PS(1)

📦 version 3.3.17, in centos-stream 9, ubuntu jammy

👑 PS(1) — User Commands 👑

okay so bestie, welcome to ps from section 1 (User Commands), and honestly? she's the main character of every terminal ever. let's get into it 💅

💫 NAME 💫

ps — report a snapshot of the current processes.

🌸 SYNOPSIS 🌸

ps [options]

🦋 DESCRIPTION 🦋

ps shows you info about a selection of the active processes, periodt. and if what you actually want is a live, repeatedly-updating view of that selection and all its info? then you want top instead, bestie. different girl, different vibe.

this version of ps accepts three whole flavors of options:

  1. UNIX options — these can be grouped together, and they must be preceded by a dash.
  2. BSD options — these can be grouped together too, but they must not be used with a dash.
  3. GNU long options — these get preceded by two dashes.

you can literally mix options of different types freely, no cap, but conflicts can absolutely pop up. and because this ps is compatible with sooo many standards and other ps implementations, some options are straight-up synonymous — functionally identical, just different names. iconic behavior tbh.

🚨 okay important, listen up: ps -aux is NOT the same as ps aux. the POSIX and UNIX standards require that ps -aux print all processes owned by a user named x, plus all the processes that would get selected by the -a option. and if a user named x doesn't exist? this ps may just interpret the command as ps aux instead and print a warning. this behavior exists to help transition old scripts and old habits. it is fragile, subject to change, and therefore should not be relied upon. do not build your whole personality on it. 🙈

by default, ps selects all processes with the same effective user ID (euid=EUID) as the current user, associated with the same terminal as whoever invoked it. and then it displays:

  • the process ID (pid=PID)
  • the terminal associated with the process (tname=TTY)
  • the cumulated CPU time in [DD-]hh:mm:ss format (time=TIME)
  • the executable name (ucmd=CMD)

and the output is unsorted by default. it's giving chaos, lowkey. 🦋

now, the use of BSD-style options will add process state (stat=STAT) to that default display, and it'll show the command args (args=COMMAND) instead of the executable name. you can override this with the PS_FORMAT environment variable, bestie, you have options. ✨

the use of BSD-style options will also change the process selection to include processes on other terminals (TTYs) that are owned by you. alternately, you can describe this as setting the selection to be the set of all processes filtered to exclude processes owned by other users or not on a terminal. and here's the tea: these effects are not considered when options are described as being "identical" below — so -M will be considered identical to Z, and so on. iykyk.

except as described below, process selection options are additive. the default selection gets discarded, and then the selected processes get added to the set of processes to be displayed. so a process will be shown if it meets any of the given selection criteria. she's inclusive like that. 💜

🔥 EXAMPLES 🔥

to see every process on the system using standard syntax:

ps -e
ps -ef
ps -eF
ps -ely

to see every process on the system using BSD syntax:

ps ax
ps axu

to print a process tree:

ps -ejH
ps axjf

to get info about threads:

ps -eLf
ps axms

to get security info:

ps -eo euser,ruser,suser,fuser,f,comm,label
ps axZ
ps -eM

to see every process running as root (real & effective ID) in user format:

ps -U root -u root u

to see every process with a user-defined format:

ps -eo pid,tid,class,rtprio,ni,pri,psr,pcpu,stat,wchan:14,comm
ps axo stat,euid,ruid,tty,tpgid,sess,pgrp,ppid,pid,pcpu,comm
ps -Ao pid,tt,user,fname,tmout,f,wchan

print only the process IDs of syslogd:

ps -C syslogd -o pid=

print only the name of PID 42:

ps -q 42 -o comm=

✨ SIMPLE PROCESS SELECTION ✨

  • a — lifts the BSD-style "only yourself" restriction, which gets imposed upon the set of all processes when some BSD-style (no dash) options are used, or when the ps personality setting is BSD-like. the set of processes selected this way is in addition to the set selected by other means. alternate description: this option makes ps list all processes with a terminal (tty), or list all processes when used together with the x option. 🎀
  • -A — select all processes. identical to -e.
  • -a — select all processes except both session leaders (see getsid(2)) and processes not associated with a terminal.
  • -d — select all processes except session leaders.
  • --deselect — select all processes except those that fulfill the specified conditions (negates the selection). identical to -N.
  • -e — select all processes. identical to -A.
  • g — really all, even session leaders. this flag is obsolete and may be discontinued in a future release. it's normally implied by the a flag, and it's only useful when operating in the sunos4 personality. 💀
  • -N — select all processes except those that fulfill the specified conditions (negates the selection). identical to --deselect.
  • T — select all processes associated with this terminal. identical to the t option without any argument.
  • r — restrict the selection to only running processes.
  • x — lifts the BSD-style "must have a tty" restriction, which gets imposed upon the set of all processes when some BSD-style (no dash) options are used, or when the ps personality setting is BSD-like. the set of processes selected this way is in addition to the set selected by other means. alternate description: this option makes ps list all processes owned by you (same EUID as ps), or list all processes when used together with the a option. 🌈

