March 2024
M T W T F S S
 123
45678910
11121314151617
18192021222324
25262728293031

Categories

March 2024
M T W T F S S
 123
45678910
11121314151617
18192021222324
25262728293031

ps command #1 – Basic

A linux command to monitor the system process consuming resources on the server. If you are working on a linux system it is good to have at least basic understanding of this command.

ps program or command when run take a snapshot of running processes at that time and display on the terminal which can be used to analyse the system performance or identify any problematic process which can be a risk for system.

ps Command:


When we run simple ps command, it will display very basic information –

$ ps
  PID TTY          TIME CMD
22396 pts/0    00:00:00 su
22402 pts/0    00:00:00 bash
22417 pts/0    00:00:00 su
22420 pts/0    00:00:00 bash
23332 pts/0    00:00:00 ps
PID – process id
TTY – terminal in which process is running
TIME – total cpu time taken till now
CMD – command

Let’s try with one argument -f (full)

$ ps -f
UID PID PPID C STIME TTY TIME CMD
root 22396 22377 0 09:49 pts/0 00:00:00 su
root 22402 22396 0 09:49 pts/0 00:00:00 bash
root 22417 22402 0 09:50 pts/0 00:00:00 su
root 22420 22417 0 09:50 pts/0 00:00:00 bash
root 23337 22420 0 11:02 pts/0 00:00:00 ps -f

this output is display with some more information –
UID – process owner user id
PPID – parent process id
STIME – process start time

Let’s play with some argument and see what will be the output look like –

$ ps -ef

mohan 7585 1 0 18:29 ? 00:00:00 /usr/libexec/gvfsd-http –spawner :1.7 /org/gtk/gvfs/exec_spaw/2
root 16991 1 0 Dec04 ? 00:00:00 /usr/sbin/bluetoothd –udev
mohan 17099 1 0 Dec04 ? 00:09:26 /usr/lib64/firefox/firefox
mohan 22246 1 0 19:28 ? 00:00:05 gnome-terminal
mohan 22248 22246 0 19:28 ? 00:00:00 gnome-pty-helper
mohan 22377 22246 0 19:35 pts/0 00:00:00 bash
root 22396 22377 0 19:35 pts/0 00:00:00 su
root 22402 22396 0 19:35 pts/0 00:00:00 bash
root 22417 22402 0 19:35 pts/0 00:00:00 su
root 22420 22417 0 19:35 pts/0 00:00:00 bash
mohan 22937 1 0 20:06 ? 00:00:00 gedit
root 23282 1899 0 20:47 ? 00:00:00 /usr/libexec/hald-addon-rfkill-killswitch
root 24348 1810 0 22:07 ? 00:00:00 /sbin/dhclient -d -4 -sf /usr/libexec/nm-dhcp-client.action -pf /var/run/dhclient-eth1.pid -lf /var/lib/dhclient/dhclient-e738be73-e337-4f64-865e-aa936ac77c14-eth1.lease -cf /var/run/nm-dhclient-eth1.conf eth1
mohan 27098 1236 2 22:23 ? 00:00:00 /usr/lib/rstudio-server/bin/rsession -u mohan
root 27112 1 0 22:23 ? 00:00:00 /usr/libexec/fprintd

All process
To see all processes on the system (along with the command line arguments used to start each process) you could use:

$ ps aux

Processes for User
To see all processes for a particular user (along with the command line arguments for each process) you could use:

$ ps U <username> u

$ ps U mohan u

USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
mohan 2695 0.0 0.0 229128 672 ? Sl Dec03 0:00 /usr/bin/gnome-keyring-daemon –daemonize –login
mohan 2705 0.0 0.1 253264 1888 ? Ssl Dec03 0:01 gnome-session
mohan 2713 0.0 0.0 20040 128 ? S Dec03 0:00 dbus-launch –sh-syntax –exit-with-session
mohan 2714 0.0 0.1 32476 1356 ? Ssl Dec03 0:01 /bin/dbus-daemon –fork –print-pid 5 –print-address 7 –session
mohan 2732 0.0 0.3 133360 3636 ? S Dec03 0:06 /usr/libexec/gconfd-2
mohan 2740 0.0 0.3 507280 3408 ? Ssl Dec03 0:26 /usr/libexec/gnome-settings-daemon
mohan 2741 0.0 0.1 286220 1624 ? Ss Dec03 0:00 seahorse-daemon
mohan 2746 0.0 0.0 137388 844 ? S Dec03 0:00 /usr/libexec/gvfsd
mohan 2760 0.0 0.5 447048 5116 ? Sl Dec03 0:25 metacity
mohan 2767 0.0 0.7 502416 7600 ? Sl Dec03 0:34 gnome-panel
mohan 2769 0.0 0.3 450232 3156 ? S<sl Dec03 0:35 /usr/bin/pulseaudio –start –log-target=syslog
mohan 2772 0.0 0.0 94828 252 ? S Dec03 0:00 /usr/libexec/pulse/gconf-helper
mohan 2773 0.0 5.6 1199004 57544 ? Sl Dec03 1:18 nautilus
mohan 2775 0.0 0.0 696412 256 ? Ssl Dec03 0:00 /usr/libexec/bonobo-activation-server –ac-activate –ior-output-fd=18
mohan 2778 0.0 0.2 30400 2212 ? S Dec03 0:00 /usr/sbin/restorecond -u
mohan 2783 0.0 0.4 469076 4244 ? Sl Dec03 0:02 gpk-update-icon
mohan 2786 0.0 0.0 146404 900 ? S Dec03 0:00 /usr/libexec/gvfs-gdu-volume-monitor
mohan 2787 0.0 0.2 375072 2924 ? S Dec03 0:00 gnome-volume-control-applet
mohan 2788 0.0 0.5 331480 5988 ? S Dec03 0:48 /usr/libexec/wnck-applet –oaf-activate-iid=OAFIID:GNOME_Wncklet_Factory –oaf-ior-fd=18
mohan 2789 0.0 0.2 476996 2900 ? Sl Dec03 0:00 /usr/libexec/trashapplet –oaf-activate-iid=OAFIID:GNOME_Panel_TrashApplet_Factory –oaf-ior-fd=24

