Project39.View Processes

Project 39. View Processes

"What's running on my Mac, and who's running it?"

This project introduces commands and techniques for discovering what processes are executing on your Mac; it shows you how to list all processes and how to monitor processes continually in a "league table." It covers the commands top and ps. Project 40 shows you how to manage a process (by terminating or restarting it, for example).

Threads vs. Processes

A process is a separately schedulable unit of software executing under the auspices of the kernel. A process has its own environment and its own protected area of memory, and is guaranteed a slice (a share) of processor time. When you launch Safari, for example, it runs as a single process.

A thread, often called a lightweight process, shares its environment and memory with other threads, all of which belong to the same parent process. Threads are closely cooperating parts of a single application that run independently. Safari, for example, might create a new thread for each browser window that's opened, allowing all the windows to load in parallel.

View Process Information

A process (or task) is a program that's actively executing on your Mac. Every Unix command you issue, such as bash or ls, creates a new process. So does each daemon, such as httpd, and each application, such as Safari. The kernel assigns a unique process identification number (PID) to each process when it's created.

The top command lets us view continually updated information about each process. It sorts processes by PID and displays one process per line. To view basic information on all processes, simply type

$ top Processes: 125 total, 3 running, 122 sleeping, 391 threads Load Avg:  0.93, 0.62, 0.46     CPU usage:  24.7% user,... SharedLibs: num =  232, resident = 49.3M code, 5.51M da... MemRegions: num = 22758, resident =  492M + 28.7M priva... PhysMem:   147M wired,  550M active,  306M inactive, 10... VM: 13.0G +  150M   239329(0) pageins, 113394(0) pageouts   PID COMMAND      %CPU   TIME   #TH #PRTS #MREGS RPRVT... 15591 top         20.5%  0:04.18   1    18    22  1.04M... 15519 mdimport     0.0%  0:00.33   3    64   127  1.04M... 15191 writeconfi   0.0%  0:00.05   1    22    26   372K... 15188 System Pre   0.0%  0:07.04   2   136   372  12.7M... 14934 iChat        0.0%  0:13.81  10   337   331  12.3M... ...

The top command takes a sample every second, and you'll see the screen updated by each new sample. The first block shows global information; the top line tells us there are currently 125 processes and 391 threads. This may sound like a lot, but most are background processes, idle (sleeping) and awaiting an event to spark them back into life. In fact, of the 125 processes shown above, 122 are sleeping.

Load average reflects the number of processes ready to run and waiting to be given CPU time. The three figures show this averaged over the last minute, 5 minutes, and 15 minutes. When the load is less than 1, the CPU has time to spare.

The last two lines of global information give a breakdown of physical and virtual memory usage. Don't worry if there appears to be very little free physical memory. The kernel makes good use of what's available by keeping processes in memory and caching data read from disk. When an active process requires more memory, the kernel flushes caches or swaps out an inactive process to virtual memory.

Below the global-information block, processes themselves are listed, complete with statistics on CPU and memory usage. The top man page tells you what each field represents.

Type q to quit top.

Find the Top Hogs

Suppose you find your Mac running slowly and want to discover what process is hogging the processor. To do this, invoke top with option -o to order processes, and follow it with cpu to specify descending order by CPU usage. (Older versions of top expect -u instead of -o cpu.)

$ top -o cpu ... PID COMMAND      %CPU   TIME   #TH #PRTS #MREGS RPRVT  ... 15931 top         26.4%  0:29.98   1    18    22  1.04M... 14631 Microsoft   20.5%  6:00:56   4    96   368  23.2M... 10898 Terminal     7.3% 20:17.01   8   105   193  3.37M... 14140 Safari       1.3% 38:12.23   7   291   412  24.0M... 69 WindowServ      1.3%  4:29:47   2   882  2914  34.8M... ...

Grab a Snapshot

The top command executes in either of two modes: interactive, which is the default, or logging, where it writes to the screen in the normal manner instead of redrawing it. If you wish to grab a single sample for later processing, invoke top in logging mode by typing a command such as

$ top -o th -l1 > top.txt

This tells top to write one sample (-l1) before exiting, and to list processes in descending order by thread count (-o th). Our command writes the top output to a text file for processing later, but we could just as easily have piped it to another command for immediate processing.

Log Activity

If you wish to monitor processes over an extended period and write the results to a log file, use a command such as

$ top -s60 -l120 > top.log &

Here, we tell top to sample at a rate different from its once-per-second default. Option -s60 says to sample every 60 seconds, and option -l120 tells top to exit after taking 120 samples (at the set rate). All output is redirected to the file top.log; the ampersand sends the command into the background so it won't monopolize the command line for two hours.

Process the Output from top

In our final example, we wish to display the five longest-running processes. Let's construct a pipeline to perform this. We'll start with

top -o time -l1

This displays one sample, sorted in order of total execution time (-o time).

