ps
report a snapshot of the current processes.
see also :
pgrep - pstree - top
Synopsis
ps
[options]
add an example, a script, a trick and tips
examples
To see every process on the system using standard syntax:
ps -e
ps -ef
ps -eF
ps -ely
To see every process on the system using BSD syntax:
ps ax
ps axu
To print a process tree:
ps -ejH
ps axjf
To get info about threads:
ps -eLf
ps axms
To get security info:
ps -eo euser,ruser,suser,fuser,f,comm,label
ps axZ
ps -eM
To see every process running as root
(real & effective ID) in user
format:
ps -U root -u root u
To see every process with a user-defined format:
ps -eo pid,tid,class,rtprio,ni,pri,psr,pcpu,stat,wchan:14,comm
ps axo stat,euid,ruid,tty,tpgid,sess,pgrp,ppid,pid,pcpu,comm
ps -Ao pid,tt,user,fname,tmout,f,wchan
Print only the process IDs of syslogd:
ps -C syslogd -o pid=
Print only the name of PID 42:
ps -p 42 -o comm=
ps aux | grep [m]ysql
##What does it do ?
Output process info of my_process and prevents 'grep' from showing up in the results. Really handy when you really need only the active process, for instance if you want to get the pid:
ps aux | grep [m]ysql | awk '{print $2}'
##Output:
root 2898 0.0 0.0 4176 720 ? S 13:06 0:00 /bin/sh /usr/bin/mysqld_safe
mysql 3283 0.0 0.6 363160 50932 ? Sl 13:06 0:22 /usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --plugin-dir=/usr/lib/mysql/plugin --user=mysql --pid-file=/var/run/mysqld/mysqld.pid --socket=/var/run/mysqld/mysqld.sock --port=3306
root 3284 0.0 0.0 4084 636 ? S 13:06 0:00 logger -t mysqld -p daemon.error
thomasXX 4348 0.0 0.3 331388 30884 ? Sl 13:07 0:22 /usr/sbin/mysqld --defaults-file=/o/.local/share/akonadi/mysql.conf --datadir=/o/.local/share/akonadi/db_data/ --socket=/o/.local/share/akonadi/socket-bowBeforeCed/mysql.socket
example added by Thomasa
ps axu | more
## What does it do ?
List all the processes currently running, even those without the controlling terminal, together with the name of the user that owns each process.
example added by LeBerger
source
ps aux output meaning
The first row of the output tells you. Beyonds that try man
ps
for more details.
$ ps aux | more
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.0 10312 716 ? Ss 2009 0:41 init [2]
root 2 0.0 0.0 0 0 ? S< 2009 0:00 [kthreadd]
...
root 25568 0.0 0.0 19884 1144 ? S 09:36 0:00 hald-addon-storage: poll
mctaylor 25607 12.3 2.1 730920 175924 ? Sl 09:37 1:13 /usr/lib/iceweasel/firef
mctaylor 25698 0.0 0.0 241500 7596 ? S 09:45 0:00 kio_http [kdeinit] http
mctaylor 25699 0.0 0.0 175964 7728 ? S 09:45 0:00 kio_http [kdeinit] http
mctaylor 25710 0.0 0.0 17432 1100 pts/5 R+ 09:47 0:00 ps aux
mctaylor 25711 0.0 0.0 10736 648 pts/5 S+ 09:47 0:00 tail
root 26130 0.0 0.0 26564 1140 ? Ss Feb04 0:00 /usr/bin/system-tools-b
root 27915 0.0 0.0 48864 1176 ? Ss Feb05 0:00 /usr/sbin/sshd
mctaylor 31607 0.0 0.0 149188 3864 ? Ssl Feb23 0:00 /usr/lib/bonobo-activati
root 32149 0.0 0.0 3796 580 tty1 Ss+ Feb26 0:00 /sbin/getty 38400 tty1
source
How can I know the absolute path of a running process?
source
ps: How can i recursively get all child process for a given pid
pstree ${pid}
where ${pid} is the pid of the parent process.
On gentoo pstree is in the package "psmisc," apparently located
at http://psmisc.sourceforge.net/
source
Why does my system hang when I run ps, w and possibly other commands?
