Linux ps Command: 20 Real-World Examples

Linux ps commands give you a snapshot of what is running on the system: process IDs (PIDs), parent PIDs (PPIDs), owners, CPU and memory use, and the command line that started each task. Unlike interactive monitors such as top, ps is built for scripts, one-off inspection, and pairing with pipes (see An Introduction to Linux I/O Redirection for how redirection fits into the same toolkit).

This tutorial walks through twenty focused examples, from a plain ps through ps aux, ps -ef, custom columns, trees, threads, and grep. Set up a lab server with Initial Server Setup for Ubuntu if you need a fresh host. The article also adds reference material that competing articles often skip: process state codes, how ps behaves in containers, sorting output, when to use top or pgrep instead, and small shell patterns you can paste into maintenance scripts. For live resource monitoring on a server, pair these ideas with How To Use top, netstat, du, & Other Tools to Monitor Server Resources.

• ps reads process data exposed under /proc and prints a static picture at the moment you run it; combine it with watch or a scheduler for repeated checks.
• ps aux (BSD style) and ps -ef (POSIX / GNU long listing) are the two most common starting points for listing all running processes on Linux.
• The STAT (or S) column uses single-letter state codes such as R (running) and Z (zombie); knowing them helps you interpret hung or stuck tasks.
• PID identifies a process; PPID identifies its parent. Tree options and --ppid help you trace service trees and session leaders.
• Inside Docker or Kubernetes, ps only sees processes in the container’s PID namespace, so process lists look smaller than on the host.
• For scripting, ps -C name, ps -p, and pgrep are often cleaner than giant ps aux | grep pipelines (and easier to read alongside Bash history and expansion tips).

Common columns you will see

Exact columns depend on which options you pass (for example ps aux versus ps -ef).

Process state codes (STAT / S)

These letters describe what the kernel thinks the process is doing. You will mostly see the first character; additional characters mark session leaders, threads, and priority hints.

If you see many D states during storage outages, investigate disk or network filesystems. If you see Z, the parent should call wait(); fixing the parent or restarting the service usually clears them.

BSD style, POSIX style, and GNU ps

Linux ps accepts several historical option styles:

• BSD style: options without a leading dash, for example ps aux.
  • a shows processes for all users with a terminal; u adds user-oriented columns; x includes processes without a controlling TTY.
• POSIX / UNIX style: options with a leading dash, for example ps -ef.
  • -e selects every process; -f prints a full-format listing; -F is an even wider variant on GNU ps.

On the same host you can compare:

ps aux | head -n 5
ps -ef | head -n 5

Both list all processes in typical usage, but column names and layout differ. Pick one style for scripts and stay consistent.

The subsections below are the twenty practical examples. Each one shows the command and a sample screenshot from the original walkthrough.

1. ps without arguments

The ps command without arguments lists processes tied to the current shell.

ps

Output

The output consists of four columns:

• PID: the unique process ID
• TTY: the type of terminal the user is logged in to
• TIME: the time in minutes and seconds that the process has been running
• CMD: the command that launched the process

2. All processes: ps -A or ps -e

To list every process on the machine, use ps -A or ps -e.

To have a glance at all the running processes, execute the command below ps -A Output

or ps -e Output

3. Processes attached to this terminal: ps -T

To view processes associated with the terminal run ps -T Output

4. Processes not tied to a TTY: ps -a

To view all processes except session leaders and those attached to a terminal, run ps -a. A session leader is a process that started its session.

Output

5. Classic “everything” combo: ps -ax

To view all current processes (including those without a controlling tty):

ps -ax

Output

-a includes processes owned by others when they have a tty; -x adds processes with no tty.

6. BSD-style user listing: ps au and ps aux

If you wish to display processes in BSD format:

ps au

OR

ps aux

Output

7. Full listing: ps -ef and ps -eF

To view a full-format listing:

ps -ef

OR

ps -eF

Output

8. Filter by user: ps -u

If you wish to list processes for a specific user, use -u:

ps -u user

For example:

ps -u jamie

Output

9. Threads for one PID: ps -L

If you wish to list threads for a particular process, use -L with a PID:

ps -L 4264

Output

10. Everything running as root: ps -U root -u root

Sometimes you want every process whose real and effective user is root:

ps -U root -u root

Output

11. Filter by group: ps -fG

If you wish to list processes for a group by name or GID:

ps -fG group_name

Or:

ps -fG groupID

For example:

ps -fG root

Output

12. Resolve PID from command name: ps -C

You can search by executable name:

ps -C process_name

For example:

ps -C bash

Output

13. Full format for one PID: ps -fp

Display one process in full format:

ps -fp PID

For example:

ps -fp 1294

Output

14. Tree view: ps --forest

Parent and child relationships are easier to see in a forest layout:

ps -f --forest -C bash

Output

15. Custom columns for a command: ps -o

For example, to show PID, user, and command for every bash process:

ps -o pid,uname,comm -C bash

Output

The first process owned by root is often the main supervisor; workers may show under it.