Next, we use grep to extract lines that display process information, searching for those that start with optional leading space and then a digit (look at the output from top to confirm that).

Learn More

See Project 55 to learn about background jobs.

grep "^[[:space:]]*[[:digit:]]"

We use awk to display fields 2 and 4 of each matched line, which correspond to the process name and its execution time, in columns 10 characters wide. (The awk stage won't work with process names that contain spaces. Use a command such as cut -c 7-32 instead.)

Tip

If you wish to take a snapshot and are interested in CPU percentage, you must take two snapshots and ignore the first; such statistics are calculated for the period between samples.

awk '{printf "%10s %10s\n", $2, $4}'

Finally, head is employed to display the first five lines only.

Putting this together, we get (typed all on one line)

$ top -o time -l1 | grep "^[[:space:]]*[[:digit:]]" ¬     | awk '{printf "%10s %10s\n", $2, $4}' | head -n5     Safari 7:06:24  Microsoft 6:40:31     Safari 94:10.98     Safari 41:19.00     iTunes 24:20.88

Learn More

Project 6 explains the principles of pipelines.

The results show three Safari processes because three users are running Safari.

Learn More

Refer to Project 23 to learn more about the grep command, and see Project 60 to learn more about the awk text processing language.

View Process Status

Similar to top is the ps command. It lists processes but does not display samples continually. The ps command is most often used to discover the PID of a named process. By default, it displays only processes you own that have controlling terminals (that is, that are running in terminal windows), typically including at least a few Bash shells. Specify option -x to display all processes you own. Option -c tells ps to display just the name of a process instead of the whole command line used to invoke it.

Learn More

Project 77 covers regular expressions.

Let's list all our processes by command name.

$ ps -cx   PID  TT  STAT      TIME COMMAND   196  ??  Ss     3:02.28 WindowServer   198  ??  Ss     0:03.68 ATSServer   202  ??  Ss     0:01.21 loginwindow ...   389 std  Ss     0:00.16 -bash   478  p2  S      0:00.12 -bash

Learn More

Project 40 looks at how to use ps in conjunction with kill to abort or restart a process.

You'll notice that each line begins with a PID, just as we saw in output from top. Column TT shows the terminal to which a process is attached. It will be ?? for all processes except those with controlling terminals. Column STAT represents the state of a process as a sequence of one or more characters. See the ps man page for status-sequence definitions and details about many more ps options.

To display all processes, not just those you own (that is, running with you as user), specify option -a. Use option u to increase the amount of information displayed for each process. Applying both options together reveals extended information for all processes. Note that the first column now lists the user who owns each process.

$ ps -acux USER       PID  %CPU %MEM  ... TIME      COMMAND saruman  16255  18.4  3.9  ... 9:15.60   Microsoft Word root     18670  11.0  0.1  ... 0:00.29   sshd saruman  10898   8.5  1.5  ... 22:58.57  Terminal ferdinan 14254   3.3  4.4  ... 95:36.61  Safari

Suppose you are interested in specific processes only. Let's display all running copies of iChat by piping the output of ps to grep and searching for iChat. Try the following command.

$ ps -acux | grep  "iChat" loraine  14171   0.0  1.8  ... 0:02.89   iChat loraine  14172   0.0  0.7  ... 0:00.82   iChatAgent galadrie 14190   0.0  1.9  ... 0:04.46   iChat galadrie 14191   0.0  0.7  ... 0:00.85   iChatAgent saruman  14933   0.0  0.8  ... 0:01.75   iChatAgent saruman  14934   0.0  3.1  ... 0:58.23   iChat

The results include unwanted data because the name of process iChatAgent matches the search term given to grep. Telling grep to return only whole-word matches (option w) corrects this problem; it returns only the exact process name iChat.

Tip

By default, ps limits the length of output lines to the width of your terminal window. Sometimes, especially when ps option -c isn't used, this causes process names to be cut offan undesirable effect if you want to search output for process names or use them in other operations. Avoid this by using option -ww to stop ps from truncating long lines.

Define a ps Function

If you find yourself employing the ps-to-grep trick on a regular basis, consider writing a simple bash function such as the one defined below. This command defines function psx and equates it to the command shown in braces. The command pipes the output from ps to grep, which is set up to perform a case-insensitive search for whole-word matches. Arguments passed to our new psx function are inserted at the pointed marked by $*.

Learn More

Project 4 touches on Bash functions, and Project 52 covers them in greater depth.

To define function psx, type

$ psx () { ps -acux | grep -iw $*; }

To discover all instances of iChat, type

$ psx ichat loraine  14171   0.0 1.9  ...  0:03.18   iChat galadrie 14190   0.0 2.0  ...  0:04.98   iChat saruman  14934   0.0 3.6  ...  2:34.80   iChat

Here's an alternative version that does not employ option -c. I'll leave it as an exercise for you to figure out why the second grep is required.

$ psx2 () { ps -auwwx | grep -iw $* | grep -v "grep -iw";}