Mastering Linux ‘ps’: Essential Commands to Inspect and Filter Processes

What is ps?

The ps command displays a snapshot of the current processes on a Linux system; it does not update continuously, so for real‑time monitoring you would use top instead.

Basic parameters

-A

(or -e): show all processes. -a: show processes attached to any terminal, including those of other users. -u: display processes grouped by user. x: often used with -a to list processes without a controlling terminal.

Output format options

l

: long, detailed listing for each PID. j: jobs format. -f: full‑format listing with additional columns.

Running ps without parameters

Executing ps alone prints four default columns: PID, TTY, TIME, and CMD, which are not sorted.

Show all processes

Use -a (all) together with x to include processes lacking a terminal: ps -ax Pipe to less for easier browsing:

ps -ax | less

Filter by user

To list processes owned by a specific user, use -u followed by the username, e.g.:

ps -u pungki

Filter by CPU and memory usage

The aux option shows a comprehensive view. You can sort the output by CPU or memory usage with --sort:

ps -aux --sort -pcpu | less

ps -aux --sort -pmem | less

Combine both sorts and show only the top 10 results:

ps -aux --sort -pcpu,+pmem | head -n 10

Filter by process name or PID

Use -C followed by the command name (e.g., getty) to select processes: ps -C getty For a formatted view add -f:

ps -f -C getty

Show threads of a process

Display threads for a given PID with -L:

ps -L 1213

Tree view of processes

Show a hierarchical tree using: ps -axjf Or use the dedicated pstree command:

pstree

Display security‑related information

List PID, user, and command arguments for all processes:

ps -eo pid,user,args

Show processes owned by root

Combine -U (real UID) and -u (effective UID) with a user‑format flag:

ps -U root -u root u

Real‑time monitoring with watch

Pair ps with watch to refresh every second: watch -n 1 'ps -aux --sort -pmem,-pcpu' Limit the output to the first 20 lines:

watch -n 1 'ps -aux --sort -pmem,-pcpu | head -n 20'

You can also filter by a specific user while watching:

watch -n 1 'ps -aux -U pungki u --sort -pmem,-pcpu | head -n 20'

Conclusion

The ps command is installed on virtually every Linux distribution, making it a reliable tool for generating custom process reports; consult man ps for a complete list of options.