ps aux command and output Explained with Practical Examples

This tutorial explains how to use the ps command and read the output of ps aux command column by column (USER, PID, %CPU, %MEM, VSZ, RSS, TTY, STAT and TIME) in detail with practical examples. Learn how to use the ps command to get the required information from any running process in detail.

The ps (process status) command is one of the most frequently used commands in Linux. Usually it is used to get the more and detailed information about a specific process or all processes. For example, it is used to know whether a particular process is running or not, who is running what process in system, which process is using higher memory or CPU, how long a process is running, etc. In this tutorial, we will explore these examples including other examples.

LAB Setup

Access some applications and minimize them. Switch user account and repeat the same process.

run process for practice

We don’t need any special setup for this tutorial. All we need are some processes running in system. By default Linux starts several processes in startup and they remain in active condition till the system is shutdown. We can use these default processes to understand the ps command, but it is worth to run some manual processes by at least two different users to get the clear overview.

Now suppose you are a system administrator and being a system administrator you want to know what’s going on in system. In this case, ps command is the best command that you can use to get the required information. Following section explains how it can be done step by step with examples.

ps command

Open terminal and run ps command

ps command without any options

Without any option and argument, ps command shows only the process running under the logged in user account from current terminal. You may wonder why ps command is showing two processes while we haven’t executed any process from this terminal so far.

Well… first process shows the process under which this terminal is opened. This process remains open, till the terminal is opened.

Second process shows the last executed command in this terminal.

Whenever we execute ps command in terminal without any options, in output first and last place are always occupied by these two processes. PID of first process remains same in each output because it represents the opened terminal itself. PID of last process changes in each output because it represents the last executed command (ps) from the terminal.

Whenever we execute any command, Linux starts it under a new process ID. Process ID remains same in entire process. When command execution is finished, Linux drops the process ID.

To understand it more clearly let’s create a simple file and instead of saving it, move it in background and run ps command again.

Following figure shows this example. To put the file in background, use CTRL+Z keys combination.

ps command examples

As we can see in above output, any running process displays between first and last processes. If process is finished and it is not a last process, it will not display in output. To understand it, let’s bring the background process again at shell prompt and finish it by saving the file. Once this is done, run ps command again and compare the output.

ps command active process

ps command options

In ps command, options can be supplied in three styles: -

BSD UNIX style: - In this style, options are supplied without any leading dash (such as “aux”).

AT & T Unix style: - In this style, options are supplied with a leading dash (such as “-aux”).

GNU Linux style: - In this style, options are supplied with double leading dashes (such as “--sort”).

Following figure shows manual page entry for above options.

manual page entry ps command

Although ps command accepts options in mix style, still we should use only the single style to specify the options. This will avoid any unnecessary conflicts.

ps command practical examples

The ps command accepts several options. From them, we will cover only the most frequently used options in this tutorial. For a complete list of options, you can check the manual page of ps command.

$man ps

ps command basic examples

To print all running processes in system, use any one of following commands

$ps –A
$ps -e

ps -e -A

To get a detailed overview, we can format this output with –f (full format) and –F (extra full format) options.

ps -ef -AF

To view the same output in BSD Unix style, we can use “aux” options

ps aux command

The “ps aux” command is the most frequently used command by Linux administrators. Before we move to next example, let’s understand the options used in this command and its output in detail.

ps aux command options

a:- This option allows us to view the processes from all users.

u:- This option shows user or owner column in output.

x:- This option allows us to view the processes that are not executed from any terminal.

Collectively “aux” options allow us to view the all running process in system regardless from where they are executed in BSD Unix style.

ps aux command output description column by column

Column Description
USER The user account under which this process is running
PID Process ID of this process
%CPU CPU time used by this process (in percentage).
%MEM Physical memory used by this process (in percentage).
VSZ Virtual memory used by this process (in bytes).
RSS Resident Set Size, the non-swappable physical memory used by this process (in KiB)
TTY Terminal from which this process is started. Question mark (?) sign represents that process is not started from terminal.
STAT Process state. Explained in next table.
START Starting time and date of this process
TIME Total CPU time used by this process
COMMAND The command with all its arguments which started this process

ps aux stat code with description

D uninterruptible sleep (usually IO)
R running or runnable (on run queue)
S interruptible sleep (waiting for an event to complete)
T stopped by job control signal
t stopped by debugger during the tracing
w paging (not valid since the 2.6.xx kernel)
x dead (should never be seen)
Z defunct ("zombie") process, terminated but not reaped by its parent
< high-priority (not nice to other users)
N low-priority (nice to other users)
L has pages locked into memory (for real-time and custom IO)
s is a session leader
l is multi-threaded (using CLONE_THREAD, like NPTL pthreads do)
+ is in the foreground process group
Key points
  • CPU usage is expressed as the percentage of time spent running during the entire lifetime of a process.
  • The SIZE and RSS fields don't count some parts of a process including the page tables, kernel stack, struct thread_info, and struct task_struct.
  • SIZE is the virtual size of the process (code+data+stack).
  • Processes marked <defunct> are dead processes (so-called "zombies") that remain because their parent has not destroyed them properly.
  • If the length of the username is greater than the length of the display column, the username will be truncated.