I had that happen once when an NFS server went down.
The fact that it's hung trying to read information about pid
17398, and pid 17398 is in D
(disk wait) state,
suggests that could be the cause for you too.
read(6, "Name:\tconvert\nState:\tD (disk sle"..., 1023) = 664
open("/proc/17398/cmdline", O_RDONLY) = 6
If you do have NFS mounts, I think the best option is to try to
bring the NFS server back up.
Otherwise, umount -f <mount>
might help.
source
Why does ps aux displays a number instead of a username?
This is most like user's id (uid) for a user which was removed
after the process was started. Or perhaps there was some kind of
failure resolving username from uid.
source
How to find out from which folder a process is running?
You can't tell where a process was invoked from, only
where it currently is. Look at the cwd
("current working directory") link instead of exe
.
source
why ps -ef show the time like this
man ps
says
cputime TIME cumulative CPU time, "[dd-]hh:mm:ss" format. (alias time).
So your Java process has been running for 1184018564 CPU days
(about 3,243,886 CPU years), OR ... something bad has happened.
It is Ubuntu bug #859311 associated with
long-running multi-threaded processes.
source
Unix : List children processes for a given pid
This should work:
ps h --ppid $PID -o pid
source
find any script which is running for more than say 30 minutes in Linux System
the ps
command has an etimes
field,
that gives you the time since a given process has been started,
in seconds.
the following bash script will output the PIDs of processes that
have been running for longer than 30 minutes.
#!/bin/sh
MIN=30
SEC=$((MIN*60))
ps -eo etimes=,pid= | while read sec pid; do
if [ ${sec} -gt ${SEC} ]; then
echo ${pid}
fi
done
source
Is it possible to 'hide' a process from the listing of `ps` or `top` on Linux
Well, you have a couple of options here. Taking the easy way out
would be to swap the ps and top programs out with modified
versions that hide what it is you want to hide.
The alternative would be to run your code embedded in an existing
process, or write a wrapper-script around your code with an
innocuous name.
In some versions of PS, you can modify it by changing argv[], but
not sure if that works for top, and not sure if it works in linux
(It's mainly a BSD convention).
It all depends, on exactly what you are looking to achieve by
doing this?
description
ps
displays information about a selection of the active
processes. If you want a repetitive update of the selection
and the displayed information, use top(1)
instead.
This version of
ps accepts several kinds of options:
1
UNIX options, which may be grouped and must be preceded
by a dash.
2
BSD options, which may be grouped and must not be used
with a dash.
3
GNU long options, which are preceded by two dashes.
Options of
different types may be freely mixed, but conflicts can
appear. There are some synonymous options, which are
functionally identical, due to the many standards and
ps implementations that this ps is compatible
with.
Note that
"ps -aux" is distinct from
"ps aux". The POSIX and UNIX standards
require that "ps -aux" print all
processes owned by a user named "x", as well as
printing all processes that would be selected by the
-a option. If the user named "x" does
not exist, this ps may interpret the command as
"ps aux" instead and print a warning.
This behavior is intended to aid in transitioning old
scripts and habits. It is fragile, subject to change, and
thus should not be relied upon.
By default,
ps selects all processes with the same effective user
ID (euid=EUID) as the current user and associated with the
same terminal as the invoker. It displays the process ID
(pid=PID), the terminal associated with the process
(tname=TTY), the cumulated CPU time in [DD-]hh:mm:ss
format (time=TIME), and the executable name (ucmd=CMD).
Output is unsorted by default.
The use of
BSD-style options will add process state (stat=STAT)
to the default display and show the command args
(args=COMMAND) instead of the executable name. You can
override this with the PS_FORMAT environment
variable. The use of BSD-style options will also
change the process selection to include processes on other
terminals (TTYs) that are owned by you; alternately, this
may be described as setting the selection to be the set of
all processes filtered to exclude processes owned by other
users or not on a terminal. These effects are not considered
when options are described as being "identical"
below, so -M will be considered identical to
Z and so on.
Except as
described below, process selection options are additive. The
default selection is discarded, and then the selected
processes are added to the set of processes to be displayed.