🎀 PROCESS SELECTION BY LIST 🎀

these options accept a single argument in the form of a blank-separated or comma-separated list. and they can be used multiple times. for example:

ps -p "1 2" -p 3,4
  • -123 — identical to --pid 123.
  • 123 — identical to --pid 123.
  • -C cmdlist — select by command name. this selects the processes whose executable name is given in cmdlist.
📢 NOTE: the command name is not the same as the command line. previous versions of procps and the kernel truncated this command name to 15 characters. this limitation is no longer present in both. if you depended on matching only 15 characters, you may no longer get a match. she grew, bestie. 🦋
  • -G grplist — select by real group ID (RGID) or name. this selects the processes whose real group name or ID is in the grplist list. the real group ID identifies the group of the user who created the process, see getgid(2).
  • -g grplist — select by session OR by effective group name. selection by session is specified by many standards, but selection by effective group is the logical behavior that several other operating systems use. this ps will select by session when the list is completely numeric (as sessions are). group ID numbers will work only when some group names are also specified. see the -s and --group options.
  • --Group grplist — select by real group ID (RGID) or name. identical to -G.
  • --group grplist — select by effective group ID (EGID) or name. this selects the processes whose effective group name or ID is in grplist. the effective group ID describes the group whose file access permissions are used by the process (see getegid(2)). the -g option is often an alternative to --group.
  • p pidlist — select by process ID. identical to -p and --pid.
  • -p pidlist — select by PID. this selects the processes whose process ID numbers appear in pidlist. identical to p and --pid.
  • --pid pidlist — select by process ID. identical to -p and p.
  • --ppid pidlist — select by parent process ID. this selects the processes with a parent process ID in pidlist. that is, it selects processes that are children of those listed in pidlist. 🫶
  • q pidlist — select by process ID (quick mode). identical to -q and --quick-pid.
  • -q pidlist — select by PID (quick mode). this selects the processes whose process ID numbers appear in pidlist. with this option ps reads the necessary info only for the pids listed in the pidlist and doesn't apply additional filtering rules. the order of pids is unsorted and preserved. no additional selection options, sorting and forest type listings are allowed in this mode. identical to q and --quick-pid.
  • --quick-pid pidlist — select by process ID (quick mode). identical to -q and q.
  • -s sesslist — select by session ID. this selects the processes with a session ID specified in sesslist.
  • --sid sesslist — select by session ID. identical to -s.
  • t ttylist — select by tty. nearly identical to -t and --tty, but it can also be used with an empty ttylist to indicate the terminal associated with ps. using the T option is considered cleaner than using t with an empty ttylist. 🌸
  • -t ttylist — select by tty. this selects the processes associated with the terminals given in ttylist. terminals (ttys, or screens for text output) can be specified in several forms: /dev/ttyS1, ttyS1, S1. a plain - may be used to select processes not attached to any terminal. 💅
  • --tty ttylist — select by terminal. identical to -t and t.
  • U userlist — select by effective user ID (EUID) or name. this selects the processes whose effective user name or ID is in userlist. the effective user ID describes the user whose file access permissions are used by the process (see geteuid(2)). identical to -u and --user.
  • -U userlist — select by real user ID (RUID) or name. it selects the processes whose real user name or ID is in the userlist list. the real user ID identifies the user who created the process, see getuid(2).
  • -u userlist — select by effective user ID (EUID) or name. this selects the processes whose effective user name or ID is in userlist.

the effective user ID describes the user whose file access permissions are used by the process (see geteuid(2)). identical to U and --user.

  • --User userlist — select by real user ID (RUID) or name. identical to -U.
  • --user userlist — select by effective user ID (EUID) or name. identical to -u and U. ✨

✨ OUTPUT FORMAT CONTROL ✨

Okay bestie, these options are the ones that decide what info actually shows up in your ps output. Heads up though — the output can differ depending on the personality you're in. Yes, ps has personalities. Iconic behavior tbh. 💅

