Mastering Linux ps: Essential Commands for Process Monitoring and Filtering

1. What is ps?

ps is the fundamental command for inspecting the current state of processes on a Linux system. It reveals which processes are running, their status, whether any are zombies, and which ones consume excessive resources.

ps provides a snapshot of process information; it does not continuously update. For real‑time monitoring, use the top command.

Basic options

-A or -e – display every process.

-a – show processes associated with the current terminal, including those of other users.

-u – list processes grouped by user.

x – commonly combined with -a to include processes without a controlling terminal.

Output‑format flags

l – long format with detailed information for each PID.

j – jobs format.

-f – full format, providing a more complete output.

2. Default output without parameters

Running ps with no arguments prints four columns in unsorted order:

PID – process identifier.

TTY – terminal associated with the process.

TIME – cumulative CPU time used.

CMD – command that started the process.

3. Show all current processes

Use the -a (all) flag, optionally combined with x to also list processes lacking a controlling terminal: $ ps -ax Because the output can be long, pipe it to less for easier navigation:

$ ps -ax | less

4. Filter by user

To view processes owned by a specific user, use the -u option followed by the username:

$ ps -u pungki

5. Filter by CPU or memory usage

Use the aux combination to display a comprehensive set of columns, then pipe to less if needed: $ ps -aux | less Sort the result by CPU usage (ascending) or memory usage (ascending) with the --sort flag:

$ ps -aux --sort -pcpu | less

$ ps -aux --sort -pmem | less

Combine both sorts and show the top ten results:

$ ps -aux --sort -pcpu,+pmem | head -n 10

6. Filter by process name or PID

Use the -C option followed by the command name, e.g., to find processes named getty:

$ ps -C getty

For a formatted view, add -f:

$ ps -f -C getty

7. Show threads of a process

Use the -L flag together with a PID to list its threads:

$ ps -L 1213

8. Display processes as a tree

Use the -axjf combination to produce a hierarchical view:

$ ps -axjf

Alternatively, the dedicated pstree command provides a similar tree representation:

$ pstree

9. Show security‑related information

To list who is logged in and what commands they are running, use:

$ ps -eo pid,user,args

The -e flag shows all processes, while -o controls which columns are displayed (PID, USER, ARGS, etc.). Additional keywords such as cmd, comm, fname, lstart, and others can be combined with -e.

10. Show processes created by the real or effective root user

System administrators can filter for processes owned by root with:

$ ps -U root -u root u

-U

filters by the real user ID (RUID), -u filters by the effective user ID (EUID), and the final u selects a user‑oriented output format (USER, PID, %CPU, %MEM, VSZ, RSS, TTY, STAT, START, TIME, COMMAND).

11. Real‑time monitoring with ps and watch

Although ps itself is static, you can combine it with watch to refresh the output every second:

$ watch -n 1 'ps -aux --sort -pmem,-pcpu'

Limit the view to the top 20 entries with head:

$ watch -n 1 'ps -aux --sort -pmem,-pcpu | head -n 20'

For a specific user, e.g., pungki, combine the user filter with sorting and limiting:

$ watch -n 1 'ps -aux -U pungki u --sort -pmem,-pcpu | head -n 20'

12. Final notes

The ps command is available on virtually every Linux distribution, making it a reliable tool for daily system monitoring and for generating custom reports via its many options.

Consult the manual page ( man ps) for a complete list of flags and formatting possibilities.