ps Command in Linux: See What Is Running Now

ps reports the processes running on the machine: what is executing, who started it, and how much CPU and memory each one is using. It is a single snapshot — the still photo next to top's live video — and it is what scripts reach for.

The two styles #

ps descends from two unix lineages, and the flag styles betray which:

BSD style: every process, full detail

$ ps aux

System V style: every process, full format

$ ps -ef

Both list everything; pick one and stay consistent. In aux output the columns that matter are %CPU, %MEM, and the command at the end.

Reading the columns #

Column	Meaning
PID	Process ID — what you pass to kill
USER	Owning user
%CPU / %MEM	Share of CPU and physical memory
VSZ / RSS	Virtual / resident memory in kilobytes
STAT	State: `R` running, `S` sleeping, `Z` zombie, `D` waiting on disk
TIME	Cumulative CPU time used
COMMAND	The program and its arguments

Finding your process #

The full list is long; grep is the filter:

Find a process by name

$ ps aux | grep nginx

Better still, pgrep does the same without matching itself:

Get just the PIDs, with names

$ pgrep -a nginx

Trees and threads #

Show the parent-child hierarchy

$ ps axjf | head -30
$ ps -fC node

The tree view answers "who spawned this?" — invaluable when a stray process refuses to explain itself. The second form prints full details for one command name only.

Once you have the PID, kill is how you act on it. More process notes and the rest of the series live in the journal.