  • -c — shows you a different flavor of scheduler info for the -l option.
  • --context — displays the security context format (this one's for SELinux).
  • -f — the full-format listing, the glow-up version. You can stack it with tons of other UNIX-style options to add extra columns, and it also makes the command arguments print out. When you pair it with -L, you get the NLWP (number of threads) and LWP (thread ID) columns added in. Check out the c option, the format keyword args, and the format keyword comm.
  • -F — extra full format. Basically peep the -f option, because -F implies it.
  • --format format — user-defined format. Literally identical to -o and o.
  • j — BSD job control format.
  • -j — jobs format.
  • l — displays the BSD long format.
  • -l — long format. The -y option is often super useful alongside this one.
  • -M — adds a column of security data. Identical to Z (for SELinux).
  • O format — this one is preloaded o (aka overloaded). The BSD O option can act like -O (user-defined output format with some common fields already predefined) or it can be used to specify sort order. The tool uses heuristics to figure out which behavior you want. To make sure you actually get the behavior you're after (sorting or formatting), just specify the option some other way (like with -O or --sort). When it's used as a formatting option, it's identical to -O, with the BSD personality.
  • -O format — like -o, but preloaded with some default columns. Identical to -o pid,format,state,tname,time,command or -o pid,format,tname,time,cmd, see -o below.
  • o format — specify user-defined format. Identical to -o and --format.
  • -o format — user-defined format, the DIY queen 👑. The format is a single argument shaped like a blank-separated or comma-separated list, and it's how you pick out individual output columns. The recognized keywords are described down in the STANDARD FORMAT SPECIFIERS section. You can rename headers however you want (ps -o pid,ruser=RealUser -o comm=Command). If all your column headers are empty (ps -o pid= -o comm=) then the header line just won't be output at all. Column width grows as needed for wide headers, and you can use that to widen up columns like WCHAN (ps -o pid,wchan=WIDE-WCHAN-COLUMN -o comm). Explicit width control is on the menu too (ps opid,wchan:42,cmd). Okay and here's a lil gotcha: the behavior of ps -o pid=X,comm=Y varies with personality — you might get one column named "X,comm=Y" or two columns named "X" and "Y". So when in doubt, just use multiple -o options. Use the PS_FORMAT environment variable to set a default if you want; DefSysV and DefBSD are macros you can use to choose the default UNIX or BSD columns.
  • s — displays signal format.
  • u — displays user-oriented format.
  • v — displays virtual memory format.
  • X — register format.
  • -y — don't show flags; show rss in place of addr. This option can only be used with -l.
  • Z — adds a column of security data. Identical to -M (for SELinux).

🌸 OUTPUT MODIFIERS 🌸

These ones tweak the vibe of what you're seeing, no cap.

  • c — shows the true command name. It comes from the name of the executable file, not from the argv value. So command arguments — and any modifications to them — just don't show. This option effectively turns the args format keyword into the comm format keyword; it's useful with the -f format option and with the various BSD-style format options, which all normally display the command arguments. See the -f option, the format keyword args, and the format keyword comm.
  • --cols n — set screen width.
  • --columns n — set screen width.
  • --cumulative — includes some dead child process data (as a sum with the parent).
  • e — show the environment after the command.
  • f — ASCII art process hierarchy (forest). It's giving tree 🌳.
  • --forest — ASCII art process tree.
  • h — no header. (Or, one header per screen in the BSD personality.) Okay so, the h option is problematic. Standard BSD ps uses this option to print a header on each page of output, but older Linux ps uses this option to totally disable the header. This version of ps follows the Linux usage — no header printed — unless the BSD personality has been selected, in which case it prints a header on each page of output. Regardless of which personality you're in, you can use the long options --headers and --no-headers to enable printing headers each page or disable headers entirely.
  • -H — show process hierarchy (forest).
  • --headers — repeat header lines, one per page of output.
  • k spec — specify sorting order. The sorting syntax is [+|-]key[,[+|-]key[,...]]. Pick a multi-letter key from the STANDARD FORMAT SPECIFIERS section. The "+" is optional since the default direction is increasing numerical or lexicographic order. Identical to --sort.

Examples:

ps jaxkuid,-ppid,+pid
ps axk comm o comm,args
ps kstart_time -ef
  • --lines n — set screen height.
  • n — numeric output for WCHAN and USER (including all types of UID and GID).
  • --no-headers — print no header line at all. --no-heading is an alias for this option.
  • O order — sorting order (overloaded). The BSD O option can act like -O (user-defined output format with some common fields predefined) or it can be used to specify sort order. Heuristics are used to determine the behavior of this option. To make sure you get the behavior you want (sorting or formatting), specify the option some other way (like with -O or --sort).

For sorting, the obsolete BSD O option syntax is O[+|-]k1[,[+|-]k2[,...]]. It orders the process listing according to the multilevel sort specified by the sequence of one-letter short keys k1,k2, ... described in the OBSOLETE SORT KEYS section below. The "+" is currently optional — it just re-iterates the default direction on a key — but it may help distinguish an O sort from an O format. The "-" reverses direction only on the key it precedes.

  • --rows n — set screen height.
  • S — sum up some information, like CPU usage, from dead child processes into their parent. This is handy for examining a system where a parent process repeatedly forks off short-lived children to do work.
  • --sort spec — specify sorting order. The sorting syntax is [+|-]key[,[+|-]key[,...]]. Choose a multi-letter key from the STANDARD FORMAT SPECIFIERS section. The "+" is optional since the default direction is increasing numerical or lexicographic order. Identical to k. For example: ps jax --sort=uid,-ppid,+pid
  • w — wide output. Use this option twice for unlimited width.
  • -w — wide output. Use this option twice for unlimited width.
  • --width n — set screen width.

🧵 THREAD DISPLAY 🧵

Threads are the moment, fr fr.

  • H — show threads as if they were processes.
  • -L — show threads, possibly with LWP and NLWP columns.
  • m — show threads after processes.
  • -m — show threads after processes.
  • -T — show threads, possibly with SPID column.

