ps — the go-to command for listing running processes.

What ps does

ps shows snapshots of processes. You can list all processes, filter by user/PID, choose columns, and sort.

Two styles of options exist. Don’t mix them:

·         BSD style: ps aux

·         SysV/POSIX (GNU): ps -ef, ps -eo ...
Stick to one style per command.

Quick recipes you’ll use a lot

ps           # your own processes in a simple format

ps -ef       # (SysV) every process, full format

ps aux       # (BSD)  every process, full format

# Top CPU / RAM consumers (GNU ps)

ps -eo pid,ppid,comm,pcpu,pmem --sort=-pcpu | head

ps -eo pid,ppid,comm,pcpu,pmem --sort=-pmem | head

# One specific PID (nice for scripts)

ps -p 1234 -o pid,ppid,tty,stat,etime,cmd

# Filter by user or by exact command name

ps -u alice -o pid,cmd,pcpu,pmem

ps -C nginx -o pid,cmd,pcpu,pmem        # exact *command* name

# Show a process tree (parents → children)

ps -ejH                                   # tree with threads (Linux)

ps -eo pid,ppid,cmd --forest              # ASCII tree

# Only processes attached to a terminal (e.g., pts/0)

ps -t pts/0 -o pid,tty,stat,cmd

Read the common columns (you’ll see these)

·         PID: process ID

·         PPID: parent PID

·         USER / UID: owner

·         %CPU / %MEM (or pcpu/pmem): usage since last refresh

·         VSZ (vsz): virtual memory size (KiB)

·         RSS (rss): resident (actual RAM) in KiB

·         TTY: controlling terminal (e.g., pts/1); ? for daemons

·         STAT: state codes (see below)

·         TIME / TIME+: total CPU time used

·         START / STIME: start time of process

·         COMMAND / CMD / ARGS: program (with args if you choose args/cmd/command)

STAT (state) quick decoder

·         R running, S sleeping, D uninterruptible I/O, T stopped, Z zombie

·         Modifiers you might see: < high-priority, N low-priority (niced), s session leader, l multithreaded, + in foreground group.

Choose your own columns with -o

Pick only what you need (great for scripting):

# Full command line and runtime

ps -eo pid,ppid,uid,user,tty,stat,etime,pcpu,pmem,args

# Current shell (note: $$ = PID of your shell)

ps -p $$ -o pid,ppid,stat,etime,cmd

Useful names: pid,ppid,uid,user,tty,stat,etime,time,pcpu,pmem,vsz,rss,ni,pri,lstart,comm,args,command

Sorting (GNU ps --sort)

# Highest CPU first, then memory

ps -eo pid,comm,pcpu,pmem --sort=-pcpu,-pmem | head

# Biggest RAM first

ps -eo pid,comm,rss --sort=-rss | head

Sort keys: pid,ppid,pcpu,pmem,rss,vsz,time,etime,start_time (prefix - for descending).

Grep vs pgrep (tip)

You’ll often see:

ps -ef | grep python | grep -v grep

Better:

pgrep -fl python      # list PIDs & names

pkill -f python       # kill by pattern (careful!)

(But ps is still the foundation for snapshots, custom columns, and trees.)

Common pitfalls

·         Mixing styles (ps aux -ef) → wrong output; use either BSD or SysV/GNU, not both.

·         Hidden kernel/daemon procs: they’ll show ? under TTY (no terminal).

·         Full command line truncated: use args/command and a wide terminal (stty size or COLUMNS=200 ps ...).

Mini-labs (15–20 min)

A) Who’s using CPU / memory?

ps -eo pid,comm,pcpu --sort=-pcpu | head

ps -eo pid,comm,rss --sort=-rss  | head

B) Watch one process evolve

sleep 200 &                 # start something (note PID: echo $!)

ps -p $! -o pid,ppid,stat,etime,cmd

C) Process tree

ps -eo pid,ppid,cmd --forest | head -n 30

D) Filter by user & terminal

whoami

ps -u "$(whoami)" -o pid,tty,stat,cmd

Exam-ready bullets

·         ps shows a snapshot of processes; top is live.

·         Two styles: ps -ef (SysV) or ps aux (BSD) — don’t mix.

·         Use -o to select columns, --sort to order, -p for specific PIDs, -u for user, -C for command name.

·         Read STAT codes; know PID/PPID/TTY/%CPU/%MEM/RSS/VSZ/ETIME/CMD.

·         Show trees with ps -ejH or --forest.

·         Prefer pgrep/pkill for matching by name; use ps for custom, scriptable snapshots.

Want this + top + free on a one-page monitoring cheat sheet? I can format it for print.