ps Command in Linux (List Running Processes)

In Linux, a running instance of a program is called a process. Every command you execute, every service running in the background, and the shell itself are all processes.

When troubleshooting issues on a Linux system, one of the first things you need to know is what processes are currently running. The ps command is the standard tool for this. It captures a snapshot of active processes at the moment you run it.

Other tools like pstree , top, and htop also display process information. The difference is that top and htop update in real time, while ps gives you a static snapshot — useful for scripting and one-time inspection.

This article explains how to use the ps command to list running processes and display detailed information about them.

How to Use the ps Command #

The general syntax for the ps command is as follows:

ps [OPTIONS]

For historical and compatibility reasons, the ps command accepts several different types of options:

• UNIX style options, preceded by a single dash.
• BSD style options, used without a dash.
• GNU long options, preceded by two dashes.

Different option types can be mixed, but in some cases conflicts can appear, so it is best to stick with one option type.

In its simplest form, when used without any option, ps prints information about the processes running in the current shell:

ps

The output includes information about the shell (bash) and the process running in it (ps, the command you just typed):

  PID TTY          TIME CMD
 1809 pts/0    00:00:00 bash
 2043 pts/0    00:00:00 ps

The four columns are labeled PID, TTY, TIME, and CMD.

• PID — The process ID. Knowing the PID allows you to kill a malfunctioning process .
• TTY — The name of the controlling terminal for the process.
• TIME — The cumulative CPU time of the process, shown in minutes and seconds.
• CMD — The name of the command that was used to start the process.

This output is not very useful on its own. The real power of the ps command comes when you use additional options.

Listing All Processes (BSD Style) #

The most common BSD-style invocation is:

ps aux

• a — Display processes from all users.
• u — Show a user-oriented format with detailed information.
• x — Include processes without a controlling terminal. These are mainly processes that started at boot time and run in the background .

The command displays information in eleven columns labeled USER, PID, %CPU, %MEM, VSZ, RSS, TTY, STAT, START, TIME, and COMMAND.

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.8  77616  8604 ?        Ss   19:47   0:01 /sbin/init
root         2  0.0  0.0      0     0 ?        S    19:47   0:00 [kthreadd]
...

The PID, TTY, TIME, and CMD columns were explained above. Here is what the remaining columns mean:

• USER — The user who runs the process.
• %CPU — The CPU utilization of the process.
• %MEM — The percentage of the process’s resident set size to the physical memory on the machine.
• VSZ — Virtual memory size of the process in KiB.
• RSS — The size of the physical memory that the process is using.
• STAT — The process state code (see the STAT codes section below).
• START — The time when the command started.

Listing All Processes (UNIX Style) #

The most common UNIX-style invocation is:

ps -ef

• -e — Display all processes.
• -f — Show a full-format listing with detailed information.

The command displays information in eight columns labeled UID, PID, PPID, C, STIME, TTY, TIME, and CMD.

UID        PID  PPID  C STIME TTY          TIME CMD
root         1     0  0 19:47 ?        00:00:01 /sbin/init
root         2     0  0 19:47 ?        00:00:00 [kthreadd]
...

The labels that are not already explained have the following meaning:

• UID — Same as USER, the user who runs the process.
• PPID — The ID of the parent process.
• C — Same as %CPU, the process CPU utilization.
• STIME — Same as START, the time when the command started.

Viewing a Process Tree #

To see the parent-child relationship between processes, use the f (forest) option:

ps auxf

The UNIX-style equivalent is:

ps -ejH

Both produce an indented tree showing which process spawned which.

Finding a Specific Process #

By Name #

To search for a process by name, you can pipe ps through grep :

ps aux | grep nginx

A cleaner approach is the -C option, which selects processes by command name without needing grep:

ps -f -C nginx

By PID #

If you know the PID of a process, use -p to display information about it:

ps -fp 1234

You can specify multiple PIDs separated by commas:

ps -fp 1234,5678,9012

By Parent PID #

To find all child processes of a specific parent process, use --ppid:

ps -f --ppid 1234

By User #

To view only the processes running as a specific user, type the following command, where linuxize is the name of the user:

ps -f -U linuxize -u linuxize

Displaying Process Threads #

To view individual threads within processes, use the -L option:

ps -fL -C nginx

This adds LWP (light-weight process ID) and NLWP (number of threads) columns to the output.

