps -e - Simple format
  1. Finding Processes:
  • By name (grep)
  • By PID
  • By user
  • By command
  1. Process Trees:
  • Tree view with --forest
  • Parent-child relationships
  1. Sorting:
  • By CPU usage
  • By memory usage
  • By PID or start time
  1. Custom Output:
  • Custom columns
  • Full command lines
  1. Troubleshooting Scenarios:
  • High CPU/memory usage
  • Finding processes
  • Process monitoring
  • Process trees

Next Steps:

  • Practice with ps aux | grep to find processes
  • Use top or htop for interactive monitoring
  • Combine with kill to manage processes
  • Learn about process signals and states

For system resource monitoring, see the Free & Top System Resource Monitoring Guide. For network connections, see the SS Network Troubleshooting Guide.