Skip to main content
A fast, practical cheat sheet for process inspection and troubleshooting. Designed for rapid recall.

​
Mental Model

ps shows running processes from the kernel’s process table.

BSD style

ps aux
Human-friendly output with all users

Unix style

ps -ef
Full format with PIDs and parent PIDs
Both styles are useful in different contexts. BSD style is typically more human-readable, while Unix style provides more detailed process hierarchy information.

​
Most Common Commands

​
Show all processes (human-friendly)

ps aux
1

a flag

Show processes for all users
2

u flag

Detailed/user-oriented output format
3

x flag

Include processes without a TTY (daemons)

​
Show all processes (Unix format)

ps -ef
  • -e = everything
  • -f = full format (UID, PPID, CMD, args)

​
Filtering Processes

ps aux | grep sshd
Uses grep to filter process list for specific name.
ps -C sshd -f
More efficient than piping to grep.
ps -u root
Lists all processes owned by the specified user.
ps -p 1234 -f
Shows detailed information for a specific process ID.

​
Useful Columns (What They Mean)

ColumnMeaning
PIDProcess ID
PPIDParent process ID
UIDUser owning the process
%CPUCPU usage percentage
%MEMMemory usage percentage
VSZVirtual memory size (KB)
RSSResident memory (physical RAM in KB)
STATProcess state
TIMECPU time consumed
COMMANDCommand executed

​
Process State Codes (STAT)

R

Running

S

Sleeping (waiting for event)

D

Uninterruptible sleep (usually I/O)

T

Stopped (by signal)

Z

Zombie (terminated but not reaped)

+

Foreground process group
Zombie processes (Z state) indicate the parent process hasn’t properly cleaned up. They consume PID table entries but no actual resources.

​
Formatting Output

ps -eo pid,ppid,user,%cpu,%mem,cmd
Select only the columns you need for better readability.
ps -eo pid,user,%mem,cmd --sort=-%mem
Shows highest memory consumers first (note the - prefix for descending order).
ps -eo pid,user,%cpu,cmd --sort=-%cpu
Identifies CPU-intensive processes quickly.
ps -ejH
Or:
ps -ef --forest
Shows parent-child process relationships visually.
Use custom column selection (-eo) to reduce noise and focus on relevant information during troubleshooting.

​
Practical Troubleshooting Examples

​
Highest CPU consumers

ps -eo pid,%cpu,cmd --sort=-%cpu | head
Quickly identify processes consuming the most CPU time.

​
Highest memory consumers

ps -eo pid,%mem,cmd --sort=-%mem | head
Find memory-hungry processes during resource exhaustion incidents.

​
Find processes holding deleted files

ps -ef | grep deleted
Processes holding open file handles to deleted files can cause disk space issues. Use lsof for more detailed investigation.

​
Show environment variables for a PID

ps -p 1234 -eo pid,cmd
cat /proc/1234/environ | tr '\0' '\n'
Useful for debugging configuration or credential issues.

​
Minimal Recall Table

ConceptShortcut
All processesps aux or ps -ef
Filter by name`ps auxgrep name`
Custom columnsps -eo ...
Sort by CPU--sort=-%cpu
Sort by memory--sort=-%mem
Tree view--forest

​
When to Use ps vs. Other Tools

GoalUse
Live, updating viewtop, htop
Deep inspection/proc/<pid>/
Check file handleslsof
Check open socketsss
Full system monitoringatop, glances
ps provides a snapshot at a point in time. For continuous monitoring, use top, htop, or atop instead.

Build docs developers (and LLMs) love

Get started for freeTalk to us