Quick Links

Get a snapshot of the processes running in your Linux computer with the ps command. Locate processes by name, user, or even terminal with as much or as little detail as you need. We show you how.

Process Management on Linux

The beating heart of all Linux and Unix-like operating systems is the kernel. Amongst its many responsibilities is the allocation of system resources such as RAM and CPU time. These have to be juggled in real-time so that all running processes get their fair share, according to the priority of each task.

Sometimes tasks can lock-up, or enter a tight loop, or become unresponsive for other reasons. Or they may continue running, but gobble up too much CPU time or RAM, or behave in some equally anti-social way. Sometimes tasks need to be killed as a mercy to everyone involved. The first step. Of course, is to identify the process in question.

But maybe you don't have any task or performance issues at all. Perhaps you're just curious about which processes are running inside your computer, and you'd like to peek beneath the hood. The ps command satisfies both of these needs. It gives you a snapshot of what is happening inside your computer "right now."

ps is flexible enough to give you precisely the information you need in exactly the format you'd like it. In fact, ps has a great many options. The options described here will cater for most commonplace needs. If you need to go deeper into ps than we've taken it in this article, you'll find that our introduction makes the man page easier to digest.

Listing Processes

The easiest way to use ps is to fire it up with no parameters:

ps

ps in a terminal window

ps displays a list of the processes started by the user who ran the command.

output from ps in a terminal window

The four columns are:

  • PID: The process ID number of the process.
  • TTY: The name of the console that the user is logged in at.
  • TIME: The amount of CPU processing time that the process has used.
  • CMD: The name of the command that launched the process

Listing Process for All Users

by adding the -e (select all processes) we can make ps list the processes that have been started by all users, not just the user who is running the ps command. Because this is going to be a long list, we're piping it into less.

ps -e | less

ps -e | less ina terminal window

The process list is piped into less.

The output from ps -e piped into less in a terminal window

We've got many more entries in the list, but we see the same four columns as before. The entries with a question mark ? in the TTY column were not started from a terminal window.

Showing Process Hierarchy

Sometimes it can help to figure out an issue or identify a particular process if you can see which processes launched other processes. We use the -H (hierarchy) option to do so.

ps -eH | less

ps -eH | less in a terminal window

The indentation indicates which processes are parents of which other processes.

output from ps -eH in a less in a terminal window

To add a little more clarity, we can ask ps to add some ASCII lines and to draw the hierarchy as a tree. The option to do this is the --forest option.

ps -eH --forest | less

ps -eH --forest | less in a terminal window

This makes it easier to track which processes are the parents of other processes.

output of ps -eH --forest piped into less in a terminal window

Listing Processes by Name

You can pipe the output from ps through grep to list entries that have names that match the search term. Here we're looking for entries that match the "firefox" search term:

ps -e | grep firefox

ps -e | grep firefox in a terminal window

In this case, the output is a single entry for the process we are interested in. Of course, if we'd launched several instances of Firefox, there'd be more than one item returned in the list.

output from ps -e | grep firefox in a terminal window

Showing More Columns in the Output

To add more columns to the output, use the -f (full-format) option.

ps -ef | less

ps -ef | less in a terminal window

An extra set of columns are included in the output from ps.

output from ps -ef | less in a terminal window

The columns are:

  • UID: The user ID of the owner of this process.
  • PID: The process ID of the process.
  • PPID: Parent process ID of the process.
  • C: The number of children the process has.
  • STIME: Start time. The time when the process commenced.
  • TTY: The name of the console that the user is logged in at.
  • TIME: The amount of CPU processing time that the process has used.
  • CMD: The name of the command that launched the process.

