psSnapshot the running processes
ps prints a one-time snapshot of the processes on the box: their PIDs, owners, CPU and memory use, state and full command line. It is how you find the PID you are about to kill, see who started what, and spot zombies or processes stuck on I/O.
ps [OPTIONS] (common: ps aux, ps -ef, ps -eo FIELDS --sort=FIELD)You've logged in to a box for the first time and want to see what is running on it and who owns it.
psprocps-ng ps: reads /proc once and prints one row per process.
ps does not talk to a daemon or keep history. It opens /proc, reads the directory with getdents and treats every numeric entry as a PID. For each one it reads small virtual files the kernel generates on the fly: /proc/PID/stat (state, parent PID, CPU ticks, start time), /proc/PID/status (UIDs, memory), /proc/PID/cmdline (arguments) and fd/0 for the terminal. UIDs are turned into names through NSS (/etc/passwd). %CPU is CPU time divided by the time the process has existed, so it is a lifetime average, not what the process is doing right now: use top for that. Because it is a snapshot, a PID you read can already be gone, or reused, by the time you act on it.
ps is a /proc reader: it lists the PID directories, reads a few virtual files per process and formats one snapshot.
ps starts, parses its options (a: all users, x: no-terminal processes too, u: user columns) and has no daemon to ask: everything comes from /proc.
auxBSD style: all processes (a, x) with user-oriented columns (u): %CPU, %MEM, VSZ, RSS, STAT, START-efSystem V style: every process, full format with UID, PID, PPID, start time and command-e / -ASelect every process-u USEROnly processes whose effective user is USER-p PID[,PID]Only these PIDs (exit code 1 if none exist)-C NAMEOnly processes whose command name is exactly NAME--ppid PIDOnly the children of PID-o FIELDSCustom columns: pid,ppid,user,stat,%cpu,%mem,rss,etime,wchan,cmd ...--sort=-FIELDSort by a field; minus for descending (--sort=-%cpu)--forest / fDraw the parent/child tree with \_ branches-L / -TShow threads (LWP / SPID column), one row per threadwwDo not cut long command lines at the terminal widthps aux | grep myapp | wc -l to count instancesThe grep process matches its own pattern, so the count is one too high (and 'myapp' also matches 'myapp-backup').
pgrep -c -x myappReading %CPU in ps aux as current CPU usageps %CPU is CPU time divided by lifetime. A process that spun for an hour and is now idle still shows a big number.
top -p PID, or pidstat -p PID 1 for live usageAdding up VSZ to see how much memory is usedVSZ is reserved virtual address space; most of it is never backed by RAM. Even RSS double-counts shared libraries.
Look at RSS per process and free -h / available for the boxkill -9 on a process listed as Z <defunct>A zombie has already exited; it is only an entry waiting for its parent to call wait(). Signals do nothing to it.
Find its parent with ps -o ppid= -p PID and fix or restart the parentTry these on a Linux machine of your own. Each task has a hint and a solution.
Show every process on the system in user-oriented format and keep only the first 5 lines.
List the 5 processes using the most memory, with PID, user, %MEM and the full command.
Find the parent PID of your current shell and print the parent's command.
Show all processes as a tree and find the branch that contains your shell.
psSnapshot the running processes
ps prints a one-time snapshot of the processes on the box: their PIDs, owners, CPU and memory use, state and full command line. It is how you find the PID you are about to kill, see who started what, and spot zombies or processes stuck on I/O.
ps [OPTIONS] (common: ps aux, ps -ef, ps -eo FIELDS --sort=FIELD)You've logged in to a box for the first time and want to see what is running on it and who owns it.
psprocps-ng ps: reads /proc once and prints one row per process.
ps does not talk to a daemon or keep history. It opens /proc, reads the directory with getdents and treats every numeric entry as a PID. For each one it reads small virtual files the kernel generates on the fly: /proc/PID/stat (state, parent PID, CPU ticks, start time), /proc/PID/status (UIDs, memory), /proc/PID/cmdline (arguments) and fd/0 for the terminal. UIDs are turned into names through NSS (/etc/passwd). %CPU is CPU time divided by the time the process has existed, so it is a lifetime average, not what the process is doing right now: use top for that. Because it is a snapshot, a PID you read can already be gone, or reused, by the time you act on it.
ps is a /proc reader: it lists the PID directories, reads a few virtual files per process and formats one snapshot.
ps starts, parses its options (a: all users, x: no-terminal processes too, u: user columns) and has no daemon to ask: everything comes from /proc.
auxBSD style: all processes (a, x) with user-oriented columns (u): %CPU, %MEM, VSZ, RSS, STAT, START-efSystem V style: every process, full format with UID, PID, PPID, start time and command-e / -ASelect every process-u USEROnly processes whose effective user is USER-p PID[,PID]Only these PIDs (exit code 1 if none exist)-C NAMEOnly processes whose command name is exactly NAME--ppid PIDOnly the children of PID-o FIELDSCustom columns: pid,ppid,user,stat,%cpu,%mem,rss,etime,wchan,cmd ...--sort=-FIELDSort by a field; minus for descending (--sort=-%cpu)--forest / fDraw the parent/child tree with \_ branches-L / -TShow threads (LWP / SPID column), one row per threadwwDo not cut long command lines at the terminal widthps aux | grep myapp | wc -l to count instancesThe grep process matches its own pattern, so the count is one too high (and 'myapp' also matches 'myapp-backup').
pgrep -c -x myappReading %CPU in ps aux as current CPU usageps %CPU is CPU time divided by lifetime. A process that spun for an hour and is now idle still shows a big number.
top -p PID, or pidstat -p PID 1 for live usageAdding up VSZ to see how much memory is usedVSZ is reserved virtual address space; most of it is never backed by RAM. Even RSS double-counts shared libraries.
Look at RSS per process and free -h / available for the boxkill -9 on a process listed as Z <defunct>A zombie has already exited; it is only an entry waiting for its parent to call wait(). Signals do nothing to it.
Find its parent with ps -o ppid= -p PID and fix or restart the parentTry these on a Linux machine of your own. Each task has a hint and a solution.
Show every process on the system in user-oriented format and keep only the first 5 lines.
List the 5 processes using the most memory, with PID, user, %MEM and the full command.
Find the parent PID of your current shell and print the parent's command.
Show all processes as a tree and find the branch that contains your shell.