A process will thus be shown if it meets any of the given
selection criteria.
aix format descriptors
This ps supports AIX format descriptors, which work
somewhat like the formatting codes of printf(1) and
printf(3). For example, the normal default output can be
produced with this: ps -eo "%p %y %x %c". The
NORMAL codes are described in the next section.
environment variables
The following environment variables could affect ps:
COLUMNS
Override default display width.
LINES
Override default display height.
PS_PERSONALITY
Set to one of posix, old, linux, bsd, sun, digital... (see
section PERSONALITY below).
CMD_ENV
Set to one of posix, old, linux, bsd, sun, digital... (see
section PERSONALITY below).
I_WANT_A_BROKEN_PS
Force obsolete command line interpretation.
LC_TIME
Date format.
PS_COLORS
Not currently supported.
PS_FORMAT
Default output format override. You may set this to a format
string of the type used for the -o option. The
DefSysV and DefBSD values are particularly useful.
PS_SYSMAP
Default namelist (System.map) location.
PS_SYSTEM_MAP
Default namelist (System.map) location.
POSIXLY_CORRECT
Don’t find excuses to ignore bad "features".
POSIX2
When set to "on", acts as POSIXLY_CORRECT.
UNIX95
Don’t find excuses to ignore bad "features".
_XPG
Cancel CMD_ENV=irix non-standard behavior.
In general, it is a bad idea to set these variables. The one
exception is CMD_ENV or PS_PERSONALITY, which could
be set to Linux for normal systems. Without that setting,
ps follows the useless and bad parts of the Unix98
standard.
notes
This ps works by reading the virtual files in /proc. This
ps does not need to be setuid kmem or have any privileges
to run. Do not give this ps any special permissions.
This ps needs access to namelist data for proper WCHAN
display. For kernels prior to 2.6, the System.map file must be
installed.
CPU usage is currently expressed as the percentage of time spent
running during the entire lifetime of a process. This is not
ideal, and it does not conform to the standards that
ps otherwise conforms to. CPU usage is unlikely to add up
to exactly 100%.
The SIZE and RSS fields don’t count some parts of a process
including the page tables, kernel stack, struct thread_info, and
struct task_struct. This is usually at least 20 KiB of memory
that is always resident. SIZE is the virtual size of the process
(code+data+stack).
Processes marked <defunct> are dead processes (so-called
"zombies") that remain because their parent has not destroyed
them properly. These processes will be destroyed by
init(8) if the parent process exits.
If the length of the username is greater than the length of the
display column, the numeric user ID is displayed instead.
obsolete sort keys
These keys are used by the BSD O option (when it is used
for sorting). The GNU --sort option doesn’t use these
keys, but the specifiers described below in the STANDARD
FORMAT SPECIFIERS section. Note that the values used in
sorting are the internal values ps uses and not the
"cooked" values used in some of the output format fields (e.g.
sorting on tty will sort into device number, not according to the
terminal name displayed). Pipe ps output into the
sort(1) command if you want to sort the cooked values.
other information
--help section
Print a help message. The section argument can be one of
simple, list, output, threads,
misc or all. The argument can be shortened to one
of the underlined letters as in: s|l|o|t|m|a.
--info
Print debugging info.
L
List all format specifiers.
V
Print the procps-ng version.
-V
Print the procps-ng version.
--version
Print the procps-ng version.
output format control
These options are used to choose the information displayed by
ps. The output may differ by personality.
-c
Show different scheduler information for the -l option.
--context
Display security context format (for SE Linux).
-f
Do full-format listing. This option can be combined with many
other UNIX-style options to add additional columns. It also
causes the command arguments to be printed. When used with
-L, the NLWP (number of threads) and LWP (thread ID)
columns will be added. See the c option, the format
keyword args, and the format keyword comm.
-F
Extra full format. See the -f option, which -F
implies.
--format format
user-defined format. Identical to -o and o.
j
BSD job control format.
-j
Jobs format.
l
Display BSD long format.
-l
Long format. The -y option is often useful with this.
-M
Add a column of security data. Identical to Z (for SE
Linux).
O format
is preloaded o (overloaded). The BSD O option can
act like -O (user-defined output format with some common
fields predefined) or can be used to specify sort order.