By using the -F (extra full-format) option we can get even more columns:

ps -eF | less

ps -eF | less in a terminal window

The columns we get this time require the screen to be scrolled sideways to reveal them all.

output from ps -eF | less in a terminal window, left hand side of the display

Pressing the "Right Arrow" key shifts the display to the left.

output from ps -eF | less in a terminal window, right hand side of the display

The columns we now get are:

  • UID: The user ID of the owner of this process.
  • PID: The process ID of the process.
  • PPID: Parent process ID of the process.
  • C: The number of children the process has.
  • SZ: Size in RAM pages of the process image.
  • RSS: Resident set size. This is the non-swapped physical memory used by the process.
  • PSR: The processor that the process is assigned to.
  • STIME: Start time. The time when the process commenced.
  • TTY: The name of the console that the user is logged in at.
  • TIME: The amount of CPU processing time that the process has used.
  • CMD: The name of the command that launched the process.

Listing Processes by Process ID

Once you have found the process ID for the process you're interested in, you can use it with the ps command to list the details of that process.  Use the -p (select by process ID) option to achieve this:

ps -p 3403

ps -p 3403 in a terminal window

The details for this process are listed:

Output of ps -p 3403 in a terminal window

You are not restricted to one process ID. You can provide a list of process IDs, separated by spaces.

Listing Processes by Command

The -C (command) option lets you search for a process using the command name. That is, the name of the command that launched the process. This is subtly different from the command line, which might include path names and parameters or options.

ps -C shutter

ps -C shutter in a terminal window

The details for the shutter process are listed.

Listing Processes Owned by a User

To see the processes that are owned by a particular user, use the -u (user list) option:

ps -u mary

ps -u mary in a terminal window

The processes owned by the user account mary are displayed.

Output from ps -u mary in a terminal window

Listing Processes by Terminal

To see the processes associated with a TTY, use the -t (select by TTY) option. Used without a TTY number, the -t option reports on processes associated with the current terminal window.

tty

ps -t

ps -t in a terminal window

The tty command reports that this is pseudo-teletype 0. The processes listed by ps -t are all associated with TTY pts/0.

If we pass a TTY number on the command line, we should get a report of the processes associated with that TTY.

ps -t 1

ps -t 1 ina terminal window

This time the processes are all associated with TTY pts/1.

Related: What is a TTY on Linux? (and How to Use the tty Command)

Selecting Columns to Display

With the -o (format) option you can select which columns you want to have included in the output from ps. You specify the columns by name. The (long) list of column names can be seen on the man page in the section titled "Standard Format Specifiers." In this example, we're choosing to have the CPU time (pcpu) and the command line with arguments  (args) included in the output.

ps -e -o pcpu,args | less

ps -e -o pcpu,args | less in a terminal window

The output only includes our two requested columns.

output from ps -e -o pcpu,args | less in a terminal window

Sorting The Output by Columns

You can have the output sorted for you by using the --sort option. Let's sort the output by the CPU column:

ps -e -o pcpu,args --sort -pcpu| less

ps -e -o pcpu,args --sort -pcpu| less in a terminal window

The hyphen "-" on the pcpu sort parameter gives a descending sort order.

Output from ps sorted by cpu in a terminal window

To see the ten most CPU intensive processes, pipe the output through the head command:

ps -e -o pcpu,args --sort -pcpu | head -10

ps -e -o pcpu,args --sort -pcpu | head 10 in a terminal window

We get a sorted, truncated list.

output from ps -e -o pcpu,args --sort -pcpu | head 10 in a terminal window

If we add more columns to our display, we can sort by more columns. Let's add the pmem column. This is the percentage of the computer's memory that is being used by the process. Without a hyphen, or with a plus " +", the sort order is ascending.

ps -e -o pcpu,pmem,args --sort -pcpu,pmem | head -10

ps -e -o pcpu,pmem,args --sort -pcpu,pmem | head 10 in a terminal window

We get our extra column, and the new column is included in the sorting. The first column is sorted before the second column, and the second column is sorted in ascending order because we didn't put a hyphen on pmem.

Output from ps -e -o pcpu,pmem,args --sort -pcpu,pmem | head 10 in a terminal window

Let's make it a bit more useful and add in the process ID column (pid) so we can see the process number of each process in our listing.

ps -e -o pid,pcpu,pmem,args --sort -pcpu,pmem | head -10

ps -e -o pid,pcpu,pmem,args --sort -pcpu,pmem | head 10 in a terminal window

Now we can identify the processes.

