Mastering the Linux ps Command: Essential Options and Real‑Time Monitoring

What is ps?

The ps command displays a snapshot of the current processes on a Linux system, allowing you to see which processes are running, their states, resource usage, and whether any are zombies.

Basic options

-A

or -e: show all processes. -a: show processes attached to a terminal, including those of other users. -u: display processes with user‑oriented columns. x: together with -a, also list processes without a controlling terminal.

Output format flags

l

: long format with detailed information. j: jobs format. -f: full‑format listing.

Running ps without arguments

Executing ps alone prints four columns: PID, TTY, TIME, and CMD. The order is not sorted.

Displaying all current processes

Use -a (or -ax) to list every process, including those without a terminal. For long output, pipe to less:

$ ps -ax | less

Filtering by user

Show processes owned by a specific user with -u:

$ ps -u pungki

Filtering by CPU and memory usage

Use the aux set to get a comprehensive view, then sort: $ ps -aux | less Sort by CPU (descending): $ ps -aux --sort -pcpu | less Sort by memory (descending): $ ps -aux --sort -pmem | less Combine both and show the top 10 results:

$ ps -aux --sort -pcpu,+pmem | head -n 10

Filtering by process name or PID

Search for a specific command name with -C: $ ps -C getty For a formatted view add -f:

$ ps -f -C getty

Showing threads of a process

List threads belonging to a PID using -L:

$ ps -L 1213

Tree‑style process display

Use -axjf for a hierarchical view, or the dedicated pstree command:

$ ps -axjf

$ pstree

Displaying security‑related information

Show who is logged in and what they are running: $ ps -eo pid,user,args The -e flag lists all processes, while -o lets you choose the output columns (e.g., pid, user, args, cmd, comm, etc.).

Formatting output for the root user

To list processes created by the real or effective UID of root:

$ ps -U root -u root u

-U

filters by real UID, -u by effective UID, and the final u selects a user‑oriented column set.

Real‑time monitoring with watch

Combine ps with watch to refresh every second: $ watch -n 1 'ps -aux --sort -pmem, -pcpu' Limit the output to the top 20 lines:

$ watch -n 1 'ps -aux --sort -pmem, -pcpu | head 20'

Or monitor a specific user’s processes:

$ watch -n 1 'ps -aux -U pungki u --sort -pmem, -pcpu | head 20'

Conclusion

The ps command is installed on virtually every Linux distribution and, with its many options, can generate a wide range of custom reports. Consult man ps for a complete list of flags.