cheatsheet

ps Command in Linux: Syntax, Options & Process Listing Examples

ps prints a snapshot of running processes from /proc — PIDs, owners, CPU and memory use, and command lines. Part of procps-ng on most Linux distros; ideal for scripts and one-off checks.

Published

Updated

Read time 8 min read

Reviewed byDeepak Prasad

ps Command in Linux: Syntax, Options & Process Listing Examples
About ps prints a snapshot of running processes from /proc — PIDs, owners, CPU and memory use, and command lines. Part of procps-ng on most Linux distros; ideal for scripts and one-off checks.
Tested on Ubuntu 25.04 (Plucky Puffin); ps from procps-ng 4.0.4; kernel 7.0.0-27-generic
Package procps (apt/deb) · procps-ng (dnf/rpm)
Man page ps(1)
Privilege user (see all processes may need root)
Distros All Linux distros shipping procps / procps-ng (Ubuntu, Debian, RHEL, Fedora, SUSE, Arch, and others).
Related guide

ps — quick reference

Basic listing

See what is running — from the current shell session up to every process on the host.

When to use Command
Processes tied to the current terminal session ps
Every process on the system (BSD -e or POSIX -A) ps -e
Full list with user, CPU%, memory%, and command (common on Linux) ps aux
Full list in SysV style with parent PID and start time ps -ef
Only processes owned by your login ps -u "$(whoami)"

Process selection

Narrow the list to one PID, one command name, children of a parent, or a specific user.

When to use Command
Show one or more PIDs ps -p 1234,5678
List child processes of a parent PID ps --ppid 1
Match by executable name (comm field) ps -C nginx
Filter by effective username ps -u www-data
Filter by real username ps -U root
Negate a selection (processes not matching -p) ps -p 1 --deselect

Output format

Control which columns appear and whether you get a process tree.

When to use Command
Full format with command line ps -f
BSD job-control style columns ps -j
ASCII process tree ps --forest
Hierarchy view (alternate tree layout) ps -H
User-oriented format (USER, %CPU, %MEM, …) ps u
Custom columns by keyword ps -o pid,user,cmd
Preload default columns plus extras ps -O pcpu,pmem

Sorting and width

Sort in the terminal or widen columns so long command lines are not truncated.

When to use Command
Sort by memory use (highest first) ps -eo pid,user,%mem,cmd --sort=-%mem
Sort by CPU use ps -eo pid,user,%cpu,cmd --sort=-%cpu
Do not truncate command lines to terminal width ps auxww
Show environment after the command (verbose) ps e

Threads

Include kernel threads or list threads inside one process.

When to use Command
Show threads as separate rows (LWP column) ps -L
Threads for one PID ps -L -p 1234
Thread-related columns with -m / -T ps -m

Help and version

When to use Command
Brief usage ps --help
Extended help topics ps --help all
Installed procps-ng version ps --version

ps — command syntax

Synopsis from ps --help on Ubuntu 25.04 (procps-ng 4.0.4):

text 
ps [options]

ps reads process data from /proc and prints a static snapshot — it does not refresh like top. No special privilege is required to see your own processes; sudo ps may show more on some systems.

ps — command examples

Essential List processes in the current session

Run plain ps when you only care about what is attached to this terminal — quick check before closing a session.

Run the command:

bash 
ps

Sample output (PIDs and commands vary):

text 
PID TTY          TIME CMD
  10103 pts/0    00:00:02 bash
  52401 pts/0    00:00:00 ps

The ps line appears because the command itself is a short-lived process in that shell.

Essential Full process table — ps aux

ps aux is the usual Linux habit for a system-wide snapshot with user, CPU%, memory%, and the full command line.

Run the command:

bash 
ps aux | head -5

Sample output:

text 
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root           1  0.0  0.1  25736  9836 ?        Ss   08:54   0:10 /sbin/init splash
root           2  0.0  0.0      0     0 ?        S    08:54   0:01 [kthreadd]
root           3  0.0  0.0      0     0 ?        S    08:54   0:00 [pool_workqueue_release]
root         267  0.0  0.3  60144 17856 ?        Ss   08:54   0:06 /usr/lib/systemd/systemd-journald

Pipe to head, grep, or awk in scripts so you are not flooded with every process on a busy server.

Common Find processes by command name

Use -C when you know the service name but not the PID — faster than scrolling ps aux.

Run the command:

bash 
ps -C bash -o pid,cmd

Sample output:

text 
PID CMD
   4022 bash
  10103 bash

Replace bash with nginx, sshd, or whatever you are troubleshooting.

Common Inspect one PID and its parent

When a service looks stuck, confirm the PID and who started it with -o and -p.

Run the command:

bash 
ps -p 1 -o pid,ppid,user,cmd

Sample output:

text 
PID    PPID USER     CMD
      1       0 root     /sbin/init splash

PPID 0 means no parent in the usual sense — PID 1 is the init process.

Common List child processes of a parent

See what systemd (or any supervisor) spawned directly — useful after a service restart.

Run the command:

bash 
ps --ppid 1 -o pid,cmd | head -6

Sample output:

text 
PID CMD
    267 /usr/lib/systemd/systemd-journald
    336 /usr/lib/systemd/systemd-udevd
   1148 /usr/libexec/accounts-daemon
   1157 /usr/sbin/cron
   1187 /usr/lib/snapd/snapd

Add -o columns or pipe to grep to focus on one daemon family.