You should never use these options with leading dash (-aux). It creates confusion between two standards. According to the POSIX and UNIX standards, -aux options ask command to display all processes with a TTY (generally the commands users are running) plus all processes owned by a user named "x". If this user doesn't exist, then ps command will assume that you really meant "ps aux". But if user named “x” exist, it will assume that you want see the all process associated with user “x”. In short, if user named “x” exist, "aux" and "–aux" are different. If user named “x” does not exist, both are same. To avoid this confusion, always use “aux” where you mean “aux”.

ps command advance examples

So far in this tutorial, we have learned basic usages of ps command. In this section we will learn some advance usages of ps command.

Displaying all process running under the root user account

$ps -U root -u root

In this command:-

-U: - Select the process based on real user ID or name.

-u: - Select the process based on effective user ID or name.

RUID (Real User ID) represents the name of user while EUID (Effective User ID) describes the user whose file access permissions are used by the process.

ps -U -u

Displaying all process running by a specific user account

$ps –U [UserName] –u [UserName]

ps -u username

Displaying all process running under a particular group

$ps –G [Group Name]

For a detailed overview, we can also combine –G option with –F option

$ps –FG [Group Name]

ps -fg

Displaying all process in hierarchy

$ps –A --forest

ps -A --forest

Displaying only specific column

By default ps command displays all columns. If we are interested only in particular columns, we can limit the output by specifying required column names as arguments. For example, to view only PID, USER and CMD column, we can use following command

$ps –eo pid,user,cmd

ps -eo pid,user,cmd

Finding the process which is using the highest memory

By default, ps command does not sort the output. By setting sort order to %MEM, we can find the processes which are consuming higher memories.

To set the sort order, --sort=[column name] option is used. We can also combine this option with other options to get the more specific output. For example, let’s display only the specific fields and order them by memory usages.

$ps –eo pid,user,%mem,cmd --sort=-%mem

ps -ef pid,user,%mem --sort-%mem

The ps command does not limit the result in output.

If we are interested only in knowing the top three processes which are consuming the highest memory, instead of displaying ps command’s output in terminal we can redirect it to the head command.

By default, head command displays top 10 lines from provided source. We can override this default behavior by specifying the required line numbers. To display only top three processes, we can use “-n 4” option with head command.

For 3 results, we have to supply the digit 4 as argument. As in ps command’s output first line is occupied by the titles.

sorting ps output

Finding the process which is using the highest CPU

Just like we figured out the highest memory consuming process, we can also find the highest CPU consuming process by sorting the output based on CPU column. For example following command prints top 3 processes ordered by CPU time

$ps –eo pid,user,%cpu,cmd –-sort=-%cpu | head –n 4

limiting ps output

Finding the total number of processes running by a user

To figure out the total number of process running by a user, use following command

$ps –U [UserName] –u [UserName] | wc –l

In this command, instead of printing the output of ps command in terminal, we redirected it to wc command. The wc -l command counts the number of lines form given source.

counting total process running under user account

Killing a non-responding process

A halted or non-responding process may reduce overall system performance. To make the situation worse, it cannot be closed through the regular process. We have to close it forcefully.

Linux includes several commands to terminate the process. These commands usually need process id to terminate the process which can be easily obtained from the ps command. Let’s take an example, suppose we are using Firefox and due to a faulty script it is hanged. To close it forcefully, first finds its process id.

$ps –U sanjay –u sanjay | grep firefox

The grep command is used for pattern search.

To learn grep command in detail with practical examples, see this tutorial

Grep Command in Linux Explained with Examples

In this command, we used it to search for the string “Firefox” in the output of ps command.

ps command with grep command

Once process id is known, it can be terminated through kill command

$kill [process id]

kill command

More examples for practice from ps command manual page

Following examples are provided from the manual page of ps command. Do practice with these examples also to gain the more confidence over ps command.

To see every process on the system using standard syntax:

ps -e
ps -ef
ps -eF
ps -ely

To see every process on the system using BSD syntax:

ps ax
ps axu

To print a process tree:

ps -ejH
ps axjf

To get info about threads:

ps -eLf
ps axms

To get security info:

ps -eo
ps axZ
ps -eM

To see every process running as root (real & effective ID) in user format:

ps -U root -u root u

To see every process with a user-defined format:

ps -eo pid,tid,class,rtprio,ni,pri,psr,pcpu,stat,wchan:14,comm
ps axo stat,euid,ruid,tty,tpgid,sess,pgrp,ppid,pid,pcpu,comm
ps -Ao pid,tt,user,fname,tmout,f,wchan

Print only the process IDs of syslogd:

ps -C syslogd -o pid=

Print only the name of PID 42:

ps -q 42 -o comm=

That’s all for this tutorial.

For any help, comment, feedback or suggestion regarding this tutorial simply mail me. If you like this tutorial, share it with friends through your favorite social network.

ComputerNetworkingNotes Ubuntu Linux Tutorials ps aux command and output Explained with Practical Examples