💖 OTHER INFORMATION 💖

  • --help section — print a help message. The section argument can be one of simple, list, output, threads, misc, or all. The argument can be shortened to one of the underlined letters, like: s|l|o|t|m|a.
  • --info — print debugging info.
  • L — list all format specifiers.
  • V — print the procps-ng version.
  • -V — print the procps-ng version.
  • --version — print the procps-ng version.

🫶 NOTES 🫶

Okay so this ps works by reading the virtual files in /proc. And it does not need to be setuid kmem or have any privileges to run. Do not give this ps any special permissions, bestie. 🙅‍♀️

CPU usage is currently expressed as the percentage of time spent running during the entire lifetime of a process. This is not ideal, and it doesn't conform to the standards that ps otherwise conforms to. CPU usage is unlikely to add up to exactly 100%.

The SIZE and RSS fields don't count some parts of a process — including the page tables, kernel stack, struct thread_info, and struct task_struct. This is usually at least 20 KiB of memory that is always resident. SIZE is the virtual size of the process (code+data+stack).

Processes marked <defunct> are dead processes (so-called "zombies") that stick around because their parent hasn't destroyed them properly. These processes will be destroyed by init(8) if the parent process exits.

If the length of the username is greater than the length of the display column, the username gets truncated. See the -o and -O formatting options to customize length.

Commands options such as ps -aux are not recommended, because it's a confusion of two different standards. According to the POSIX and UNIX standards, the above command asks to display all processes with a TTY (generally the commands users are running) plus all processes owned by a user named x. If that user doesn't exist, then ps will assume you really meant ps aux.

🔥 PROCESS FLAGS 🔥

The sum of these values is displayed in the "F" column, which is provided by the flags output specifier:

1    forked but didn't exec
4    used super-user privileges

👑 PROCESS STATE CODES 👑

Here are the different values that the s, stat and state output specifiers (header "STAT" or "S") will display to describe the state of a process:

D    uninterruptible sleep (usually IO)
I    Idle kernel thread
R    running or runnable (on run queue)
S    interruptible sleep (waiting for an event to complete)
T    stopped by job control signal
t    stopped by debugger during the tracing
W    paging (not valid since the 2.6.xx kernel)
X    dead (should never be seen)
Z    defunct ("zombie") process, terminated but not reaped by
     its parent

For BSD formats and when the stat keyword is used, additional characters may be displayed:

<    high-priority (not nice to other users)
N    low-priority (nice to other users)
L    has pages locked into memory (for real-time and custom IO)
s    is a session leader
l    is multi-threaded (using CLONE_THREAD, like NPTL pthreads
     do)
+    is in the foreground process group

🫠 OBSOLETE SORT KEYS 🫠

okay so these keys are what the BSD O option uses — but ONLY when it's being used for sorting, bestie. The GNU --sort option does not use these keys, it uses the specifiers down in the STANDARD FORMAT SPECIFIERS section instead. Keep up 💅

And a lil heads up: the values used in sorting are the internal values ps uses, not the "cooked" values you see in some of the output format fields. Like, sorting on tty sorts into device number, not according to the terminal name that gets displayed. So if you want to sort the cooked values, just pipe ps output into the sort(1) command. iykyk 🌸
  • c / cmd — simple name of executable
  • C / pcpu — cpu utilization
  • f / flags — flags as in long format F field
  • g / pgrp — process group ID
  • G / tpgid — controlling tty process group ID
  • j / cutime — cumulative user time
  • J / cstime — cumulative system time
  • k / utime — user time
  • m / min_flt — number of minor page faults
  • M / maj_flt — number of major page faults
  • n / cmin_flt — cumulative minor page faults
  • N / cmaj_flt — cumulative major page faults
  • o / session — session ID
  • p / pid — process ID
  • P / ppid — parent process ID
  • r / rss — resident set size
  • R / resident — resident pages
  • s / size — memory size in kilobytes
  • S / share — amount of shared pages
  • t / tty — the device number of the controlling tty
  • T / start_time — time process was started
  • U / uid — user ID number
  • u / user — user name
  • v / vsize — total VM size in KiB
  • y / priority — kernel scheduling priority

🔮 AIX FORMAT DESCRIPTORS 🔮

This ps supports AIX format descriptors, which work kinda like the formatting codes of printf(1) and printf(3) — fr fr, same energy. For example, the normal default output can be produced with this:

ps -eo "%p %y %x %c"

The NORMAL codes are described in the next section ✨

  • %C → NORMAL pcpu → HEADER %CPU
  • %G → NORMAL group → HEADER GROUP
  • %P → NORMAL ppid → HEADER PPID
  • %U → NORMAL user → HEADER USER
  • %a → NORMAL args → HEADER COMMAND
  • %c → NORMAL comm → HEADER COMMAND
  • %g → NORMAL rgroup → HEADER RGROUP
  • %n → NORMAL nice → HEADER NI
  • %p → NORMAL pid → HEADER PID
  • %r → NORMAL pgid → HEADER PGID
  • %t → NORMAL etime → HEADER ELAPSED
  • %u → NORMAL ruser → HEADER RUSER
  • %x → NORMAL time → HEADER TIME
  • %y → NORMAL tty → HEADER TTY
  • %z → NORMAL vsz → HEADER VSZ

🌟 STANDARD FORMAT SPECIFIERS 🌟

Here are all the different keywords you can use to control the output format (like, with option -o) or to sort the selected processes with the GNU-style --sort option. This is the good stuff 💖

For example:

ps -eo pid,user,args --sort user

This version of ps tries to recognize most of the keywords used in other implementations of ps. Iconic behaviour honestly 👑

The following user-defined format specifiers may contain spaces: args, cmd, comm, command, fname, ucmd, ucomm, lstart, bsdstart, start.