Heuristics are used to determine the behavior of this option. To
ensure that the desired behavior is obtained (sorting or
formatting), specify the option in some other way (e.g. with
-O or --sort). When used as a formatting option, it
is identical to -O, with the BSD personality.
-O format
Like -o, but preloaded with some default columns.
Identical to
-o pid,format,state,tname,time,command
or -o pid,format,tname, time,cmd, see
-o below.
o format
Specify user-defined format. Identical to -o and
--format.
-o format
User-defined format. format is a single argument in the
form of a blank-separated or comma-separated list, which offers a
way to specify individual output columns. The recognized keywords
are described in the STANDARD FORMAT SPECIFIERS section
below. Headers may be renamed (ps -o pid,ruser=RealUser -o
comm=Command) as desired. If all column headers are empty
(ps -o pid= -o comm=) then the header line will not be
output. Column width will increase as needed for wide headers;
this may be used to widen up columns such as WCHAN (ps -o
pid,wchan=WIDE- WCHAN-COLUMN -o comm). Explicit width control
(ps opid, wchan:42,cmd) is offered too. The behavior of
ps -o pid=X, comm=Y varies with personality; output may be
one column named "X,comm=Y" or two columns named "X" and "Y". Use
multiple -o options when in doubt. Use the
PS_FORMAT environment variable to specify a default as
desired; DefSysV and DefBSD are macros that may be used to choose
the default UNIX or BSD columns.
s
Display signal format.
u
Display user-oriented format.
v
Display virtual memory format.
X
Register format.
-y
Do not show flags; show rss in place of addr. This option can
only be used with -l.
Z
Add a column of security data. Identical to -M (for SE
Linux).
output modifiers
c
Show the true command name. This is derived from the name of the
executable file, rather than from the argv value. Command
arguments and any modifications to them are thus not shown. This
option effectively turns the args format keyword into the
comm format keyword; it is useful with the -f
format option and with the various BSD-style format options,
which all normally display the command arguments. See the
-f option, the format keyword args, and the format
keyword comm.
--cols n
Set screen width.
--columns n
Set screen width.
--cumulative
Include some dead child process data (as a sum with the parent).
e
Show the environment after the command.
f
ASCII art process hierarchy (forest).
--forest
ASCII art process tree.
h
No header. (or, one header per screen in the BSD personality).
The h option is problematic. Standard BSD ps uses
this option to print a header on each page of output, but older
Linux ps uses this option to totally disable the header.
This version of ps follows the Linux usage of not printing
the header unless the BSD personality has been selected, in which
case it prints a header on each page of output. Regardless of the
current personality, you can use the long options
--headers and --no-headers to enable printing
headers each page or disable headers entirely, respectively.
-H
Show process hierarchy (forest).
--headers
Repeat header lines, one per page of output.
k spec
Specify sorting order. Sorting syntax is
[+|-]key[,[+|-]key[,...]].
Choose a multi-letter key from the STANDARD FORMAT
SPECIFIERS section. The "+" is optional since default
direction is increasing numerical or lexicographic order.
Identical to --sort.
Examples:
ps jaxkuid,-ppid,+pid
ps axk comm o comm,args
ps kstart_time -ef
--lines n
Set screen height.
-n namelist
Set namelist file. Identical to N. The namelist file is
needed for a proper WCHAN display, and must match the current
Linux kernel exactly for correct output. Without this option, the
default search path for the namelist is:
$PS_SYSMAP
$PS_SYSTEM_MAP
/proc/*/wchan
/boot/System.map-$(uname -r)
/boot/System.map
/lib/modules/$(uname -r)/System.map
/usr/src/linux/System.map
/System.map
n
Numeric output for WCHAN and USER (including all types of UID and
GID).
N namelist
Specify namelist file. Identical to -n, see -n
above.
--no-headers
Print no header line at all. --no-heading is an alias for
this option.
O order
Sorting order (overloaded). The BSD O option can act like
-O (user-defined output format with some common fields
predefined) or can be used to specify sort order. Heuristics are
used to determine the behavior of this option. To ensure that the
desired behavior is obtained (sorting or formatting), specify the
option in some other way (e.g. with -O or --sort).
For sorting, obsolete BSD O option syntax is
O[+|-]k1[,[+|-]k2[,...]].
