ps (Processes)

A process is a running instance of a program, together with its memory, credentials, open resources, and execution state. Linux identifies each live process with a numeric process ID, or PID. A PID is unique among processes that exist at the same time, but the kernel can reuse it after a process exits.

Taking a Basic Snapshot

Run ps without options to see a snapshot selected by the implementation's defaults, commonly processes associated with your current terminal and user:

$ ps
    PID TTY          TIME CMD
  41230 pts/4    00:00:00 bash
  51224 pts/4    00:00:00 ps

Typical fields include:

• PID: process ID
• TTY: controlling terminal, or ? when none is associated
• TIME: accumulated CPU time, not elapsed wall-clock duration
• CMD: command name or command line, depending on the selected format

Exact columns and selection defaults vary between ps implementations and environments.

CheckWhat does the PID column identify?

The process's current directory number. The accumulated CPU time in seconds. The process ID assigned by the kernel.

Listing Processes with BSD-Style Options

Linux ps accepts several option styles. BSD-style options are commonly written without a leading dash:

$ ps aux

In this combination:

• a expands selection to processes belonging to other users that have terminals.
• x also includes processes without controlling terminals and broadens the selection when combined with a.
• u selects a user-oriented output format with fields such as USER, %CPU, %MEM, VSZ, and RSS.

Because option meanings can interact, interpret the complete combination rather than treating every letter as an independent command.

CheckIn ps aux, which option requests the user-oriented output format?

u x a

Using Standard-Style Options

The widely used standard-style command ps -ef writes options with a leading dash:

$ ps -ef

• -e selects every process visible to the caller.
• -f requests a full-format listing.

The output commonly includes UID, PID, PPID, start time, and command information. PPID is the parent process ID. This listing is not inherently hierarchical; use an option such as --forest where supported, or a dedicated tree viewer such as pstree, when parent-child layout matters.

CheckWhat does -e request in ps -ef?

An update every second until interrupted. A selection containing every process visible to the caller. Only processes whose command ended with an error.

Monitoring Activity over Time

ps exits after producing one snapshot. Use top for an interactive view that refreshes periodically:

$ top

top helps identify changing CPU and memory consumers, but its values are samples and can fluctuate. Confirm a suspected problem across multiple observations and relate percentages to the machine's CPU count, memory accounting, and workload.

CheckWhich tool introduced here refreshes its process display periodically by default?

top ps -ef ls -l

For hands-on practice, use Manage and Monitor Linux Processes to compare snapshots with an interactive monitor, or explore sorting and filtering in the Linux top Command lab.

Summary

You can now choose a process view and interpret its basic identifiers.

1. Treat a PID as a reusable identifier for a currently live process.
2. Use plain ps for a small default snapshot.
3. Use ps aux or ps -ef for broader selections and richer columns.
4. Use top when changes over time matter.