Some keywords may not be available for sorting. It's giving... limited, but we move 😭

  • %cpu — header %CPU — cpu utilization of the process in "##.#" format. Currently, it is the CPU time used divided by the time the process has been running (cputime/realtime ratio), expressed as a percentage. It will not add up to 100% unless you are lucky. (alias pcpu).
  • %mem — header %MEM — ratio of the process's resident set size to the physical memory on the machine, expressed as a percentage. (alias pmem).
  • args — header COMMAND — command with all its arguments as a string. Modifications to the arguments may be shown. The output in this column may contain spaces. A process marked <defunct> is partly dead, waiting to be fully destroyed by its parent. Sometimes the process args will be unavailable; when this happens, ps will instead print the executable name in brackets. (alias cmd, command). See also the comm format keyword, the -f option, and the c option.
    • When specified last, this column will extend to the edge of the display. If ps can not determine display width, as when output is redirected (piped) into a file or another command, the output width is undefined (it may be 80, unlimited, determined by the TERM variable, and so on). The COLUMNS environment variable or --cols option may be used to exactly determine the width in this case. The w or -w option may be also be used to adjust width.
  • blocked — header BLOCKED — mask of the blocked signals, see signal(7). According to the width of the field, a 32 or 64-bit mask in hexadecimal format is displayed. (alias sig_block, sigmask).
  • bsdstart — header START — time the command started. If the process was started less than 24 hours ago, the output format is " HH:MM", else it is " Mmm:SS" (where Mmm is the three letters of the month). See also lstart, start, start_time, and stime.
  • bsdtime — header TIME — accumulated cpu time, user + system. The display format is usually "MMM:SS", but can be shifted to the right if the process used more than 999 minutes of cpu time.
  • c — header C — processor utilization. Currently, this is the integer value of the percent usage over the lifetime of the process. (see %cpu).
  • caught — header CAUGHT — mask of the caught signals, see signal(7). According to the width of the field, a 32 or 64 bits mask in hexadecimal format is displayed. (alias sig_catch, sigcatch).
  • cgname — header CGNAME — display name of control groups to which the process belongs.
  • cgroup — header CGROUP — display control groups to which the process belongs.
  • class — header CLS — scheduling class of the process. (alias policy, cls). Field's possible values are:
    • - — not reported
    • TS — SCHED_OTHER
    • FF — SCHED_FIFO
    • RR — SCHED_RR
    • B — SCHED_BATCH
    • ISO — SCHED_ISO
    • IDL — SCHED_IDLE
    • DLN — SCHED_DEADLINE
    • ? — unknown value
  • cls — header CLS — scheduling class of the process. (alias policy, cls). Field's possible values are:
    • - — not reported
    • TS — SCHED_OTHER
    • FF — SCHED_FIFO
    • RR — SCHED_RR
    • B — SCHED_BATCH
    • ISO — SCHED_ISO
    • IDL — SCHED_IDLE
    • DLN — SCHED_DEADLINE
    • ? — unknown value
  • cmd — header CMD — see args. (alias args, command).
  • comm — header COMMAND — command name (only the executable name). Modifications to the command name will not be shown. A process marked <defunct> is partly dead, waiting to be fully destroyed by its parent. The output in this column may contain spaces. (alias ucmd, ucomm). See also the args format keyword, the -f option, and the c option.
    • When specified last, this column will extend to the edge of the display. If ps can not determine display width, as when output is redirected (piped) into a file or another command, the output width is undefined (it may be 80, unlimited, determined by the TERM variable, and so on). The COLUMNS environment variable or --cols option may be used to exactly determine the width in this case. The w or -w option may be also be used to adjust width.
  • command — header COMMAND — See args. (alias args, command).
  • cp — header CP — per-mill (tenths of a percent) CPU usage. (see %cpu).
  • cputime — header TIME — cumulative CPU time, "[DD-]hh:mm:ss" format. (alias time).
  • cputimes — header TIME — cumulative CPU time in seconds (alias times).
  • drs — header DRS — data resident set size, the amount of physical memory devoted to other than executable code.
  • egid — header EGID — effective group ID number of the process as a decimal integer. (alias gid).
  • egroup — header EGROUP — effective group ID of the process. This will be the textual group ID, if it can be obtained and the field width permits, or a decimal representation otherwise. (alias group).
  • eip — header EIP — instruction pointer.
  • esp — header ESP — stack pointer.
  • etime — header ELAPSED — elapsed time since the process was started, in the form [[DD-]hh:]mm:ss.
  • etimes — header ELAPSED — elapsed time since the process was started, in seconds.
  • euid — header EUID — effective user ID (alias uid).
  • euser — header EUSER — effective user name. This will be the textual user ID, if it can be obtained and the field width permits, or a decimal representation otherwise. The n option can be used to force the decimal representation. (alias uname, user).
