Bash Process Status (ps)

PS Features

ps

ps aux

ps aux | grep firefox

ps auxf

🔹 Basic Usage

The tail command is a core utility for viewing the end portion of files, particularly useful for logs and large text files. Its default behavior, invoked simply as tail filename, is to output the last 10 lines to the terminal. This provides a quick, resource-efficient way to inspect the most recent entries without loading the entire file. It is indispensable for system administrators checking the latest system log entries (/var/log/syslog), developers verifying the end of application output, or anyone needing a snapshot of recent data. The command reads input from files or standard input, making it highly versatile in pipelines.

# View your terminal processes
ps

  PID TTY          TIME CMD
 1234 pts/0    00:00:00 bash
 5678 pts/0    00:00:00 ps

🔹 View All Processes

The classic and most commonly used ps options to see every process on the system are aux (BSD-style) or -ef (standard Unix-style). The aux combination is particularly informative: a shows processes from all users, u provides a user-oriented format that includes the owning username and resource percentages (CPU, MEM), and x lists processes not attached to a terminal (daemons, background services). Running ps aux gives a comprehensive overview of system activity, essential for administration and troubleshooting.

# View all processes with details
ps aux

# View all processes (alternative)
ps -ef

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.1 169416 11234 ?        Ss   Jan10   0:05 /sbin/init
user      1234  0.5  2.3 456789 98765 ?        Sl   10:30   1:23 firefox

🔹 Understanding PS Output

Interpreting the columns in ps aux output is key to effective process management. Important columns include: USER (process owner), PID (Process ID), %CPU (CPU usage percentage), %MEM (memory usage percentage), VSZ (virtual memory size), RSS (resident set size, physical memory used), TTY (controlling terminal), STAT (process state code, e.g., R for running, S for sleeping), START (start time), and COMMAND (command line). Understanding STAT codes (like Z for zombie, D for uninterruptible sleep) is especially crucial for diagnosing unresponsive processes or system load issues.

🔹 Search for Specific Process

A powerful pattern is to pipe the output of ps aux into grep to filter for a specific process name or pattern. For example, ps aux | grep nginx will display only lines containing "nginx", helping you check if the web server is running, find its PID, and see its resource consumption. To exclude the grep command itself from the results, add a pattern like grep -v grep. This technique is fundamental for quickly locating processes, verifying service status, and obtaining PIDs for further actions like sending signals with kill.

# Find Firefox processes
ps aux | grep firefox

# Find processes by user
ps aux | grep username

# Find Python scripts
ps aux | grep python

user  1234  2.5  3.2 1234567 123456 ?  Sl  10:30  1:23 /usr/bin/firefox
user  5678  0.0  0.0  12345   1234 pts/0 S+ 11:45  0:00 grep firefox

🔹 Process Tree View

Using the f or --forest option with ps displays processes in an ASCII art tree format, visually indicating parent-child relationships. For instance, ps auxf or ps -ef --forest shows which processes spawned others. This is invaluable for understanding process hierarchies—like seeing that a web server master process has multiple worker children. It helps in tracking down the root cause of issues: if a child process is misbehaving, you can identify and manage its parent. This view clarifies systemd/service structures and application architectures.

# Show process tree
ps auxf

# Alternative tree view
ps -ejH

# Show tree for specific user
ps -u username f

USER  PID  COMMAND
root    1  /sbin/init
root  123  \_ /usr/sbin/sshd
user  456      \_ sshd: user@pts/0
user  789          \_ -bash
user  999              \_ ps auxf

🔹 Sort and Filter Processes

While ps itself has sorting flags, a common practice is to combine its output with the sort command to order processes by resource usage for easy identification of top consumers. For example, ps aux --sort=-%mem | head -10 lists the top 10 processes by memory usage. Similarly, ps aux --sort=-%cpu | head -5 shows the top 5 CPU hogs. This method is critical for performance troubleshooting, quickly pinpointing processes causing memory leaks, excessive CPU load, or other resource contention that could be degrading system performance.

# Sort by memory usage (highest first)
ps aux --sort=-%mem | head -n 10

# Sort by CPU usage
ps aux --sort=-%cpu | head -n 10

# Show only specific columns
ps -eo pid,user,%cpu,%mem,command

USER   PID %CPU %MEM COMMAND
user  1234  5.2 15.3 /usr/bin/chrome
user  5678  2.1  8.7 /usr/bin/firefox
user  9012  0.5  4.2 /usr/bin/code

🔹 Common PS Options

The ps command offers a rich set of options for customizing output columns, sorting, and selecting processes. Key options include: -e or -A for all processes, -f for full-format listing, -o to specify custom columns (e.g., ps -eo pid,user,pcpu,pmem,cmd), --sort for sorting, and -C to select by command name. Mastering these allows you to craft precise commands for monitoring, generating reports, or feeding data into scripts. For example, ps -eo pid,%mem --sort=-%mem | head -1 extracts the PID of the top memory-using process.

# View specific process by PID
ps -p 1234 -f

# View processes by command name
ps -C firefox -f

# Custom output format
ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%mem