Linux · process & service management

ps

what is running

ps prints a snapshot of the process table. ps aux is the form to remember: every process, from every user, with its owner and resource use. The number in the PID column is the handle every other management command needs.

Everything running on the machine is a process with a number and an owner — and ps is the list.

Shows

A snapshot

not a live view — that is top

Everyday form

ps aux

all users, with details

Key column

PID

the process ID

Tree view

ps -ef --forest

who started what

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashprocps

$ ps aux --sort=-%mem | head -5

1USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND

2mysql 934 1.2 11.4 1789432 462180 ? Ssl Sep28 41:07 /usr/sbin/mysqld

3user 4120 3.8 4.1 1104332 166924 pts/0 Sl+ 09:58 0:42 node server.js

4root 1 0.0 0.3 168940 11560 ? Ss Sep28 0:14 /sbin/init

root 801 0.0 0.2 15432 9120 ? Ss Sep28 0:00 sshd: /usr/sbin/sshd -D

Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range

Reading the output

What the numbered lines are telling you

RSS is the memory that matters

RSS is the physical memory in use, in kibibytes. VSZ is everything the process has reserved, most of which it may never touch.

A question mark means no terminal

mysqld is a daemon: nobody typed it into a shell. In STAT, S is sleeping, s a session leader and l multi-threaded.

pts/0 is somebody's terminal

This one was started by hand in a shell. The + in STAT says it is in the foreground of that terminal.

PID 1 is the first process

init — systemd on most systems — is started by the kernel and is the ancestor of everything else.

Switches

A switch changes how the command behaves. These are the ones used day to day; man ps lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

aux: BSD style, no dash: every process, with its owner, CPU and memory use.
-e: Every process on the system. -A is the same.
-f: Full format: adds the parent process id and the full command line.
-u USER: Only the processes belonging to this user.
-p PID: Only the process with this id.
--forest: Draw parent and child processes as a tree.
-o FIELDS: Choose the columns yourself, for example -o pid,user,%cpu,cmd.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

ps -ef --forest

Draws the parent-child tree, so you can see which process started which.

ps -u www-data

Only the processes owned by one user.

pgrep -a nginx

Finds processes by name and prints their PIDs — tidier than piping ps into grep.

top

The same table, refreshed live and sorted by CPU. Press q to leave.

In cybersecurity

The process list is the inventory of what the machine is actually doing, and it is visible to every local user by default.

Secrets on the command line

Arguments appear in the COMMAND column for everyone to read. A password passed as a flag is a password published.

Processes that do not belong

An unfamiliar name, a binary running from /tmp, or a web-server user running a shell are all classic signs of a compromise.

Who it runs as

The USER column is the blast radius. A service that does not need root should not appear here as root.

Filed under

Process & service management

Read alongside

killSends a signal to a process — by default a polite request to finish, and with -9 an order the process cannot refuse.systemctlControls systemd services — start, stop, restart, enable at boot — and reports the state of each one.