Output from ps -e -o pid,pcpu,pmem,args --sort -pcpu,pmem | head 10

Killing Processes by Process ID

We've covered a range of ways to identify processes, including name, command, user, and terminal. We've also covered ways to identify processes by their dynamic attributes, such as CPU usage and memory.

So, one way or another, we can identify the processes that are running. By knowing their process ID, we can (if we need to) kill any of those processes using the kill command. If we wanted to kill process 898, we'd use this format:

sudo kill 898

sudo kill 898 in a terminal window

If all goes well, the process is silently terminated.

output from sudo kill 898 in a terminal window

Related: How to Kill Processes From the Linux Terminal

Killing Processes by Name

The pkill command allows you to kill processes by name. Make sure you've identified the correct process! This command will terminate the top process.

sudo pkill top

sudo pkill top in a terminal window

Again, no news is good news. The process is silently terminated.

output from sudo pkill top in a terminal window

Killing Multiple Processes by Name

If you have multiple copies of a process running, or a process has spawned a number of child processes (like Google Chrome can do), how can you kill them off? That's just as easy. We use the killall command.

We've got two copies of top running:

ps -e | grep top

ps -e | grep top in a terminal window

We can terminate both of them with this command:

sudo killall top

sudo killall top in a terminal window

No response means no problems, so both of those processes have been terminated.

output from sudo killall top in a termonal window

Get a Dynamic View with top

The output from ps is a snapshot view. It doesn't update. To get an updating view of the processes, use the top command. It provides a dynamic view of the processes running in your computer. The display is in two parts. There is a dashboard area at the top of the screen made up of lines of text, and a table in the lower part of the screen made up of columns.

Start top with this command:

top

the top command running in a terminal window

The columns hold information on the processes:

  • PID: Process ID
  • USER: Name of the owner of the process
  • PR: Process priority
  • NI: The nice value of the process
  • VIRT: Virtual memory used by the process
  • RES: Resident memory used by the process
  • SHR: Shared memory used by the process
  • S: Status of the process. See the list below of the values this field can take
  • %CPU: the share of CPU time used by the process since the last update
  • %MEM: share of physical memory used
  • TIME+: total CPU time used by the task in hundredths of a second
  • COMMAND: command name or command line (name and command line parameters) If the command column cannot be seen, press the "Right Arrow" key.

The status of the process can be one of:

  • D: Uninterruptible sleep
  • R: Running
  • S: Sleeping
  • T: Traced (stopped)
  • Z: Zombie

Press the "Q" key to exit from top.

Related: 37 Important Linux Commands You Should Know

Before You Kill a Process

Make sure it is the one you're after, and check that it isn't going to cause you any problems. In particular, it is worth checking with the -H (hierarchy) and --forest options to make sure it doesn't have any important child processes that you'd forgotten about.

Linux Commands

Files

tar · pv · cat · tac · chmod · grep ·  diff · sed · ar · man · pushd · popd · fsck · testdisk · seq · fd · pandoc · cd · $PATH · awk · join · jq · fold · uniq · journalctl · tail · stat · ls · fstab · echo · less · chgrp · chown · rev · look · strings · type · rename · zip · unzip · mount · umount · install · fdisk · mkfs · rm · rmdir · rsync · df · gpg · vi · nano · mkdir · du · ln · patch · convert · rclone · shred · srm · scp · gzip · chattr · cut · find · umask · wc · tr

Processes

alias · screen · top · nice · renice · progress · strace · systemd · tmux · chsh · history · at · batch · free · which · dmesg · chfn · usermod · ps · chroot · xargs · tty · pinky · lsof · vmstat · timeout · wall · yes · kill · sleep · sudo · su · time · groupadd · usermod · groups · lshw · shutdown · reboot · halt · poweroff · passwd · lscpu · crontab · date · bg · fg · pidof · nohup · pmap

Networking

netstat · ping · traceroute · ip · ss · whois · fail2ban · bmon · dig · finger · nmap · ftp · curl · wget · who · whoami · w · iptables · ssh-keygen · ufw · arping · firewalld

RELATED: Best Linux Laptops for Developers and Enthusiasts