Sorting Output #

The --sort option lets you sort the output by any column. Prefix the column name with - to sort in descending order.

Sort by memory usage (highest first):

ps aux --sort=-%mem

Sort by CPU usage (highest first):

ps aux --sort=-%cpu

You can sort by multiple keys by separating them with commas:

ps aux --sort=-%cpu,-%mem

Custom Output Format #

Sometimes you only need specific columns. The -o option lets you define exactly which columns to display.

For example, to print only the PID, user, CPU usage, memory usage, and command:

ps -eo pid,user,%cpu,%mem,comm

The BSD equivalent:

ps axo pid,user,%cpu,%mem,comm

Some useful format specifiers include:

Showing the Full Command Line #

By default, the command column may be truncated. To see the full command line with all arguments, use the ww option:

ps auxww

This is useful when you need to see the exact flags or configuration paths a process was started with.

Process State Codes #

The STAT column shows the current state of each process. The first character is the main state:

Additional modifier characters may follow:

For example, Ss means the process is sleeping and is a session leader. R+ means the process is running in the foreground.

Zombie Processes #

A zombie process (state Z) is one that has finished execution but still has an entry in the process table because its parent has not read its exit status. A few zombies are normal — they appear briefly between a child exiting and the parent calling wait(). If you see many zombie processes accumulating, the parent process is likely not handling its children properly.

To find zombie processes:

ps aux | grep 'Z'

Using ps With Other Commands #

ps can be used in combination with other commands through piping.

To display the output one page at a time, pipe it to less :

ps -ef | less

To show only the processes belonging to the root user:

ps -ef | grep root

To count the total number of running processes:

ps -e --no-headers | wc -l

To monitor ps output in real time, combine it with watch :

watch -n 2 'ps aux --sort=-%cpu | head -15'

This refreshes the top 15 CPU-consuming processes every 2 seconds.

Common Mistakes #

• Using ps -aux instead of ps aux. The dash makes it UNIX-style syntax, where -a has a different meaning than BSD a. While ps is forgiving and often produces similar output, mixing styles can cause unexpected results.
• Matching the grep process itself. When you run ps aux | grep nginx, the grep process also appears in the output because its command line contains the word “nginx”. To avoid this, use ps aux | grep [n]ginx or use the -C option: ps -f -C nginx.
• Assuming ps output is real-time. The ps command takes a snapshot at the moment you run it. Processes can start or stop between the time ps runs and the time you read the output.

Quick Reference #

FAQ #

What is the difference between ps aux and ps -ef?
Both list all running processes. ps aux uses BSD syntax and shows %CPU, %MEM, and STAT columns. ps -ef uses UNIX syntax and shows PPID (parent process ID) and STIME. The information overlaps, so which one you use is mostly a matter of preference.

Does ps show real-time information?
No. ps takes a one-time snapshot of the current processes. For real-time monitoring, use top or htop.

How do I find zombie processes?
Run ps aux | grep 'Z'. Zombie processes show Z in the STAT column. A few zombies are normal, but many accumulating zombies indicate that a parent process is not properly handling its children.

How do I see which process is using the most CPU?
Run ps aux --sort=-%cpu | head to see the top CPU-consuming processes.

Conclusion #

The ps command is one of the most commonly used commands when troubleshooting issues on Linux systems. It reads process information from the /proc filesystem and presents it in a readable format. The two most important invocations to remember are ps aux (BSD style) and ps -ef (UNIX style). From there, you can sort, filter, and customize the output to find exactly the process information you need.

For a complete list of all available options, type man ps in your terminal.

If you have any questions, feel free to leave a comment below.

About the authors

Dejan Panovski

Dejan Panovski is the founder of Linuxize, an RHCSA-certified Linux system administrator and DevOps engineer based in Skopje, Macedonia. Author of 800+ Linux tutorials with 20+ years of experience turning complex Linux tasks into clear, reliable guides.

View author page