The ps Command

ps (process status) shows you what's running. It's the foundation of process management.

Basic ps

Terminal

$ps

PID TTY TIME CMD 1234 pts/0 00:00:00 bash 5678 pts/0 00:00:00 ps

By default, ps only shows processes in your current terminal. Not very useful.

The Magic Flags: ps aux

Terminal

$ps aux | head -10

USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.1 16920 8520 ? Ss Jan14 0:02 /sbin/init root 2 0.0 0.0 0 0 ? S Jan14 0:00 [kthreadd] user 1234 0.0 0.1 10848 5912 pts/0 Ss 10:00 0:00 -bash www-data 2345 0.1 0.5 123456 24680 ? S 09:30 0:15 nginx: worker

ps aux shows ALL processes from ALL users. This is what you'll use 99% of the time.

Understanding the Output

Column	Meaning
USER	Process owner
PID	Process ID
%CPU	CPU usage
%MEM	Memory usage
VSZ	Virtual memory (KB)
RSS	Physical memory (KB)
TTY	Terminal (? = no terminal)
STAT	State (R, S, T, Z, etc.)
START	Start time
TIME	CPU time used
COMMAND	Command that started process

Process States in STAT

The STAT column has modifiers:

Letter	Meaning
R	Running
S	Sleeping (interruptible)
D	Sleeping (uninterruptible, usually I/O)
T	Stopped
Z	Zombie
`<`	High priority
N	Low priority
s	Session leader
l	Multi-threaded
`+`	Foreground process

Terminal

$ps aux | grep 'Ss'

(session leaders, sleeping)

Finding Specific Processes

Terminal

$ps aux | grep nginx

root 1234 0.0 0.1 12345 2345 ? Ss Jan14 0:00 nginx: master www-data 1235 0.1 0.3 23456 5678 ? S Jan14 0:15 nginx: worker

Avoid grep Showing Itself

grep nginx might show itself in results. Use:

hljs bash

ps aux | grep [n]ginx

The brackets prevent grep from matching its own process.

Alternative Syntax: ps -ef

BSD style (ps aux) vs Unix style (ps -ef):

Terminal

$ps -ef | head -5

UID PID PPID C STIME TTY TIME CMD root 1 0 0 Jan14 ? 00:00:02 /sbin/init root 2 0 0 Jan14 ? 00:00:00 [kthreadd]

-ef shows PPID (parent PID), which aux doesn't.

Useful ps Combinations

Show Process Tree

Terminal

$ps auxf | head -20

(tree view showing parent-child relationships)

The f flag shows forest (tree) format.

Show Only Your Processes

Terminal

$ps aux | grep ^$USER

(processes owned by you)

Sort by CPU

Terminal

$ps aux --sort=-%cpu | head -10

(top CPU consumers)

Sort by Memory

Terminal

$ps aux --sort=-%mem | head -10

(top memory consumers)

Knowledge Check

What does `ps aux | grep nginx` do?

Quick Reference

Command	Shows
`ps`	Your terminal's processes
`ps aux`	All processes, all users
`ps -ef`	All processes with parent PID
`ps auxf`	Process tree
`ps aux --sort=-%cpu`	Sorted by CPU
`ps aux --sort=-%mem`	Sorted by memory

Key Takeaways

ps aux is your go-to for viewing processes
Use grep to filter for specific processes
STAT column shows process state (R, S, T, Z)
ps -ef shows parent PID
ps auxf shows tree structure

Next: real-time process monitoring with top and htop.

The ps Command

ps (process status) shows you what's running. It's the foundation of process management.

Basic ps

Terminal

$ps

PID TTY TIME CMD 1234 pts/0 00:00:00 bash 5678 pts/0 00:00:00 ps

By default, ps only shows processes in your current terminal. Not very useful.

The Magic Flags: ps aux

Terminal

$ps aux | head -10

ps aux shows ALL processes from ALL users. This is what you'll use 99% of the time.

Understanding the Output

Column	Meaning
USER	Process owner
PID	Process ID
%CPU	CPU usage
%MEM	Memory usage
VSZ	Virtual memory (KB)
RSS	Physical memory (KB)
TTY	Terminal (? = no terminal)
STAT	State (R, S, T, Z, etc.)
START	Start time
TIME	CPU time used
COMMAND	Command that started process

Process States in STAT

The STAT column has modifiers:

Letter	Meaning
R	Running
S	Sleeping (interruptible)
D	Sleeping (uninterruptible, usually I/O)
T	Stopped
Z	Zombie
`<`	High priority
N	Low priority
s	Session leader
l	Multi-threaded
`+`	Foreground process

Terminal

$ps aux | grep 'Ss'

(session leaders, sleeping)

Finding Specific Processes

Terminal

$ps aux | grep nginx

root 1234 0.0 0.1 12345 2345 ? Ss Jan14 0:00 nginx: master www-data 1235 0.1 0.3 23456 5678 ? S Jan14 0:15 nginx: worker

Avoid grep Showing Itself

grep nginx might show itself in results. Use:

hljs bash

ps aux | grep [n]ginx

The brackets prevent grep from matching its own process.

Alternative Syntax: ps -ef

BSD style (ps aux) vs Unix style (ps -ef):

Terminal

$ps -ef | head -5

UID PID PPID C STIME TTY TIME CMD root 1 0 0 Jan14 ? 00:00:02 /sbin/init root 2 0 0 Jan14 ? 00:00:00 [kthreadd]

-ef shows PPID (parent PID), which aux doesn't.

Useful ps Combinations

Show Process Tree

Terminal

$ps auxf | head -20

(tree view showing parent-child relationships)

The f flag shows forest (tree) format.

Show Only Your Processes

Terminal

$ps aux | grep ^$USER

(processes owned by you)

Sort by CPU

Terminal

$ps aux --sort=-%cpu | head -10

(top CPU consumers)

Sort by Memory

Terminal

$ps aux --sort=-%mem | head -10

(top memory consumers)

Knowledge Check

What does `ps aux | grep nginx` do?

Quick Reference

Command	Shows
`ps`	Your terminal's processes
`ps aux`	All processes, all users
`ps -ef`	All processes with parent PID
`ps auxf`	Process tree
`ps aux --sort=-%cpu`	Sorted by CPU
`ps aux --sort=-%mem`	Sorted by memory

Key Takeaways

ps aux is your go-to for viewing processes
Use grep to filter for specific processes
STAT column shows process state (R, S, T, Z)
ps -ef shows parent PID
ps auxf shows tree structure

Next: real-time process monitoring with top and htop.