  • exe — header EXE — path to the executable. Useful if path cannot be printed via cmd, comm or args format options.
  • f — header F — flags associated with the process, see the PROCESS FLAGS section. (alias flag, flags).
  • fgid — header FGID — filesystem access group ID. (alias fsgid).
  • fgroup, FGROUP — filesystem access group ID. It'll show the textual group ID if it can be obtained and the field width permits, otherwise it's a decimal representation, periodt. (alias fsgroup). 💅
  • flag, F — okay so this is just a redirect: see f. (alias f, flags). 🔁
  • flags, F — another redirect bestie, see f. (alias f, flag). 🔁
  • fname, COMMAND — first 8 bytes of the base name of the process's executable file. Heads up, the output in this column may contain spaces. 😭
  • fuid, FUID — filesystem access user ID. (alias fsuid). ✨
  • fuser, FUSER — filesystem access user ID. This will be the textual user ID, if it can be obtained and the field width permits, or a decimal representation otherwise. 💖
  • gid, GID — see egid. (alias egid). 🔁
  • group, GROUP — see egroup. (alias egroup). 🔁
  • ignored, IGNORED — mask of the ignored signals, see signal(7). According to the width of the field, a 32 or 64 bits mask in hexadecimal format is displayed. (alias sig_ignore, sigignore). 🚫
  • ipcns, IPCNS — Unique inode number describing the namespace the process belongs to. See namespaces(7). 🌀
  • label, LABEL — security label, most commonly used for SELinux context data. This is for the Mandatory Access Control ("MAC") found on high-security systems. 🔒
  • lstart, STARTED — time the command started. See also bsdstart, start, start_time, and stime. ⏰
  • lsession, SESSION — displays the login session identifier of a process, if systemd support has been included. 🪪
  • luid, LUID — displays Login ID associated with a process. 🆔
  • lwp, LWP — light weight process (thread) ID of the dispatchable entity (alias spid, tid). See tid for additional information. 🧵
  • lxc, LXC — The name of the lxc container within which a task is running. If a process is not running inside a container, a dash (-) will be shown. 📦
  • machine, MACHINE — displays the machine name for processes assigned to VM or container, if systemd support has been included. 🖥️
  • maj_flt, MAJFLT — The number of major page faults that have occurred with this process. 💥
  • min_flt, MINFLT — The number of minor page faults that have occurred with this process. ✨
  • mntns, MNTNS — Unique inode number describing the namespace the process belongs to. See namespaces(7). 🗂️
  • netns, NETNS — Unique inode number describing the namespace the process belongs to. See namespaces(7). 🌐
  • ni, NI — nice value. This ranges from 19 (nicest) to -20 (not nice to others), see nice(1). (alias nice). 😇
  • nice, NI — see ni. (alias ni). 🔁
  • nlwp, NLWP — number of lwps (threads) in the process. (alias thcount). 🧮
  • numa, NUMA — The node associated with the most recently used processor. A -1 means that NUMA information is unavailable. 🧠
  • nwchan, WCHAN — address of the kernel function where the process is sleeping (use wchan if you want the kernel function name). Running tasks will display a dash (-) in this column. 😴
  • ouid, OWNER — displays the Unix user identifier of the owner of the session of a process, if systemd support has been included. 👑
  • pcpu, %CPU — see %cpu. (alias %cpu). 🔁
  • pending, PENDING — mask of the pending signals. See signal(7). Signals pending on the process are distinct from signals pending on individual threads. Use the m option or the -m option to see both. According to the width of the field, a 32 or 64 bits mask in hexadecimal format is displayed. (alias sig). ⏳
  • pgid, PGID — process group ID or, equivalently, the process ID of the process group leader. (alias pgrp). 👯
  • pgrp, PGRP — see pgid. (alias pgid). 🔁
  • pid, PID — a number representing the process ID (alias tgid). 🔢
  • pidns, PIDNS — Unique inode number describing the namespace the process belongs to. See namespaces(7). 🌀
  • pmem, %MEM — see %mem. (alias %mem). 🔁
  • policy, POL — scheduling class of the process. (alias class, cls). Possible values are:
    • - — not reported
    • TS — SCHED_OTHER
    • FF — SCHED_FIFO
    • RR — SCHED_RR
    • B — SCHED_BATCH
    • ISO — SCHED_ISO
    • IDL — SCHED_IDLE
    • DLN — SCHED_DEADLINE
    • ? — unknown value
  • ppid, PPID — parent process ID. 👨‍👧
  • pri, PRI — priority of the process. Higher number means lower priority. ⬆️⬇️
  • psr, PSR — processor that process is currently assigned to. 🖥️
  • rgid, RGID — real group ID. 🆔
  • rgroup, RGROUP — real group name. This will be the textual group ID, if it can be obtained and the field width permits, or a decimal representation otherwise. 💖
  • rss, RSS — resident set size, the non-swapped physical memory that a task has used (in kilobytes). (alias rssize, rsz). 🧠
  • rssize, RSS — see rss. (alias rss, rsz). 🔁
  • rsz, RSZ — see rss. (alias rss, rssize). 🔁
  • rtprio, RTPRIO — realtime priority. ⚡
  • ruid, RUID — real user ID. 🆔
  • ruser, RUSER — real user ID. This will be the textual user ID, if it can be obtained and the field width permits, or a decimal representation otherwise. 💖
  • s, S — minimal state display (one character). See section PROCESS STATE CODES for the different values. See also stat if you want additional information displayed. (alias state). 🔤