It orders the processes listing according to the multilevel sort
specified by the sequence of one-letter short keys
k1,k2, ... described in the OBSOLETE SORT
KEYS section below. The "+" is currently optional,
merely re-iterating the default direction on a key, but may help
to distinguish an O sort from an O format. The "-"
reverses direction only on the key it precedes.
--rows n
Set screen height.
S
Sum up some information, such as CPU usage, from dead child
processes into their parent. This is useful for examining a
system where a parent process repeatedly forks off short-lived
children to do work.
--sort spec
Specify sorting order. Sorting syntax is
[+|-]key[,[+|-]key[,...]].
Choose a multi-letter key from the STANDARD FORMAT
SPECIFIERS section. The "+" is optional since default
direction is increasing numerical or lexicographic order.
Identical to k. For example: ps jax --sort=uid,-ppid,
+pid
w
Wide output. Use this option twice for unlimited width.
-w
Wide output. Use this option twice for unlimited width.
--width n
Set screen width.
personality
process flags
The sum of these values is displayed in the "F" column, which is
provided by the flags output specifier:
1
forked but didn’t exec
4
used super-user privileges
process selection by list
These options accept a single argument in the form of a
blank-separated or comma-separated list. They can be used
multiple times. For example:
ps -p "1 2" -p 3,4
-123
Identical to --pid 123.
123
Identical to --pid 123.
-C cmdlist
Select by command name. This selects the processes whose
executable name is given in cmdlist.
-G grplist
Select by real group ID (RGID) or name. This selects the
processes whose real group name or ID is in the grplist
list. The real group ID identifies the group of the user who
created the process, see getgid(2).
-g grplist
Select by session OR by effective group name. Selection by
session is specified by many standards, but selection by
effective group is the logical behavior that several other
operating systems use. This ps will select by session when
the list is completely numeric (as sessionsare). Group ID
numbers will work only when some group names are also specified.
See the -s and --group options.
--Group grplist
Select by real group ID (RGID) or name. Identical to -G.
--group grplist
Select by effective group ID (EGID) or name. This selects the
processes whose effective group name or ID is in
grouplist. The effective group ID describes the group
whose file access permissions are used by the process (see
getegid(2)). The -g option is often an alternative
to --group.
p pidlist
Select by process ID. Identical to -p and --pid.
-p pidlist
Select by PID. This selects the processes whose process ID
numbers appear in pidlist. Identical to p and
--pid.
--pid pidlist
Select by process ID. Identical to -p and p.
--ppid pidlist
Select by parent process ID. This selects the processes with a
parent process ID in pidlist. That is, it selects
processes that are children of those listed in pidlist.
-s sesslist
Select by session ID. This selects the processes with a session
ID specified in sesslist.
--sid sesslist
Select by session ID. Identical to -s.
t ttylist
Select by tty. Nearly identical to -t and --tty,
but can also be used with an empty ttylist to indicate the
terminal associated with ps. Using the T option is
considered cleaner than using t with an empty
ttylist.
-t ttylist
Select by tty. This selects the processes associated with the
terminals given in ttylist. Terminals (ttys, or screens
for text output) can be specified in several forms: /dev/ttyS1,
ttyS1, S1. A plain "-" may be used to select processes not
attached to any terminal.
--tty ttylist
Select by terminal. Identical to -t and t.
U userlist
Select by effective user ID (EUID) or name. This selects the
processes whose effective user name or ID is in userlist.
The effective user ID describes the user whose file access
permissions are used by the process (see geteuid(2)).
Identical to -u and --user.
-U userlist
Select by real user ID (RUID) or name. It selects the processes
whose real user name or ID is in the userlist list. The
real user ID identifies the user who created the process, see
getuid(2).
-u userlist
Select by effective user ID (EUID) or name. This selects the
processes whose effective user name or ID is in userlist.
The effective user ID describes the user whose file access
permissions are used by the process (see geteuid(2)).
Identical to U and --user.
--User userlist
Select by real user ID (RUID) or name. Identical to -U.
