Processes or Tasks are the executing instances of a particular application or program in an operating system. All running programs including operating system will have its own process. Also, you can have multiple instances of the same program running, each of which will have separate processes.

In addition to the top level processes, there can also be child processes. A child process is a process that is created by another process, referred to as the parent process. Technically, all process are children of the root (top-level) process.

You might occasionally want to see the list of processes that are running on your system. This gives you additional information about the processes itself, such as how much memory is being used by each process or which process is using the most CPU etc etc. You can then find the process and kill them manually if it is using too many resources, for example.

The most useful and popular command to list processes is ps. The ps command reports a snapshot of the currently running processes in your system. Another popular command is top and its several different variations.

The list of all processes that are running can be in hundreds and can be overwhelming at times. The ps command offers a whole set of command line options to wilt it down to a manageable set with the optimal format you need. ps is a very versatile command with a lot of options, we will just look at a limited set of popular options that you can use.

List all running process

In order to list all running processes in the system, use the ps command with the command line option -e. There are different variations of the command which lists all processes, mostly to control the formatting of the output. We use the -F option below to display the extra full format. You can use -ef or -ely as well.

bash$ ps -eF

The above command will print all processes using the full display format which includes columns such as process id, user id, parent process id, memory and the command.

bash$ ps aux

The command line options without the hypen (-) refers to the BSD syntax. We will mostly stick with the standard syntax in this post.

List process by User

If you want to print out the processes of a particular user, then you can use either the -U or -u option (or both). This option allows you to specify a comma-separated list of users.

bash$ ps -u tom,harry -F

The difference between -U and -u is that one uses the real user id (RUID) while the other uses the  effective user id (EUID). -U option takes into account the real user of the process, while -u specifies the effective user id. The effective user is the user whose file access permissions are used by the process, which might be different from the user who owns the process.

Another option worth mentioning is the -N which can be used to negate the list. The following command will print process by users who are not root.

bash$ ps -u root -F -N

List process by Name/Command

If you just to see the processes that have a specific command name or program name, such as sshd, kate or firefox then you can use the -C option with the ps command.

bash$ ps -F -C kate

List process by Status/State

A process can be in one of the several states which is also referred to as its status. The possible states for a process are R (Running), D (non-interruptible sleep), S (interruptible sleep), Z (Zombie or terminated) or T (stopped).

You might want to list processes that are currently in a specific state such T (stopped). Unfortunately, despite all the plethora of option in ps, filtering by process state is not one of them. You can however use grep to filter the output as below but might end up with some false positives.

bash$ ps -e -o pid,stat,cmd | grep 'T'

Instead of ‘T”, you can use other process states such ‘S’ or ‘Z’ in the above example. If you like to completely eliminate the false positives, you can use awk to filter it out better.

bash$ ps -e -o pid,stat,uid,rss,sz,cmd | awk '$2~/^T/ { print }'

The -o option is used to specify a user format and we use it to include the field we need such as stat for status.

List process by pid or ppid

If you already know the process id (pid) or the parent process id (ppid) of the process you are interested in, then you can just list those processes. Use the -p or –pid option to list the set of processes by id.

bash$ ps -F -p 1234,4563,1432

You can use the -ppid option if you want to list the processes by the parent id. Again you can use several ids separated by comma.

bash$ ps -F --ppid 124,128

One of the main reasons why you might want to see processes is to stop or kill them. Another reason could be that you may want to detach them from the terminal. You want to identify processes that are using the most resources such as memory or cpu and then terminate them.

That means you would want to list the process in some sorted order. You can use the –sort option that is available with ps for this.

List process by Memory usage

When you are trying to find the memory usage of the process, you are mostly interested in how much memory is currently resident in the RAM for that process. This value is shown under the field RSS (Resident Set Size). You can now sort the processes with respect to this field

bash$ ps -eF --sort=-rss

We use the minus (-) sign to sort it in decreasing order according to the field value in rss. You can also use other command line options with this to further filter the results. For example,

bash$ ps -F -u tom --sort=-rss,+pid

This will sort all the processes by user tom sorted first by memory usage and then by the process id.

List process by CPU usage

The field of interest when trying to find the CPU usage is either ‘c‘ or ‘pcpu‘. We will use pcpu as it gives a better value with greater accuracy. Again we can use the –sort option here to sort by the pcpu field.

bash$ ps -e -u tom -o uid,pid,ppid,sz,stat,pcpu,cmd --sort=pcpu

The above command will sort all currently running processes by user tom by the cpu usage.

There are couple of other popular commands that can use to list processes. One of them is pstree and the other is top.They are both similar to ps but works better when you need to see the list visually different.

top is better when you need to monitor the progress of processes. The top command will run and list all processes and then update them every few seconds. This is good when you want to see the resources being used by different processes over a period of time. There are also several variations of top such htop, lotop etc.

pstree is useful when you want to see the processes in a hierarchical format such as a tree. It is then very easy to visualize as to which process is started by which user and why etc. You can still filter the processes by user or process ids.