Mastering the Linux ps Command: Essential Options for Process Monitoring

The ps command is the fundamental tool for viewing the current state of processes on a Linux system. It provides a snapshot of running processes, their IDs, owners, resource usage, and more, enabling administrators to diagnose issues, detect zombies, and monitor resource consumption.

Basic Usage and Core Options

Running ps without arguments shows a minimal set of columns (PID, TTY, TIME, CMD). The output is unsorted and reflects the state at the moment of execution. -A or -e: display all processes. -a: show processes associated with a terminal, including those of other users. -u: display processes with user‑oriented columns. x: include processes without a controlling terminal (often used with -a).

Output Formatting

-l

: long format with detailed information. -j: jobs format. -f: full format, showing parent‑child relationships.

Practical Examples

1. Default output (no parameters)

$ ps

The default view shows four columns: PID, TTY, TIME, and CMD.

2. Show all processes

$ ps -ax
$ ps -ax | less

3. Filter by user

$ ps -u pungki

4. Sort by CPU or memory usage

$ ps -aux | less

To sort ascending by CPU:

$ ps -aux --sort -pcpu | less

To sort ascending by memory:

$ ps -aux --sort -pmem | less

Combine both and show the top 10 results:

$ ps -aux --sort -pcpu,+pmem | head -n 10

5. Filter by process name or PID

$ ps -C getty

For more detail, add -f:

$ ps -f -C getty

6. Show threads of a specific PID

$ ps -L 1213

7. Display processes as a tree

$ ps -axjf

Alternatively, use the dedicated pstree command:

$ pstree

8. Show security‑related information

$ ps -eo pid,user,args

This lists each process’s PID, the user that started it, and the command line arguments.

9. Show processes created by the root user

$ ps -U root -u root u

The -U flag filters by real UID, -u by effective UID, and the final u selects a user‑oriented output format.

10. Real‑time monitoring with watch

Combine ps with watch to refresh every second:

$ watch -n 1 'ps -aux --sort -pmem,-pcpu'

Limit the view to the top 20 entries:

$ watch -n 1 'ps -aux --sort -pmem,-pcpu | head -n 20'

For user‑specific real‑time monitoring:

$ watch -n 1 'ps -aux -U pungki u --sort -pmem,-pcpu | head -n 20'

Conclusion

The ps utility is available on virtually every Linux distribution, making it a reliable choice for generating custom process reports. By mastering its myriad options, administrators can tailor output to their exact needs, and further explore additional flags via man ps.