--user userlist
Select by effective user ID (EUID) or name. Identical to
-u and U.
process state codes
Here are the different values that the
s, stat and state output
specifiers (header "STAT" or "S") will display to describe the
state of a process:
D
uninterruptible sleep (usually IO)
R
running or runnable (on run queue)
S
interruptible sleep (waiting for an event to complete)
T
stopped, either by a job control signal or because it is being
traced
W
paging (not valid since the 2.6.xx kernel)
X
dead (should never be seen)
Z
defunct ("zombie") process, terminated but not reaped by its
parent
For BSD formats and when the stat keyword is used,
additional characters may be displayed:
<
high-priority (not nice to other users)
N
low-priority (nice to other users)
L
has pages locked into memory (for real-time and custom IO)
s
is a session leader
l
is multi-threaded (using CLONE_THREAD, like NPTL pthreads do)
+
is in the foreground process group
simple process selection
a
Lift the BSD-style "only yourself" restriction, which is imposed
upon the set of all processes when some BSD-style (without "-")
options are used or when the ps personality setting is
BSD-like. The set of processes selected in this manner is in
addition to the set of processes selected by other means. An
alternate description is that this option causes ps to
list all processes with a terminal (tty), or to list all
processes when used together with the x option.
-A
Select all processes. Identical to -e.
-a
Select all processes except both session leaders (see
getsid(2)) and processes not associated with a terminal.
-d
Select all processes except session leaders.
--deselect
Select all processes except those that fulfill the specified
conditions (negates the selection). Identical to -N.
-e
Select all processes. Identical to -A.
g
Really all, even session leaders. This flag is obsolete and may
be discontinued in a future release. It is normally implied by
the a flag, and is only useful when operating in the
sunos4 personality.
-N
Select all processes except those that fulfill the specified
conditions (negates the selection). Identical to
--deselect.
T
Select all processes associated with this terminal. Identical to
the t option without any argument.
r
Restrict the selection to only running processes.
x
Lift the BSD-style "must have a tty" restriction, which is
imposed upon the set of all processes when some BSD-style
(without "-") options are used or when the ps personality
setting is BSD-like. The set of processes selected in this manner
is in addition to the set of processes selected by other means.
An alternate description is that this option causes ps to
list all processes owned by you (same EUID as ps), or to
list all processes when used together with the a option.
standards
This ps conforms to:
1
Version 2 of the Single Unix Specification
2
The Open Group Technical Standard Base Specifications,
Issue 6
3
IEEE Std 1003.1, 2004 Edition
4
X/Open System Interfaces Extension [UP XSI]
5
ISO/IEC 9945:2003
standard format specifiers
Here are the different keywords that may be used to control the
output format (e.g. with option -o) or to sort the
selected processes with the GNU-style --sort option.
For example: ps -eo pid,user,args --sort user
This version of ps tries to recognize most of the keywords
used in other implementations of ps.
The following user-defined format specifiers may contain spaces:
args, cmd, comm, command, fname, ucmd, ucomm,
lstart, bsdstart, start.
Some keywords may not be available for sorting.
thread display
H
Show threads as if they were processes.
-L
Show threads, possibly with LWP and NLWP columns.
m
Show threads after processes.
-m
Show threads after processes.
-T
Show threads, possibly with SPID column.
see also
pgrep ,
pstree , top , proc.
author
ps was
originally written by Branko
Lankester (lankeste[:at:]fwi.uva[:dot:]nl). Michael K.
Johnson (johnsonm[:at:]redhat[:dot:]com) re-wrote it significantly to use the proc
filesystem, changing a few things in the process.
Michael Shields (mjshield[:at:]nyx.cs.du[:dot:]edu) added
the pid-list feature. Charles
Blake (cblake[:at:]bbn[:dot:]com) added multi-level sorting, the
dirent-style library, the device
name-to-number mmaped database, the approximate
binary search directly on System.map, and many code and
documentation cleanups. David Mossberger-Tang wrote
the generic BFD support for psupdate.
Albert Cahalan (albert[:at:]users.sf[:dot:]net) rewrote ps
for full Unix98 and BSD support, along with some ugly hacks
for obsolete and foreign syntax.
Please send bug
reports to
procps[:at:]freelists[:dot:]org (procps[:at:]freelists[:dot:]org). No
subscription is required or suggested.