Example Uses Of The Linux ps Command

The 'ps' command displays all running system processes

The ps command produces a list of the currently running processes on your computer. The ps command is commonly used in conjunction with the grep command and the more or less commands; these additional commands help to filter and paginate the output from ps which can often be quite long.

How to Use the 'ps' Command

Illustration of a computer screen showing a Terminal window and the Linux
Lifewire / Hilary Allison

On its own, the ps command shows the running processes by the user running it within a terminal window. To invoke ps simply type the following:


The output will show rows of data containing the following information:

  • PID
  • TTY
  • Time
  • Command

The PID is the process ID which identifies the running process. The TTY is the terminal type. 

On its own, the ps command is quite limited. You probably want to see all the running processes. To view all the running processes use either of the following commands:

ps -A 
ps -e

To show all of the processes except for session leaders run the following command:

ps -d

So what is a session leader? When one process kicks off other processes it is the session leader of all the other processes. So imagine process A kicks off process B and process C. Process B kicks off process D and process C kicks off process E. When you list all processes except sessions leaders you will see B, C, D, and E but not A.

Negate any of the selections that you have chosen by using the -N switch. For example, to see just the session leaders run the following command:

ps -d -N

The -N is not helpful when used with the -e or -A switches as it will show nothing at all.

To see only the processes associated with this terminal run the following command:

ps T

If you want to see all the running processes using the following command:

ps r

Selecting Specific Processes Using the ps Command

Return specific processes using the ps command and there are various ways to change the selection criteria.

For instance, if you know the process id you can simply use the following command:

ps -p <pid>

You can select multiple processes by specifying multiple process IDs as follows:

ps -p "1234 9778"

You can also specify them using a comma-separated list:

ps -p 1234,9778

The chances are that you won't know the process ID and it is easier to search by command. To do this use the following command:

ps -C <command>

For example, to see if Chrome is running you can use the following command:

ps -C chrome

Other ways to filter results is by group. Search by group name using the following syntax:

ps -G <groupname> ps --Group <groupname>

For example to find out all the processes being run by the accounts group, type the following:

ps -G "accounts" ps --Group "accounts"

You can also search by group id instead of group name by using a lowercase "g" as follows:

ps -g <groupid> ps --group <groupid>

To search by a list of session IDs use the following command:

ps -s <sessionid>

Alternatively, use the following to search by terminal type.

ps -t <sessionid>

To find all the processes run by a specific user try out the following command:

ps U <userlist>

For example, to find all the processes ran by gary run the following:

ps U "gary"

This output shows the person whose credentials are used to run the command. For example, if you are logged in as gary and run the above command it will show all the commands you've executed.

If you log in as Tom and use sudo to run a command then the above command will show Tom's command as being run by gary and not Tom.

To limit the list to just the processes really run by gary use the following command:

ps -U "gary"

Formatting ps Command Output

ps -ef

By default you get the same four columns when you use the ps command:

  • PID
  • TTY
  • Time
  • Command

You can get a full listing by running the following command:

ps -ef

The -e, as you know, shows all the processes and the f or -f shows full details.

The columns returned are as follows:

  • User ID
  • PID
  • PPID
  • C
  • STime
  • TTY
  • Time
  • Command

The User ID is the person who ran the command. The PID is the process ID of the command. The PPID is the parent process that kicked off the command.

The C column shows the number of children a process has. The STime is the start time for the process. The TTY is the terminal, the time is the amount of time it took to run and command is the command that was run.

You can get even more columns by using the following command:

ps -eF

This returns the following columns:

  • UID
  • PID
  • PPID
  • C
  • SZ
  • RSS
  • PSR
  • STime
  • TTY
  • Time
  • Command

The extra columns are SZ, RSS, and PSR. SZ is the size of the process, RSS is the real memory size and PSR is the processor the command is assigned to.

Specify a user-defined format using the following switch:

ps -e --format <format>

The formats available are as follows:

  • %cpu: CPU utilisation
  • %mem: Memory percentage utilization
  • args: The command with all its arguments
  • c: Processor utilization
  • cmd: The command
  • comm: The command name only
  • cp: CPU Usage
  • cputime: CPU Time
  • egid: Effective group id
  • egroup: Effective group
  • etime: Elapsed time
  • euid: Effective user id
  • euser: Effective user
  • gid: Group id
  • group: Group name
  • pgid: Process group id
  • pgrp: Process group
  • ppid: Parent Process ID
  • start: Time the process started
  • sz: Size in physical pages
  • thcount: Threads owned by the process
  • time: Cumulative time
  • uid: User Id
  • uname: Username

There are many more options but these are the most commonly used ones.

To use the formats type the following:

 ps -e --format="uid uname cmd time"

Mix and match the items as you wish them to be.

Sorting Output

To sort the output, use the following notation:

ps -ef --sort <sortcolumns>

The choice of sort options are as follows:

  • cmd: Executable name
  • pcpu: CPU utilization
  • flags: Flags
  • pgrp: Process group id
  • cutime: Cumulative user time
  • cstime: Cumulative system time
  • utime: User time
  • pid: Process ID
  • ppid: Parent process ID
  • size: Size
  • uid: User ID
  • user: User Name

Again there are more options available but these are the most common ones.

An example sort command is as follows:

ps -ef --sort user,pid

Using 'ps' with 'grep', 'less', and 'more' Commands

It's common to use ps with the grep, less and more commands.

The less and more commands help you sift through the results one page at a time. To use these commands simply pipe the output from grep into them as follows:

ps -ef | more ps -ef | less

The grep command helps you filter the results from the ps command.

For example:

ps -ef | grep chrome 


The ps command is commonly used for listing processes within Linux. You can also use the top command to display running processes in a different manner.