NUI, Galway Compsoc :: Learning :: List processes with ps

List processes with ps

ps is a relatively simple program but has a large collection of options that can make it very powerful when it comes to trying to sort out viewing whats currently being executed on the machine. Just how things are displayed in general and one or two of the most common options used with ps and how to understand what is displayed will be covered.

ps is a program used to report process status for processes running on a machine. It gives just a snapshot status, if you want a continous update use top. Lets start by just invoking ps without any options.

$ ps

  PID TTY          TIME CMD
 4113 pts/1    00:00:00 bash
 5591 pts/1    00:00:00 ps

As you can see this only displays process running in the current terminal, it would display more if I had some jobs/processes running in the background. As to what its actually displaying its fairly straight forward:

PID = Process id, this is the unique number assigned to each process running on the machine for the duration of its execution so that it can be identified uniquely by the user, the system and any other processes running that may need to be able to identify the process.
TTY = basically this is the terminal window that the process will display output to.
TIME = as with top, this covers the amount of time that this process has been in the CPU
CMD = the name of the command that is running.

The most common options to be used with ps is usually when your trying to locate the PID of a process that needs to be killed since it has hung in one of the terminal windows that your using. In which case just running ps won't display it. The options commonly used are:

a - to display all processes even those run by the system and other users that are currently attached to a terminal
u - to include the user name in the output
and x - displays processes not attached to terminals

Basically the combination of all three options will display all processes running on the machine and include the owners username in the output beside each process. Since this throws out a lot of info its usually piped (the output is redirected, like redirecting water through a pipe) through grep and supplied with the programs name so that only the lines with that command in them will be displayed. Try just using the ps command by itself as follows:

$ ps aux

The output of that command has not been included due to its length. Clearly there is too much info to handle. Lets try searching for the web server to see who is running it and what its process id is, assuming for the moment that the normal methods of stopping and starting the service failed to work and it needed to be killed explicitly. Just remember if you're using this on frink the webserver program name is apache, on certain other Linux OS it will be called httpd (the http daemon).

