linux ps command useful examples

The ps command on linux is one of the most basic commands for viewing the processes running on the system. It provides a snapshot of the current processes along with detailed information like user id, cpu usage, memory usage, command name etc.

Here I list most used options in examples:

list all processes (ps -e, ps -ef, ps -eF, ps -ely, ps ax, ps axu)

UID        PID  PPID  C STIME TTY          TIME CMD
root         1     0  0 Jul25 ?        00:00:01 /usr/lib/systemd/systemd --switched-root --system --deserialize 22
root         2     0  0 Jul25 ?        00:00:00 [kthreadd]
root         3     2  0 Jul25 ?        00:00:00 [ksoftirqd/0]
root         5     2  0 Jul25 ?        00:00:00 [kworker/0:0H]
root         7     2  0 Jul25 ?        00:00:01 [rcu_sched]
root         8     2  0 Jul25 ?        00:00:00 [rcu_bh]
root         9     2  0 Jul25 ?        00:00:00 [migration/0]

Where 
       -e, list all processes
       -l, long listing
       -f, full format listing
       -F, extra full format
On BSD machine, to get all processes, run
ps ax
ps axu are 

List processes by user

# ps -lf -u ganglia
F S UID        PID  PPID  C PRI  NI ADDR SZ WCHAN  STIME TTY          TIME CMD
5 S ganglia   1566     1  0  80   0 - 36728 ep_pol Jul23 ?        00:00:11 /usr/sbin/gmond

The command above shows user ganglia's processes, long and full format output

List the processes based on PIDs or PPIDs (ps -p, ps –ppid)

Want to check a pid info, run

# ps -fl -p 1
F S UID        PID  PPID  C PRI  NI ADDR SZ WCHAN  STIME TTY          TIME CMD
4 S root         1     0  0  80   0 -  4840 poll_s Jul23 ?        00:00:02 /sbin/init

Want to list all child processes of one pid, run

# ps -fl --ppid 1
F S UID        PID  PPID  C PRI  NI ADDR SZ WCHAN  STIME TTY          TIME CMD
5 S root      1436     1  0  80   0 - 63855 poll_s Jul23 ?        00:00:02 /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
5 S root      1448     1  0  80   0 -  2704 hrtime Jul23 ?        00:00:35 irqbalance
5 S rpc       1462     1  0  80   0 -  4743 poll_s Jul23 ?        00:00:00 rpcbind
5 S dbus      1475     1  0  80   0 -  5350 poll_s Jul23 ?        00:00:00 dbus-daemon --system

The '--ppid' option is very useful for some applications that have lots of child/sub processes.

List the process by process name

# ps -lf -C postmaster
F S UID        PID  PPID  C PRI  NI ADDR SZ WCHAN  STIME TTY          TIME CMD
1 S postgres  2013 31977  0  80   0 - 171406 sk_wai Jul25 ?       00:01:31 postgres: srmdcache dcache 127.0.0.1(37345) idle                                   
1 S postgres 11728 31977  0  80   0 - 171591 poll_s 00:58 ?       00:00:00 postgres: autovacuum worker process   dcache  

List the process by a forest tree

# ps -lf -u postgres --forest
F S UID        PID  PPID  C PRI  NI ADDR SZ WCHAN  STIME TTY          TIME CMD
4 S postgres  6841  6840  0  80   0 -  2869 n_tty_ Jul16 pts/2    00:00:00 -bash
0 S postgres 31977     1  0  80   0 - 170537 poll_s Jul21 ?       00:00:24 /usr/pgsql-9.2/bin/postmaster -p 5432 -D /var/lib/pgsql/9.2/data
1 S postgres 31979 31977  0  80   0 - 20770 poll_s Jul21 ?        00:00:06  \_ postgres: logger process                                        
1 S postgres 31981 31977  0  80   0 - 170829 poll_s Jul21 ?       00:04:51  \_ postgres: checkpointer process                                  
1 S postgres 31982 31977  0  80   0 - 170602 poll_s Jul21 ?       00:02:07  \_ postgres: writer process                                        
1 S postgres 31983 31977  0  80   0 - 170602 poll_s Jul21 ?       00:00:23  \_ postgres: wal writer process                                    
1 S postgres 31984 31977  0  80   0 - 171048 poll_s Jul21 ?       00:00:38  \_ postgres: autovacuum launcher process                           
1 S postgres 31985 31977  0  80   0 - 20952 poll_s Jul21 ?        00:08:53  \_ postgres: stats collector process  

Similar to the command above, you can also combine --forest option with others, for example

