A common administration task is to check if a specific process is running and what are its properties. 1
There are a number of commands that you can use to find information about the running processes with 2
ps, pgrep, pstree, 3
and top being the most commonly used ones. 4
Note that any user, not only root, can see information about the running processes. 5
Let’s start with the first command, ps, which stands for “process status”. 6
I'm running the ps command without any option. 7
It's displaying the processes running in the current terminal, and there are only two: the bash shell 8
and ps, the command I’ve just run. 9
The displayed information consists of four columns: PID, TTY, TIME, and CMD. Let's take them 10
one by one. PID 11
is the process id, a positive integer number that's automatically assigned and used by the kernel to 12
uniquely identify each process. 13
This is probably the most important information when looking for a process because it allows you to 14
interact with the process. 15
DTY represents the name of the controlling terminal for the process; TIME: The cumulative CPU 16
time of the process, shown in minutes and seconds; 17
CMD is the name of the command that was used to start the process. 18
This output is not very useful because it doesn't contain too much information. 19
Maybe you want to see all the processes that are running. 20
Ps is a very complex tool with lots of options. 21
The most frequently used options are:-e (to list all processes) and 22
-f (to do a full-listing format and display detailed information about the processes that 23
are running) ps -e; it's displaying all processes that are running and ps -f full status information. 24
It's displaying detailed information about the processes. 25
And ps -ef 26
it's also very common, it's displaying all processes with detailed information. 27
Let's see how many processes are running. 28
And on my system, there are 181 processes that are running. 29
I'll pipe the output of ps -ef | less 30
Let's take a closer look at the output. 31
The user column indicates the user who runs the process ; PID is the process idee and PPID is the parent 32
process id, 33
the pip of the parent. 34
Stime indicates the starting time, which is the time when the process was started. 35
If you see a question mark in the TTY column, it means that the process is no terminal to which 36
it is attached. 37
It’s probably a system service or a daemon. 38
Daemons are the processes which run in the background and are not interactive; they have no controlling 39
terminal. In Linux, the names of daemons end in d. Colloquially, when someone says the word daemon, 40
you think of a server application that provides a service. 41
Some well-known daemons are sshd which is the OpenSSH Server Daemon, httpd which is 42
the Apache web server daemon, named which is a DNS server damone or mysqld which is a database 43
server daemon. 44
Another frequently used combination of options is aux. You can run the ps command in the BSD form 45
without a dash before the options or in the Unix form with a dash before the options: 46
So ps -dash aux or ps aux without a dash, without the minus sign. 47
Let's pipe the output to less. 48
The extra columns you are seeing have the following meanings: 49
%CPU is cpu utilization of the process expressed as a percentage; %MEM is how much 50
memory the process is using. 51
It's the ratio of the process's resident set size to the physical memory on the machine, expressed 52
as a percentage. 53
VSZ is the virtual memory size of the process in KiB.. 54
It includes all the memory that the process can access, including the memory that is swapped out, 55
the memory that is allocated but not used and the memory that is from shared 56
libraries. 57
RSS is the size of the physical memory that the process is using; it indicates how much memory is allocated 58
to each process. 59
It does not include memory that is swapped out, but it includes the memory from shared libraries 60
as long as they are actually in the memory. 61
It does include all stack and heap memory. 62
And staat indicates the process 63
state using a code. Possible values displayed S for sleeping, R for running, 64
Z for zombie 65
T for stopped 66
and I for idle kernel thread. A < sign means high priority and the upper case N means 67
low priority. 68
This is the running process. 69
Let me tell you a few words about the running process. A CPU core can run a single process at a specific 70
moment. 71
If you have a CPU with 4 cores then no more than 4 processes can run simultaneously. 72
Actually, it only appears that the operating system is performing the job simultaneously. 73
In reality, it is running only one process per core at a time, but quickly switching between all 74
of its ongoing tasks or processes. 75
The Linux kernel will execute some instructions from Process A and then will set the process A aside and 76
executes instructions from Process B.. 77
The concept of switching between queued processes is called process scheduling. 78
The ps command also allows you to sort the output using the --sort option. For example, 79
to sort of the output by memory usage, you should use: ps aux --sort= 80
%mem | less It's sorting in ascending order and if you want to sort the output in descending 81
order add - before %mem. 82
It's in ascending order and now I'll sort them in descending order. 83
For example, the gnome shell consumes 11 percent of the memory. 84
Let's see some other useful options. If you want to see only the processes of a specific user, use the 85
-u option. 86
ps -f -u student 87
Or -u root, I'm seeing all the processes. 88
It's very common to filter the output of the ps command with grep. For example, you want to check if 89
a specific process, especially a daemon, is running or not. 90
Let's see if sshd is running ps-ef 91
| grep sshd and it's running. 92
You can get another output depending on your particular case. 93
Now I'll show you something important. 94
Let's suppose you want to check if a process called xyz123 is running. 95
Of course it's not, but let's take it anyway, using ps and grep. 96
Even though no such process is running, the grep command found and returned a line from the output 97
of ps. What's happening here is that when executing the commands using the pipe, 2 processes 98
were created: ps and grep. 99
One of them is grep. 100
And it appears in the process list as the command that was executed. 101
So as grep xyz123 102
So in fact, grep has selected itself from the process list. 103
So when you search for a process this way, if the process is running, you'll get, in fact, at least 104
two lines: one of them being the grep command which selects itself 105
Because this construction ps| grep is very common 106
there's another command called pgrep, which comes from ps grep and looks up for a process using 107
its name. 108
Let's see if sshd is running. 109
pgrep sshd 110
or pgrep python 3 111
So pgrep is looking through the currently running processes and listing the process ids, which 112
match the selection criteria to stdout, 113
so to the terminal. If you want to see both of the process IDs and the names add the -l option 114
like this. 115
This is the PID, the process id and the process name. 116
Note that it's not looking for the whole name of the process, it's looking also for partial names. 117
You can also search for the processes owned by a specific user, pgrep -u root sshd 118
I'm searching for processes named sshd which are owned by root. 119
So we've seen so far that ps a complex command with lots of options and in most cases it satisfies our 120
requirements. 121
However, you should know that there's another command called ps3, which displays a hierarchical tree 122
structure of all running processes. 123
I'll pipe its output to less because it doesn't fit well on the screen. 124
pstree | less Ps3 merges identical branches by putting them between square brackets and prefixing them 125
with an integer that represents the number of branches. 126
This makes the output more readable and visually appealing. To disable the merging of the identical 127
branches, use the -c options. 128
pstree -c | less 129
The threads of a process are found under the parent process and are shown with the process name 130
in curly braces. 131
This command has a bunch of options as well and if you are interested you can take a look at its 132
man page