Linux ps Command

last modified October 18, 2026

The ps command displays information about running processes. It shows a snapshot of the processes on the system, including their process IDs (PIDs), owners, CPU and memory usage, and command lines. This tutorial covers basic and advanced usage of ps with practical examples.

ps is commonly used to find a process before sending it a signal, to check which programs are consuming resources, and to inspect parent-child relationships between processes.

The examples use ps from procps-ng, which is common on Linux. Options and output formats may differ in other implementations.

Display Processes for the Current Terminal

With no options, ps shows the processes associated with the current terminal and effective user.

ps_basic.sh

$ ps
    PID TTY          TIME CMD
   4216 pts/0    00:00:00 bash
   4271 pts/0    00:00:00 ps

The output contains four columns: the process ID, the controlling terminal, the cumulative CPU time, and the command name. The output is a snapshot; it does not update when processes start or finish.

Display All Processes

The aux options are the most common way to show every process on the system with user-oriented details.

ps_all.sh

$ ps aux
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root           1  0.0  0.1 166756 10276 ?        Ss   09:12   0:02 /sbin/init
root         812  0.0  0.0  55236  3140 ?        Ss   09:12   0:00 /usr/sbin/cron -f
jano        4216  0.0  0.0  12344  5678 pts/0    Ss   10:01   0:00 bash
jano        4271  0.0  0.0  11264  3456 pts/0    R+   10:05   0:00 ps aux

The letters in aux are not options with dashes. a selects all processes with a terminal, u selects the user-oriented format, and x includes processes without a controlling terminal. Important columns are %CPU, %MEM, VSZ (virtual memory size), RSS (resident set size), STAT (process state), and COMMAND.

%CPU is CPU time divided by elapsed process lifetime, not an instantaneous utilization measurement. VSZ and RSS are reported in KiB.

Display a Full-Format Listing

The -e option selects every process and -f produces a full-format listing with the parent PID.

ps_full.sh

$ ps -ef
UID          PID    PPID  C STIME TTY          TIME CMD
root           1       0  0 09:12 ?        00:00:02 /sbin/init
root         812       1  0 09:12 ?        00:00:00 /usr/sbin/cron -f
jano        4216    4200  0 10:01 pts/0    00:00:00 bash
jano        4271    4216  0 10:05 pts/0    00:00:00 ps -ef

The PPID column is especially useful. It identifies the parent process, which lets you follow how a process was started. C is the processor utilization, STIME is the start time, and CMD is the command line.

Select Specific Columns

The -o option lets you choose exactly which columns to display. This is useful when you need a compact report or when the output is consumed by a script.

ps_columns.sh

$ ps -eo pid,ppid,user,%cpu,%mem,comm --sort=-%cpu | head
    PID    PPID USER     %CPU %MEM COMMAND
   4388    1986 jano      4.9  4.6 kilo
   3665    1986 jano      2.5  3.0 code
   4216    4200 jano      0.0  0.0 bash

-e selects all processes and -o takes a comma-separated list of columns. The --sort=-%cpu option sorts by CPU usage in descending order; a leading minus means descending. The head command limits the output to the first ten lines.

Filter Processes by User

Use -u to show only processes owned by a specific user.

ps_user.sh

$ ps -u jano -o pid,comm
    PID COMMAND
   4216 bash
   4302 brave
   4318 code

The argument can be a user name or a numeric UID. The capital -U option filters by the real user ID, while -u filters by the effective user ID. The difference matters for setuid programs.

Find Processes by Name

The -C option selects processes by their executable name. The name must match exactly; it is not a regular expression.

ps_name.sh

$ ps -C nginx -o pid,ppid,comm
    PID    PPID COMMAND
    812       1 nginx
    815     812 nginx

For pattern matching, use pgrep instead. The -a option prints the full command line next to each PID.

$ pgrep -a nginx
812 nginx: master process /usr/sbin/nginx
815 nginx: worker process

Inspect a Specific PID

The -p option selects processes by PID. Combined with -o, it is a convenient way to inspect a single process.

ps_pid.sh

$ ps -ww -p 812 -o pid,ppid,user,%cpu,%mem,args
    PID    PPID USER     %CPU %MEM COMMAND
    812       1 root      0.0  0.1 nginx: master process /usr/sbin/nginx

The args column (also called cmd or command) displays the command line with arguments. Use comm for the executable name. The -ww option avoids normal output-width truncation of the command line.

Display a Process Tree

The --forest option draws a tree based on parent-child relationships.

ps_tree.sh

$ ps -ef --forest
UID          PID    PPID  C STIME TTY          TIME CMD
root           1       0  0 09:12 ?        00:00:02 /sbin/init
root         812       1  0 09:12 ?        00:00:00  \_ nginx: master process
www-data     815     812  0 09:12 ?        00:00:00      \_ nginx: worker process
jano        4216    4200  0 10:01 pts/0    00:00:00 bash
jano        4271    4216  0 10:05 pts/0    00:00:00  \_ ps -ef --forest

The tree makes it easy to see which service started a worker process. Use pstree for a dedicated process-tree display, or top and htop for continuously updated monitoring.

Sort Processes by Memory Usage

The --sort option works with most output columns. This example shows the processes using the most resident memory.

ps_memory.sh

$ ps aux --sort=-%mem | head -n 5
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
jano        4388  4.9  4.6 13436060 751408 ?      Ssl  18:29  11:12 kilo serve
jano        3665  2.5  3.0 1518567036 489176 ?   Sl   18:29   5:42 code
jano        2577  1.9  2.6 55592680 433824 ?      Sl   18:29   4:24 brave
root           1  0.0  0.1 166756 10276 ?        Ss   18:29   0:02 /sbin/init

Use --sort=-%cpu to rank by CPU instead. Since the output is sorted by ps itself, you do not need to pipe it through sort.

Best Practices for ps

Choose the Right Format: Use ps aux for a quick overview and ps -eo when you need predictable columns.
Filter Early: Use -u, -C, or -p to reduce noise before inspecting the output.
Remember It Is a Snapshot: Use top or htop for continuous, real-time monitoring.
Use pgrep for PIDs: Use pgrep or pidof when you only need process IDs for another command.
Sort and Limit: Combine --sort with head to find resource-heavy processes quickly.

Source

Linux ps Manual

In this article, we have explored various examples of using the ps command for listing processes, selecting output columns, filtering by user and name, inspecting a PID, and displaying process trees.

Author

My name is Jan Bodnar, and I am a passionate programmer with extensive programming experience. I have been writing programming articles since 2007. To date, I have authored over 1,400 articles and 8 e-books. I possess more than ten years of experience in teaching programming.

List all Linux tutorials.

Ebooks