  • sched, SCH — scheduling policy of the process. The policies SCHED_OTHER (SCHED_NORMAL), SCHED_FIFO, SCHED_RR, SCHED_BATCH, SCHED_ISO, SCHED_IDLE and SCHED_DEADLINE are respectively displayed as 0, 1, 2, 3, 4, 5 and 6. 📅
  • seat, SEAT — displays the identifier associated with all hardware devices assigned to a specific workplace, if systemd support has been included. 🪑
  • sess, SESS — session ID or, equivalently, the process ID of the session leader. (alias session, sid). 🪪
  • sgi_p, P — processor that the process is currently executing on. Displays "*" if the process is not currently running or runnable. ⭐
  • sgid, SGID — saved group ID. (alias svgid). 🆔
  • sgroup, SGROUP — saved group name. This will be the textual group ID, if it can be obtained and the field width permits, or a decimal representation otherwise. 💖
  • sid, SID — see sess. (alias sess, session). 🔁
  • sig, PENDING — see pending. (alias pending, sig_pend). 🔁
  • sigcatch, CAUGHT — see caught. (alias caught, sig_catch). 🔁
  • sigignore, IGNORED — see ignored. (alias ignored, sig_ignore). 🔁
  • sigmask, BLOCKED — see blocked. (alias blocked, sig_block). 🔁
  • size, SIZE — approximate amount of swap space that would be required if the process were to dirty all writable pages and then be swapped out. This number is very rough! 😬
  • slice, SLICE — displays the slice unit which a process belongs to, if systemd support has been included. 🍰
  • spid, SPID — see lwp. (alias lwp, tid). 🔁
  • stackp, STACKP — address of the bottom (start) of stack for the process. 🥞
  • start, STARTED — time the command started. If the process was started less than 24 hours ago, the output format is "HH:MM:SS", else it is " Mmm dd" (where Mmm is a three-letter month name). See also lstart, bsdstart, start_time, and stime. ⏰
  • start_time, START — starting time or date of the process. Only the year will be displayed if the process was not started the same year ps was invoked, or "MmmDD" if it was not started the same day, or "HH:MM" otherwise. See also bsdstart, start, lstart, and stime. 📅
  • stat, STAT — multi-character process state. See section PROCESS STATE CODES for the different values meaning. See also s and state if you just want the first character displayed. 🔤
  • state, S — see s. (alias s). 🔁
  • stime, STIME — see start_time. (alias start_time). 🔁
  • suid, SUID — saved user ID. (alias svuid). 🆔
  • supgid, SUPGID — group ids of supplementary groups, if any. See getgroups(2). 👥
  • supgrp, SUPGRP — group names of supplementary groups, if any. See getgroups(2). 👥
  • suser, SUSER — saved user name. This will be the textual user ID, if it can be obtained and the field width permits, or a decimal representation otherwise. (alias svuser). 💖
  • svgid, SVGID — see sgid. (alias sgid). 🔁
  • svuid, SVUID — see suid. (alias suid). 🔁
  • sz, SZ — size in physical pages of the core image of the process. This includes text, data, and stack space. Device mappings are currently excluded; this is subject to change. See vsz and rss. 🧠
  • tgid, TGID — a number representing the thread group to which a task belongs (alias pid). It is the process ID of the thread group leader. 🧵
  • thcount, THCNT — bestie, this one says see nlwp. (alias nlwp). It's the number of kernel threads owned by the process. periodt ✨
  • tid, TID — the unique number representing a dispatchable entity (alias lwp, spid). This value may also appear as: a process ID (pid); a process group ID (pgrp); a session ID for the session leader (sid); a thread group ID for the thread group leader (tgid); and a tty process group ID for the process group leader (tpgid). it's giving every ID at once 💅
  • time, TIME — cumulative CPU time, "[DD-]HH:MM:SS" format. (alias cputime). ⏰
  • times, TIME — cumulative CPU time in seconds (alias cputimes). ⏳
  • tname, TTY — controlling tty (terminal). (alias tt, tty). 🖥️
  • tpgid, TPGID — ID of the foreground process group on the tty (terminal) that the process is connected to, or -1 if the process is not connected to a tty. no tty? it's -1, bestie 🫶
  • trs, TRS — text resident set size, the amount of physical memory devoted to executable code. 🧠
  • tt, TT — controlling tty (terminal). (alias tname, tty). ✨
  • tty, TT — controlling tty (terminal). (alias tname, tt). 🌸
  • ucmd, CMD — see comm. (alias comm, ucomm). 💖
  • ucomm, COMMAND — see comm. (alias comm, ucmd). 💫
  • uid, UID — see euid. (alias euid). 🆔
  • uname, USER — see euser. (alias euser, user). 👑
  • unit, UNIT — displays unit which a process belongs to, if systemd support has been included. 🧚
  • user, USER — see euser. (alias euser, uname). 🫶
  • userns, USERNS — Unique inode number describing the namespace the process belongs to. See namespaces(7). 🌈
  • utsns, UTSNS — Unique inode number describing the namespace the process belongs to. See namespaces(7). 🦋
  • uunit, UUNIT — displays user unit which a process belongs to, if systemd support has been included. 🌟
  • vsize, VSZ — see vsz. (alias vsz). 💅
  • vsz, VSZ — virtual memory size of the process in KiB (1024-byte units). Device mappings are currently excluded; this is subject to change. (alias vsize). subject to change, so don't make it your whole personality 😭
  • wchan, WCHAN — name of the kernel function in which the process is sleeping, a "-" if the process is running, or a "*" if the process is multi-threaded and ps is not displaying threads. 💤

