Linux ps command overview

top and htop provide a dashboard interface to view running processes similar to a graphical task manager. A dashboard interface can provide an overview but usually does not return directly actionable output. For this, Linux provides another standard command called ps to query running processes.

ps is a command used for monitoring actively running processes on the system.

• PID - process ID. Each process on the Linux system is going to have its own unique PID because no 2 processes can have the same PID;

• TTY - terminal that the process is running inside of;

The "TTY" column in the output of the ps command in Linux represents the terminal (teletypewriter, TTY) associated with the process. This column shows the controlling terminal for the process, if any. The controlling terminal is the terminal device from which the process was started and with which it can interact. It could be:

• A physical terminal device (e.g., /dev/tty1).

• A virtual terminal device (e.g., /dev/pts/0 for processes started in a graphical terminal emulator).

• "?" - if the process is not attached to any terminal, which is common for system daemons and background processes that do not interact directly with a user through a terminal.

The TTY information is useful for identifying the context in which a process is running, especially for distinguishing between system processes and those started by users in terminal sessions.

• TIME - refers to CPU time, how much time the process has been utilizing the CPU;

• CMD - shows the actual command that is running as part of that process;

ps command without any options shows the processes that are running as part of this particular terminal session.

There are 3 different styles of options for the ps command:

• Unix-style options begin with a single dash (-) and can be grouped without spaces. For example, ps -ef shows all processes in full format.

• BSD-style options do not start with a dash. This style originated from the BSD (Berkeley Software Distribution) version of Unix. For example, ps aux is a BSD-style command that lists all running processes with detailed information.

• GNU-style options start with two dashes (--) and are more descriptive. They are meant to be more readable and self-explanatory. For example, ps --forest is a GNU long option that displays a hierarchy of processes in a tree-like format.

1. To list all running processes on the system, regardless of which terminal they are associated with, use:

    ps x
   

   x flag tells ps to display processes that are not associated with a terminal (x stands for "eXcluded"). These include background processes, daemons, and system processes.

   

   Here, the question mark in the TTY column means the process is running system-wide and the STAT column shows the process state:

   • s: Session leader

   • S - uninterruptable sleep which means that it is waiting for some sort of user input and can't be disturbed until it receives that;

   • R - actively running process on the CPU. This is the most active state;

   • T - process has been stopped;

   • <: High-priority process (not nice to other users)

   • N: Low-priority process (nice to other users)

   • L: Pages locked into memory (for real-time and custom I/O)

   • l: Multi-threaded process

   • Z: The process is a "zombie" - it has terminated but its parent process hasn't yet reaped its resources.

2. To understand the hierarchy and status of processes running on the system, run the command:

    ps -axjf
   

   The options used with ps are used to modify the output. Let's break down what each option means:

   • -a: Show processes for all users. Without this option, ps displays only the processes belonging to the current user.

   • -x: Include processes that have no controlling terminal. This includes many daemon processes or background processes started by the system and services.

   • -j: Print the process ID (PID), parent process ID (PPID), process group ID (PGID), and session ID (SID) as a part of the output. This option is useful for seeing the relationship between processes, including which processes are grouped together or share the same session.

   • f: Use a full-format listing. This option provides a more detailed output, including the command line used to start each process.

The output of this command will be a list of processes with several columns, each providing specific information about the processes:

• PPID - The parent process ID. This tells you the ID of the process that started this process.

• PID: The process ID. This is a unique identifier for each running process.

• PGID: The process group ID. Processes in the same group can be controlled together, often used for shell job control.

• SID: Session ID. This identifies a session or a group of processes that are controlled together. A session usually starts with a login from a user and includes all the processes initiated in that login session.

• TTY: Terminal type. This column shows the terminal associated with the process, if any.

• STAT: Process state. This column shows the current state of the process (running, sleeping, zombie, etc.).

• TIME: The cumulative CPU time taken by the process.

• COMMAND: The command line that started the process. This includes both the command and its arguments.

1. To provide a comprehensive overview of system activity, use:

    ps aux
   

   Here's what each part of the command does:

   • a: lists the processes of all users on the system.

   • u: displays user-oriented format. It adds a column for the user/owner of the process.

   • x: includes processes that have no controlling terminal. This can include daemon processes (background services) and processes started by other processes.

The output will contain several columns, each providing important information about each process:

1. USER: The username of the owner of the process.

2. PID: Stands for "Process ID," a unique identifier for each running process.

3. %CPU: The percentage of the CPU time that the process is currently using.

4. %MEM: The percentage of physical memory that the process is using.

5. VSZ: Virtual memory size of the process in KiB (Kibibytes).

6. RSS: Resident Set Size, the non-swapped physical memory the process has used, in KiB.

7. TTY: Terminal type associated with the process. If the process is not attached to a terminal, this field will be '?'.

8. STAT: This represents the state of the process (running, sleeping, zombie, etc.).

9. START: The time the process started.

10. TIME: The cumulative CPU time the process has used since it started.

11. COMMAND: The command line (name of the executable) that started the process.

This command is widely used for displaying detailed information about running processes. It is very useful for monitoring system resources, managing processes, and performing system diagnostics. It provides a snapshot of what's currently happening on the system, allowing administrators and users to identify processes that might be consuming too much memory or CPU time.

References:

1. IBM documentation: ps command