$ ps aux | grep apache

www-data   838  0.0  0.2 174884 1084 ?       S    Oct29   0:00 /usr/lib/j2se/1.3/bin/i386/native_threads/java org.apache.jserv.JServ /etc/jserv/jserv.properties
www-data   905  0.0  0.2 174884 1084 ?       S    Oct29   0:15 /usr/lib/j2se/1.3/bin/i386/native_threads/java org.apache.jserv.JServ /etc/jserv/jserv.properties
www-data   906  0.0  0.2 174884 1084 ?       S    Oct29   0:54 /usr/lib/j2se/1.3/bin/i386/native_threads/java org.apache.jserv.JServ /etc/jserv/jserv.properties
www-data   907  0.0  0.2 174884 1084 ?       S    Oct29   0:00 /usr/lib/j2se/1.3/bin/i386/native_threads/java org.apache.jserv.JServ /etc/jserv/jserv.properties
www-data   908  0.0  0.2 174884 1084 ?       S    Oct29   0:00 /usr/lib/j2se/1.3/bin/i386/native_threads/java org.apache.jserv.JServ /etc/jserv/jserv.properties
www-data   912  0.0  0.2 174884 1084 ?       S    Oct29  19:34 /usr/lib/j2se/1.3/bin/i386/native_threads/java org.apache.jserv.JServ /etc/jserv/jserv.properties
www-data   913  0.0  0.2 174884 1084 ?       S    Oct29   0:00 /usr/lib/j2se/1.3/bin/i386/native_threads/java org.apache.jserv.JServ /etc/jserv/jserv.properties
www-data   914  0.0  0.2 174884 1084 ?       S    Oct29   0:00 /usr/lib/j2se/1.3/bin/i386/native_threads/java org.apache.jserv.JServ /etc/jserv/jserv.properties
www-data   915  0.0  0.2 174884 1084 ?       S    Oct29   0:00 /usr/lib/j2se/1.3/bin/i386/native_threads/java org.apache.jserv.JServ /etc/jserv/jserv.properties
www-data   916  0.0  0.2 174884 1084 ?       S    Oct29   0:00 /usr/lib/j2se/1.3/bin/i386/native_threads/java org.apache.jserv.JServ /etc/jserv/jserv.properties
www-data   917  0.0  0.2 174884 1084 ?       S    Oct29   0:02 /usr/lib/j2se/1.3/bin/i386/native_threads/java org.apache.jserv.JServ /etc/jserv/jserv.properties
root       928  0.0  0.6 84352 3520 ?        S    Oct29   0:51 /usr/sbin/apache-ssl
root     17085  0.0  0.6 84196 3192 ?        S    Oct29   1:16 /usr/sbin/apache
www-data 29950  0.0  1.7 86912 9132 ?        S    06:35   0:03 [apache-ssl]
www-data 29951  0.0  1.9 87872 10108 ?       S    06:35   0:05 [apache-ssl]
www-data 29952  0.0  1.9 87832 9976 ?        S    06:35   0:03 [apache-ssl]
www-data 29953  0.0  1.9 87744 9900 ?        S    06:35   0:03 [apache-ssl]
www-data 29954  0.0  2.0 88292 10520 ?       S    06:35   0:04 [apache-ssl]
www-data   681  0.0  1.7 86748 8964 ?        S    09:48   0:03 [apache-ssl]
www-data   684  0.0  1.8 87372 9508 ?        S    09:48   0:04 [apache-ssl]
www-data   691  0.0  1.8 87464 9584 ?        S    09:48   0:04 [apache-ssl]
www-data   692  0.0  1.8 87536 9760 ?        S    09:48   0:04 [apache-ssl]
www-data  3060  0.0  1.8 87548 9764 ?        S    11:22   0:02 [apache-ssl]
www-data  3061  0.0  1.8 87524 9772 ?        S    11:22   0:03 [apache-ssl]
www-data  3064  0.0  2.0 88108 10340 ?       S    11:22   0:02 [apache-ssl]
www-data  3065  0.0  1.8 87532 9744 ?        S    11:22   0:02 [apache-ssl]
www-data  3066  0.0  1.8 87228 9472 ?        S    11:22   0:04 [apache-ssl]
www-data 13873  0.0  1.8 87344 9612 ?        S    15:53   0:04 [apache-ssl]
www-data 21544  0.0  1.3 85060 7176 ?        S    21:13   0:01 [apache]
www-data 21896  0.0  1.1 84736 6140 ?        S    21:28   0:01 [apache]
www-data 21910  0.0  1.2 84740 6200 ?        S    21:30   0:01 [apache]
www-data 21946  0.0  1.2 84880 6324 ?        S    21:30   0:00 [apache]
www-data 22140  0.0  1.2 84840 6236 ?        S    21:39   0:00 [apache]
www-data 22870  0.0  1.2 84720 6196 ?        S    22:05   0:01 [apache]
www-data 22907  0.0  1.1 84708 6160 ?        S    22:06   0:01 [apache]
www-data 23464  0.0  1.2 84840 6236 ?        S    22:22   0:00 [apache]
www-data 23668  0.0  1.2 84772 6200 ?        S    22:29   0:00 [apache]
www-data 23719  0.0  1.1 84764 6040 ?        S    22:30   0:00 [apache]
www-data 23833  0.0  0.8 84236 4328 ?        S    22:36   0:00 [apache]
www-data 23934  0.0  0.7 84196 3868 ?        S    22:39   0:00 [apache]
www-data 23935  0.0  0.7 84196 3868 ?        S    22:39   0:00 [apache]
www-data 23936  0.0  0.7 84196 3868 ?        S    22:39   0:00 [apache]
www-data 23937  0.0  0.7 84196 3868 ?        S    22:39   0:00 [apache]
felix    23939  0.0  0.1  1596  576 pts/1    S    22:39   0:00 grep apache

As you can see, even just searching for the process name can throw up a lot of results. 17085 is the process id we're looking for which can be realised since the CMD output contains /usr/sbin/apache which is the full path to the executable on the server. You'll also notice that the program grep apache that was being used to search the output for the string apache also shows up in the results.

There's a lot more options available for ps but you'll have to look at them yourself. For the most part the options covered here will get you through 99.9% of all times you need to use ps. Again if you want further details about the full range of command line options that can be used with ps use man ps from the command line.