PROGRAMS

# ps

## Overview

The ps command (a.k.a process status) provides a snapshot of the current processes running on the system.

For repetitive updating of the process information (e.g. updates on how much CPU and memory each process is using, similar to Task Manager in Windows) see the top command instead.

## Default Implementation

By default, ps only prints processes owned by the current user, AND are processes that are associated with the terminal that called ps. Normally this will result in quite a small amount of output, perhaps only 2-5 processes.

gbmhunter@ubuntu:~$ps PID TTY TIME CMD 71811 pts/3 00:00:00 bash 73771 pts/3 00:00:00 ps gbmhunter@ubuntu:~$ 

You will always be guaranteed these two above when running from a bash terminal, obviously bash is running, and so is the ps command (it includes itself).

## More Complete Information

More complete information on the running processes of the system can be found by providing arguments, such as the UNIX-style ps -e:

[ghunter@ubuntu ~]$ps -e PID TTY TIME CMD 1 ? 01:15:50 systemd 2 ? 00:00:26 kthreadd 3 ? 00:02:24 ksoftirqd/0 8 ? 00:01:55 migration/0 9 ? 00:00:00 rcu_bh 10 ? 06:22:40 rcu_sched 11 ? 00:00:51 watchdog/0 12 ? 00:01:00 watchdog/1 ... If you want more detail on the command that started each process, use ps -ef. [ghunter@ubuntu ~]$ ps -ef
UID         PID   PPID  C STIME TTY          TIME CMD
root          1      0  0 Jan02 ?        01:15:51 /usr/lib/systemd/systemd --system --deserialize 22
root          2      0  0 Jan02 ?        00:00:26 [kthreadd]
root      45147      1  0 Jun06 ?        00:00:19 /usr/sbin/crond -n
root      45697      1  0 Jun06 ?        00:06:39 /usr/sbin/irqbalance --foreground
root      45718      1  0 Jun06 ?        00:00:00 /usr/sbin/atd -f
ntp       45742      1  0 Jun06 ?        00:00:18 /usr/sbin/ntpd -u ntp:ntp -g

Remember that PID is the process ID and PPID is the parent process ID.

If you use BSD style options (no dash), ps will print the command and the provided options for each process, rather than the executable name:

gbmhunter@ubuntu:~$ps -aux USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.0 33896 4020 ? Ss Jan27 0:02 /sbin/init root 2 0.0 0.0 0 0 ? S Jan27 0:00 [kthreadd] root 3 0.0 0.0 0 0 ? S Jan27 0:01 [ksoftirqd/0] root 5 0.0 0.0 0 0 ? S< Jan27 0:00 [kworker/0:0H] root 7 0.0 0.0 0 0 ? S Jan27 0:30 [rcu_sched] root 8 0.0 0.0 0 0 ? S Jan27 0:00 [rcu_bh] root 9 0.0 0.0 0 0 ? S Jan27 0:00 [migration/0] root 10 0.0 0.0 0 0 ? S Jan27 0:00 [watchdog/0] root 11 0.0 0.0 0 0 ? S Jan27 0:00 [watchdog/1] root 12 0.0 0.0 0 0 ? S Jan27 0:00 [migration/1] root 13 0.0 0.0 0 0 ? S Jan27 0:01 [ksoftirqd/1] root 15 0.0 0.0 0 0 ? S< Jan27 0:00 [kworker/1:0H] ... This is only a snapshot of the total number of processes it will print! ## Supported Options ps can support a large and confusing amount of different option styles, including UNIX options (one dash), BSD options (no dash) and GNU long options (two dashes). ## ps With grep The output of ps can be piped to grep to filter the results. For example, if you wanted to only look for processes with the word hocus_pocus in it: $ ps -aux | grep hocus_pocus

Note: grep will match anything on the line printed by ps -aux. That means that hocus_pocus will be matched against the username column and any paths in the process name.

However, aside from having to use two commands, there are other disadvantages to using ps with grep. A completely new program, pgrep was built to try and provide a better process-searching tool.