Process tree
A process tree shows the child/parent relationships between processes. (When a process spawns another process, the spawned is called a child process while the other is the parent)

$ ps afjx

 

 

Usually, when we are monitoring process, we are targeting something which can impact our server performance or some specific process. For doing so we grep the ps output –

This is how we call list all http processes –

$ ps aux | grep http
atul      7585  0.0  0.0 177676   592 ?        S    Dec06   0:00 /usr/libexec/gvfsd-http --spawner :1.7 /org/gtk/gvfs/exec_spaw/2
root     28848  0.0  0.0   2700   168 pts/0    D+   02:49   0:00 grep http

you can filter ps command output by any keyword as above.

There are some ps options which can give you a customized output –

To see every process on the system using standard syntax:

$ ps -e
$ ps -ef
$ ps -eF
$ ps -ely
 To see every process on the system using BSD syntax:

$ ps ax
$ ps axu

To print a process tree:

$ ps -ejH
$ ps axjf

To get info about threads:

$ ps -eLf
$ ps axms

To get security info:

$ ps -eo euser,ruser,suser,fuser,f,comm,lable
$ ps axZ
$ ps -eM

To see every process running as root (real & effective ID) in user format:

$ ps -U root -u root u

To see every process with a user-defined format:

$ ps -eo pid,tid,class,rtprio,ni,pri,psr,pcpu,stat,wchan:14,comm
$ ps axo stat,euid,ruid,tty,tpgid,sess,pgrp,ppid,pid,pcpu,comm
$ ps -eopid,tt,user,fname,tmout,f,wchan

Print only the process IDs of process syslogd:

$ ps -C syslogd -o pid=
 #ps -C <process_name> -o pid=

Print only the name of PID 42:

$ ps -p 42 -o comm=
  #ps -p <process_id> -o comm=

We can sort the ps command output by unix sort also which is easy to use. Need to pass ps command output to sort command with proper argument and Volla !! You will get the output as you want.

Let’s see how this is work [ sort command arguement can differ per your linux flavour and version ]
I am using – CentOS 6.3

1. Display the top CPU consuming process (Column 3 – %CPU)

$ ps aux | head -1; ps aux | sort -k3 -nr |grep -v ‘USER’| head

USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND

mohan 21210 2.0 0.1 110232 1140 pts/3 R+ 00:13 0:00 ps aux
hduser 2671 0.8 4.1 960428 42436 pts/1 Sl+ Aug22 5:29 mongod
root 1447 0.2 0.3 185112 3384 ? Sl Aug22 1:36 /usr/sbin/vmtoolsd
mohan 2478 0.2 2.1 448120 21876 ? Sl Aug22 1:51 /usr/lib/vmware-tools/sbin64/vmtoolsd -n vmusr –blockFd 3
rtkit 2359 0.1 0.1 168448 1204 ? SNl Aug22 0:44 /usr/libexec/rtkit-daemon
root 7 0.1 0.0 0 0 ? S Aug22 0:53 [events/0]
root 2204 0.1 4.3 147500 43872 tty1 Ss+ Aug22 0:45 /usr/bin/Xorg :0 -nr -verbose -audit 4 -auth /var/run/gdm/auth-for-gdm-wEmBs1/database -nolisten tcp vt1
root 920 0.0 0.0 0 0 ? S Aug22 0:00 [bluetooth]
root 9 0.0 0.0 0 0 ? S Aug22 0:00 [khelper]
root 8 0.0 0.0 0 0 ? S Aug22 0:00 [cgroup]

For my linux sort command arguements are —
-kn ==> This use to select the column n, such as for column 4, -k4
-n ==> column is numeric
-r ==> reverse order

sort -k3 -nr ==> sort the third column of output in numeric reverse sort (largest to smallest)