🌿 ENVIRONMENT VARIABLES 🌿

The following environment variables could affect ps:

  • COLUMNS — Override default display width. 📏
  • LINES — Override default display height. 📐
  • PS_PERSONALITY — Set to one of posix, old, linux, bsd, sun, digital... (see section PERSONALITY below). 🎭
  • CMD_ENV — Set to one of posix, old, linux, bsd, sun, digital... (see section PERSONALITY below). 🎭
  • I_WANT_A_BROKEN_PS — Force obsolete command line interpretation. 💀
  • LC_TIME — Date format. 📅
  • PS_COLORS — Not currently supported. 🙈
  • PS_FORMAT — Default output format override. You may set this to a format string of the type used for the -o option. The DefSysV and DefBSD values are particularly useful. ✨
  • POSIXLY_CORRECT — Don't find excuses to ignore bad "features". 😌
  • POSIX2 — When set to "on", acts as POSIXLY_CORRECT. 🔛
  • UNIX95 — Don't find excuses to ignore bad "features". 😌
  • _XPG — Cancel CMD_ENV=irix non-standard behavior. 🚫
okay so in general, it is a bad idea to set these variables. The one exception is CMD_ENV or PS_PERSONALITY, which could be set to Linux for normal systems. Without that setting, ps follows the useless and bad parts of the Unix98 standard. iykyk 💅

🎭 PERSONALITY 🎭

  • 390 — like the OS/390 OpenEdition ps
  • aix — like AIX ps
  • bsd — like FreeBSD ps (totally non-standard)
  • compaq — like Digital Unix ps
  • debian — like the old Debian ps
  • digital — like Tru64 (was Digital Unix, was OSF/1) ps
  • gnu — like the old Debian ps
  • hp — like HP-UX ps
  • hpux — like HP-UX ps
  • irix — like Irix ps
  • linux — * recommended *
  • old — like the original Linux ps (totally non-standard)
  • os390 — like OS/390 Open Edition ps
  • posix — standard
  • s390 — like OS/390 Open Edition ps
  • sco — like SCO ps
  • sgi — like Irix ps
  • solaris2 — like Solaris 2+ (SunOS 5) ps
  • sunos4 — like SunOS 4 (Solaris 1) ps (totally non-standard)
  • svr4 — standard
  • sysv — standard
  • tru64 — like Tru64 (was Digital Unix, was OSF/1) ps
  • unix — standard
  • unix95 — standard
  • unix98 — standard

👀 SEE ALSO 👀

bestie, go peek at pgrep(1), pstree(1), top(1), and proc(5). 💖

📜 STANDARDS 📜

This ps conforms to:

  1. Version 2 of the Single Unix Specification
  2. The Open Group Technical Standard Base Specifications, Issue 6
  3. IEEE Std 1003.1, 2004 Edition
  4. X/Open System Interfaces Extension [UP XSI]
  5. ISO/IEC 9945:2003

👑 AUTHOR 👑

okay so ps was originally written by Branko Lankester. Michael K. Johnson re-wrote it significantly to use the proc filesystem, changing a few things in the process. Michael Shields added the pid-list feature. Charles Blake added multi-level sorting, the dirent-style library, the device name-to-number mmaped database, the approximate binary search directly on System.map, and many code and documentation cleanups. David Mossberger-Tang wrote the generic BFD support for psupdate. Albert Cahalan rewrote ps for full Unix98 and BSD support, along with some ugly hacks for obsolete and foreign syntax.

Please send bug reports to procps@freelists.org. No subscription is required or suggested. slay, they said what they said 💅

this whole page is from procps-ng, dated 2020-06-04, and it's PS(1) — bye bestie, go check your processes 💖✨

📦 where this page comes from