Common Process tree with --forest

A tree view shows parent/child relationships without leaving the terminal.

Run the command:

bash 
ps --forest -e | head -12

Sample output:

text 
PID TTY          TIME CMD
      2 ?        00:00:01 kthreadd
      3 ?        00:00:00  \_ pool_workqueue_release
      4 ?        00:00:00  \_ kworker/R-rcu_gp
      5 ?        00:00:00  \_ kworker/R-sync_wq

Backslash-indented lines are children of the row above.

Advanced Sort processes by memory use

Find RAM-heavy processes in one shot — pair with top when you need live refresh.

Run the command:

bash 
ps -eo pid,user,%cpu,%mem,cmd --sort=-%mem | head -6

Sample output:

text 
PID USER     %CPU %MEM CMD
  21458 root     28.1 16.3 hugo server --environment production --bind 0.0.0.0
   4323 root      7.3  6.8 /root/.cursor-server/bin/linux-x64/.../node
  16072 root      0.0  1.7 tsserver[5.9.2]: semantic

Leading - in --sort=-%mem means descending (biggest first).

Advanced Show threads for one process

Some apps spawn many threads — -L lists them like separate rows.

Run the command:

bash 
ps -L -p 1 -o pid,lwp,cmd

Sample output:

text 
PID     LWP CMD
      1       1 /sbin/init splash

For a multi-threaded app you will see multiple LWP values under one PID.

ps — when to use / when not

Use ps when Use something else when
  • You need a one-time process list for a script or ticket
  • You are filtering by PID, user, or command name with flags
  • You want lightweight output piped to grep, awk, or cut
  • procps is already installed (default on most distros)
  • You need a live refreshing view → top or htop
  • You need historical CPU/memory trends → sar or monitoring tools
  • You need to change priority → nice / renice
  • You need to stop a process → kill / killall

ps vs top

ps top
Output Static snapshot Refreshes until you quit
Best for Scripts, logs, quick checks Live triage, watching spikes
Sorting --sort on -eo lines Interactive -o / key presses
System summary No load/CPU header by default Uptime, load, CPU, memory header
Package procps-ng procps-ng (same family)

Both read /proc. Use ps when the command must exit cleanly; use top when you are watching behavior over time.

Nearby tools for the same workflow — spot, sort, and control running processes.

Command One line
ps Static process snapshot (this page)
pgrep Find PIDs by name pattern

Browse the full index in our Linux commands reference.

ps — interview corner

What does the ps command do in Linux?

ps (process status) prints a snapshot of processes: PID, owner, CPU and memory use, state, and often the command line. It reads from /proc and is part of procps-ng on modern distros.

Unlike top, ps runs once and exits — ideal for scripts:

bash 
ps aux | grep nginx

A strong answer is:

"ps lists running processes from /proc as a static snapshot. I use ps aux or ps -eo with custom columns in scripts, and top when I need a live view."

What does ps aux mean?

On Linux, ps aux is three BSD-style flags combined (no leading dash on aux):

Flag Meaning
a Processes from all users with a terminal
u User-oriented columns (USER, %CPU, %MEM, …)
x Include processes without a controlling TTY

Together they produce the wide table admins grep daily. ps -ef is the SysV alternative with UID, PPID, and STIME.

A strong answer is:

"ps aux is the common Linux form — a, u, and x are BSD options for all users, user-oriented output, and processes without a TTY. ps -ef is the SysV-style full list with parent PID."

When would you use ps instead of top?

Use ps for point-in-time lists in scripts, cron jobs, or support tickets — it is cheap and exits. Use top when load is climbing and you need repeated samples with a CPU/memory header.

Batch equivalent on top: top -b -n 1.

A strong answer is:

"ps for one-shot lists in automation; top when I'm watching a spike live. For logs I often use top -b -n 1 or ps with --sort."

What package provides ps on Ubuntu?

The procps package (upstream procps-ng) ships ps, top, free, vmstat, and related tools. Check the build with:

bash 
ps --version

Sample line:

text 
ps from procps-ng 4.0.4

A strong answer is:

"ps comes from procps-ng — the procps package on Debian and Ubuntu. Same family as top and free."

How do you show custom columns with ps?

Use -o (or -eo with -e for all processes) and column keywords from the man page:

bash 
ps -eo pid,user,%mem,cmd --sort=-%mem | head

-O preloads defaults plus extra fields. Run ps -L on your host to list format specifiers on some builds.

A strong answer is:

"I use ps -eo with -o column names like pid,user,%mem,cmd and --sort for ordering — handy for finding memory hogs in one pipeline."

Troubleshooting

Symptom Likely cause Fix
Empty or tiny ps output Bare ps only shows this TTY Use ps aux or ps -e for system-wide
error: process ID list syntax error Bad -p argument Pass numeric PIDs: ps -p 1234
Truncated COMMAND column Terminal width limit ps auxww or ps -o cmd with -ww
Unknown option on a flag Older procps build Run ps --help all; drop unsupported flags
Cannot see other users' processes Running as normal user sudo ps aux for full visibility
ps vs ps -ef column mismatch BSD vs SysV styles Pick one style per script; do not mix flags blindly
Rohan Timalsina

is a technical writer and Linux enthusiast who writes practical guides on Linux commands and system administration. He focuses on simplifying complex topics through clear explanations.