2. Display the top 10 memory consuming process (Column 4 – %MEM)

$ ps aux | head -1; ps aux | sort -k4 -nr |grep -v ‘USER’| head

USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND

root 2204 0.1 4.3 147500 43872 tty1 Ss+ Aug22 0:46 /usr/bin/Xorg :0 -nr -verbose -audit 4 -auth /var/run/gdm/auth-for-gdm-wEmBs1/database -nolisten tcp vt1
hduser 2671 0.8 4.1 960428 42436 pts/1 Sl+ Aug22 5:32 mongod
mohan 2458 0.0 2.3 943204 23624 ? S Aug22 0:16 nautilus
mohan 2516 0.0 2.2 275280 22316 ? Ss Aug22 0:06 gnome-screensaver
mohan 2478 0.2 2.1 448120 21876 ? Sl Aug22 1:52 /usr/lib/vmware-tools/sbin64/vmtoolsd -n vmusr –blockFd 3
mohan 2507 0.0 1.6 321388 16680 ? S Aug22 0:01 python /usr/share/system-config-printer/applet.py
mohan 2589 0.0 1.4 292556 14600 ? Sl Aug22 0:14 gnome-terminal
mohan 2536 0.0 1.3 395832 13372 ? S Aug22 0:00 /usr/bin/gnote –panel-applet –oaf-activate-iid=OAFIID:GnoteApplet_Factory –oaf-ior-fd=22
mohan 2502 0.0 1.3 474620 13952 ? Sl Aug22 0:01 gpk-update-icon
mohan 2537 0.0 1.2 459964 12736 ? S Aug22 0:10 /usr/libexec/clock-applet –oaf-activate-iid=OAFIID:GNOME_ClockApplet_Factory –oaf-ior-fd=34

3. Display the process by time (Column 4 – TIME)

$ ps vx | head -1; ps vx | sort -k4 -r| grep -v ‘PID’ | head

PID TTY STAT TIME MAJFL TRS DRS RSS %MEM COMMAND 2478 ? Sl 1:52 351 593 447526 21876 2.1 /usr/lib/vmware-tools/sbin64/vmtoolsd -n vmusr –blockFd 3
2458 ? S 0:16 228 1763 941440 23624 2.3 nautilus
2589 ? Sl 0:15 28 296 292259 14600 1.4 gnome-terminal
2421 ? Ssl 0:14 22 34 500541 9676 0.9 /usr/libexec/gnome-settings-daemon
2479 ? S 0:13 23 403 310472 11996 1.1 nm-applet –sm-disable
2537 ? S 0:10 37 168 459795 12736 1.2 /usr/libexec/clock-applet –oaf-activate-iid=OAFIID:GNOME_ClockApplet_Factory –oaf-ior-fd=34
2444 ? Ssl 0:10 25 64 445791 4872 0.4 /usr/bin/pulseaudio –start –log-target=syslog
2445 ? S 0:07 51 593 322206 12684 1.2 gnome-panel
2516 ? Ss 0:06 4 151 275128 22316 2.2 gnome-screensaver
2522 ? Sl 0:05 5 41 231870 1960 0.1 /usr/libexec/gvfs-afc-volume-monitor

4. Display the top 10 real memory usage process (Column 8 – RSS)

$ ps vx | head -1; ps vx | sort -k8 -nr| grep -v ‘PID’ | head

PID TTY STAT TIME MAJFL TRS DRS RSS %MEM COMMAND
2458 ? S 0:16 228 1763 941440 23624 2.3 nautilus
2516 ? Ss 0:06 4 151 275128 22316 2.2 gnome-screensaver
2478 ? Sl 1:52 351 593 447526 21876 2.1 /usr/lib/vmware-tools/sbin64/vmtoolsd -n vmusr –blockFd 3
2507 ? S 0:01 73 2 321385 16680 1.6 python /usr/share/system-config-printer/applet.py
2589 ? Sl 0:15 28 296 292259 14600 1.4 gnome-terminal
2502 ? Sl 0:01 29 257 474362 13952 1.3 gpk-update-icon
2536 ? S 0:00 92 1607 394224 13372 1.3 /usr/bin/gnote –panel-applet –oaf-activate-iid=OAFIID:GnoteApplet_Factory –oaf-ior-fd=22
2537 ? S 0:10 37 168 459795 12744 1.2 /usr/libexec/clock-applet –oaf-activate-iid=OAFIID:GNOME_ClockApplet_Factory –oaf-ior-fd=34
2445 ? S 0:07 51 593 322206 12684 1.2 gnome-panel
2438 ? Sl 0:03 30 542 433105 12512 1.2 metacity

Like above examples you can create so many one liners for you. But before using anyone of above one command, check your ps and sort command behavior then use them.
Mostly, every other shell has its own argument for ps and sort but basics are same. For sorting any command output by particular column first understand that output/column and then use sort commnd.

Leave a Reply

You can use these HTML tags

<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>