#ps -lf -C postmaster --forest
#ps -lf -p <pid>  --forest
#ps -elf --forest

List a process threads

Some time you want to check a process' thread status, run

# ps -lf -C java -L 
F S UID        PID  PPID   LWP  C NLWP PRI  NI ADDR SZ WCHAN  STIME TTY          TIME CMD
0 S root     17949 17946 17949  0  322  80   0 - 1207154 futex_ Jul25 pts/1  00:00:00 /usr/bin/java -server -Xmx2048m -XX:MaxDirectMemorySize=512m -Dsun.net.inetaddr.ttl=1800 -Dorg.globus.tcp.port.range=20000,25000 -Djava.net.preferIPv4Stack=true -Dorg.dcache.dcap.port=0 -Dorg.dcache.net.tcp.portran
ge=33115:33145 -Dorg.globus.jglobus.delegation.cache.lifetime=30000 -Dorg.globus.jglobus.crl.cache.lifetime=60000 -Djava.security.krb5.realm=EXAMPLE.ORG -Djava.security.krb5.kdc=localhost -Djavax.security.auth.useSubjectCredsOnly=false -Djava.security.auth.login.config=/etc/dcache/jgss.conf -XX:+Hea
pDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/log/dcache/dCacheDomain-oom.hprof -javaagent:/usr/share/dcache/classes/spring-instrument-3.2.2.RELEASE.jar -Djava.awt.headless=true -DwantLog4jSetup=n -Ddcache.home=/usr/share/dcache -Ddcache.paths.defaults=/usr/share/dcache/defaults org.dcache.boot.Boot
Loader start dCacheDomain
1 S root     17949 17946 17953  0  322  80   0 - 1207154 futex_ Jul25 pts/1  00:00:01 /usr/bin/java -server -Xmx2048m -XX:MaxDirectMemorySize=512m -Dsun.net.inetaddr.ttl=1800 -Dorg.globus.tcp.port.range=20000,25000 -Djava.net.preferIPv4Stack=true -Dorg.dcache.dcap.port=0 -Dorg.dcache.net.tcp.portran
ge=33115:33145 -Dorg.globus.jglobus.delegation.cache.lifetime=30000 -Dorg.globus.jglobus.crl.cache.lifetime=60000 -Djava.security.krb5.realm=EXAMPLE.ORG -Djava.security.krb5.kdc=localhost -Djavax.security.auth.useSubjectCredsOnly=false -Djava.security.auth.login.config=/etc/dcache/jgss.conf -XX:+Hea
pDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/log/dcache/dCacheDomain-oom.hprof -javaagent:/usr/share/dcache/classes/spring-instrument-3.2.2.RELEASE.jar -Djava.awt.headless=true -DwantLog4jSetup=n -Ddcache.home=/usr/share/dcache -Ddcache.paths.defaults=/usr/share/dcache/defaults org.dcache.boot.Boot
Loader start dCacheDomain

Specify the output format

-o option
ps -C postmaster -o pid,tid,pcpu,state,nlwp,args

8.Sort option, --sort

$ ps jax --sort=uid,-ppid,+pid
 PPID   PID  PGID   SID TTY      TPGID STAT   UID   TIME COMMAND
 3143  3147  3143  3143 ?           -1 S        0   0:00 (sd-pam)
 1048  1076  1076  1076 tty1      1076 Rs+      0   7:12 /usr/bin/Xorg :0 -background none -verbose -auth /run/gdm/auth-for-gdm-00pQFt/database -seat seat0 
 1048  1739   888   888 ?           -1 Sl       0   0:00 gdm-session-worker [pam/gdm-password]
  954  1406  1406   954 ?           -1 S        0   0:00 /sbin/dhclient -d -sf /usr/libexec/nm-dhcp-helper -pf /var/run/dhclient-p4p1.pid -lf /var/lib/Netwo
  888  1048   888   888 ?           -1 Sl       0   0:00 /usr/libexec/gdm-simple-slave --display-id /org/gnome/DisplayManager/Displays/_0
  838   839   838   838 ?           -1 S<       0   0:00 /usr/sbin/sedispatch
  828   838   838   838 ?           -1 S<sl     0   0:00 /sbin/audispd

Where

a      Lift the BSD-style "only yourself" restriction
j      BSD job control format
x      Lift the BSD-style "must have a tty" restriction
--sort spec     specify sorting order. Sorting syntax is [+|-]key[,[+|-]key[,...]] Choose a multi-letter key from the STANDARD FORMAT SPECIFIERS section. The "+" is optional since default direction is increasing numerical or lexicographic order. Identical to k.