16. Child processes of a parent PID: ps --ppid

To list children of a known parent PID:

ps --ppid 1294

Output

17. Threads with ps -p … -L

To list every thread row for one PID:

ps -p 1294 -L

Output

Replace 1294 with the PID you care about.

18. Choose columns once: ps -e -o …

You can print only the fields you need:

ps -e -o pid,uname,pcpu,pmem,comm

Output

19. Friendly column headers

Rename columns at print time:

ps -e -o pid=PID,uname=USERNAME,pcpu=CPU_USAGE,pmem=%MEM,comm=COMMAND

Output

20. Elapsed time and grep

Show how long processes have been running:

ps -e -o pid,comm,etime

Output

The -o option adds etime, which is handy when you suspect a stuck worker.

Finally, combine ps with grep when you need a quick filter (remember grep also matches its own process unless you exclude it):

ps -ef | grep systemd

Output

GNU ps supports --sort so you can rank processes without leaving the command. Examples:

ps -eo pid,comm,%cpu,%mem --sort=-%cpu | head -n 15
ps -eo pid,comm,%cpu,%mem --sort=-%mem | head -n 15

A leading minus sorts descending. These pairs answer the common question how to sort ps output by CPU or memory usage on Linux hosts.

ps helps you find a PID; kill, killall, or your init system performs the action. Typical pattern:

1. Run ps -fp PID or ps -C service to confirm the process.
2. Prefer a graceful stop: for systemd units use sudo systemctl stop unit (see How To Use Systemctl to Manage Systemd Services and Units).
3. If you must signal directly, kill PID sends SIGTERM by default; use kill -9 PID only when a process ignores normal termination.

This keeps kill process by PID on Linux workflows explicit and avoids guessing IDs.

Containers use PID namespaces. When you run ps inside a Docker or containerd container, PID 1 is usually your entrypoint, and you only see processes in that namespace, not every host process. That surprises people who expect the full host list.

• Docker: docker exec -it container ps aux
• Kubernetes: kubectl exec -it pod -- ps aux

For cgroup-aware views across nodes, operators often rely on kubectl top or metrics servers; ps remains useful for quick debugging inside the pod filesystem.

When readers search top htop process monitoring tools, point them at top for live dashboards and ps for repeatable listings.

Check whether a service binary is running

Using ps -C avoids a fragile grep on the full aux table:

if ps -C nginx -o pid= | grep -q '[0-9]'; then
  echo "nginx is running"
else
  echo "nginx is not running"
fi

pgrep -x nginx is another clean option.

Find zombie processes

Zombies show Z in the state field. Example:

ps -eo pid,ppid,stat,cmd | awk '$3 ~ /Z/ { print }'

Investigate the parent PID in the second column; it should reap child exit statuses.

1. What is the ps command used for in Linux?

ps prints information about running processes: PIDs, users, CPU and memory use, command lines, and kernel state codes. It is the standard tool for process status on the Linux command line when you want a point-in-time list instead of a live dashboard.

2. What is the difference between ps aux and ps -ef?

They both list processes for all users in typical use, but they come from different option styles. ps aux is BSD style (a, u, x). ps -ef is POSIX style (-e every process, -f full format). Columns and ordering differ; pick one format for monitoring scripts so parsers stay stable.

3. How do I list all processes in Linux using ps?

Use ps aux, ps -ef, ps -e, or ps -A. For a wide GNU view, ps -eF adds extra columns. These commands answer searches for list all running processes Linux.

4. How do I find the PID of a running process?

Use ps -C name, ps -ef | grep pattern (mind the extra grep line), or pgrep. For a known PID’s details, ps -fp PID shows the full command line.

5. What do the process state codes mean in ps output?

R means runnable, S means sleeping, D means uninterruptible sleep, Z means zombie, and T means stopped. See the table in this guide for quick reference when diagnosing stuck or dead processes.

6. How do I sort ps output by CPU or memory usage?

On GNU ps, add --sort=-%cpu or --sort=-%mem with an -o field list, for example ps -eo pid,comm,%cpu,%mem --sort=-%cpu | head.

7. Can I use ps inside a Docker container?

Yes. ps inside the container only sees that container’s PID namespace, so the list is shorter than on the host. Install procps in minimal images if ps is missing.

8. What is a zombie process and how do I find one with ps?

A zombie is a process that exited but whose parent has not read its exit status. In ps, the state column contains Z. Use ps -eo pid,ppid,stat,cmd | awk '$3 ~ /Z/ { print }' to list them, then fix or restart the parent service.

You now have a full set of Linux ps commands for daily administration: listing processes, interpreting ps aux and ps -ef, working with PID and PPID, formatting columns, sorting, spotting zombies, and understanding container namespaces. Pair this knowledge with interactive monitors from the server monitoring tools tutorial when you need live graphs during incidents.

Next steps

• Automate recurring checks with cron or systemd timers after you identify PIDs with ps.
• Learn shell productivity features in How To Use Bash History Commands and Expansions on a Linux VPS.
• Practice safe piping and redirection in An Introduction to Linux I/O Redirection.