Standard UNIX Commands

To begin, let's look at some commands you can issue from the UNIX prompt to give you some information about your system. The commands I'll cover are:

• iostat

• vmstat

• netstat

• ps

• kill

• showmount

• swapinfo and swap

• sar

• timex

We'll first look at each of these commands so that you get an understanding of the output produced by them and how this output may be used. There are manual pages for some of the commands in Appendix A.

Please keep in mind that, like all topics we have covered, the output of these commands may differ somewhat among UNIX variants. The basic information produced on most UNIX variants is the same; however, the format of the outputs may differ somewhat. This usually is not significant if you're viewing the outputs; however, if you're writing programs that accept these outputs and manipulate them in some way, then the format of the outputs is important.

I/O and CPU Statistics with iostat

The iostat command gives you an indication of the level of effort the CPU is putting into I/O and the amount of I/O taking place among your disks and terminals. iostat provides a lot of useful information; however, it acts somewhat differently among UNIX variants. The following examples show issuing iostat on a Solaris system, an HP-UX system, and an AIX system. iostat was not supported on the Linux system I was using for this chapter. Note that on some systems, using the -t option for terminal information produces just terminal information, and on some systems it produces a full output. You will, of course, have to determine the best options for your needs on your UNIX variant. The following examples show the iostat command:

Here is a Solaris example executed ten times at five-second intervals:

 #  iostat 5 10  tty          fd0           sd1           sd3           sd6          cpu  tin tout kps tps serv  kps tps serv  kps tps serv  kps tps serv  us sy wt id    0    0   0   0    0    0   0    0    3   0   57    0  79    0   0  7 49 43    0   47   0   0    0    0   0    0   14   2   75    0   0    0   0  2  0 98    0   16   0   0    0    0   0    0    0   0    0    0   0    0   0  1  0 98    0   16   0   0    0    0   0    0    0   0    0    0   0    0   0  2  0 98    0   16   0   0    0    0   0    0    0   0    0    0   0    0   0  0  0 100    0   16   0   0    0    0   0    0    0   0    0    0   0    0   0  0  0 100    0   16   0   0    0    0   0    0    0   0    0    0   0    0   0  1  0 99    0   16   0   0    0    0   0    0    0   0    0    0   0    0   0  0  0 100    0   16   0   0    0    0   0    0    6   1   35    0   0    0   0  4  0 96    0   16   0   0    0    0   0    0    0   0    0    0   0    0   0  0  0 100 

An HP-UX example includes the -t option executed five times at five-second intervals:

 # iostat -t 5 5                    tty             cpu                  tin tout        us  ni  sy  id                    1   58         5   1  10  84   device    bps     sps    msps   c1t2d0      0     0.0     1.0                    tty             cpu                  tin tout        us  ni  sy  id                    0   30         0   2  26  72   device    bps     sps    msps   c1t2d0    484    249.6     1.0                    tty             cpu                  tin tout        us  ni  sy  id                    0   31         1   3  23  73   device    bps     sps    msps   c1t2d0    517    256.1     1.0                    tty             cpu                  tin tout        us  ni  sy  id                    0   35         0   2  23  75   device    bps     sps    msps   c1t2d0    456    254.4     1.0                    tty             cpu                  tin tout        us  ni  sy  id                    0  744         1   6  38  55   device    bps     sps    msps   c1t2d0    155    83.1     1.0 # 

Here is an AIX example executed ten times at five-second intervals:

 #  iostat 5 10  tty:      tin         tout   avg-cpu:  % user    % sys     % idle    % iowait           0.0          0.0               0.3      1.0       98.4       0.3 Disks:        % tm_act     Kbps      tps    Kb_read   Kb_wrtn hdisk0           0.4       2.7       0.4    2366635    959304 hdisk1           0.0       0.0       0.0      18843     37928 hdisk2           0.1       0.6       0.1     269803    423284 hdisk3           0.0       0.0       0.0      20875       172 cd0              0.0       0.0       0.0         14         0 tty:      tin         tout   avg-cpu:  % user    % sys     % idle    % iowait           0.0        108.2               0.0      0.2       99.8       0.0 Disks:        % tm_act     Kbps      tps    Kb_read   Kb_wrtn hdisk0           0.0       0.0       0.0          0         0 hdisk1           0.0       0.0       0.0          0         0 hdisk2           0.0       0.0       0.0          0         0 hdisk3           0.0       0.0       0.0          0         0 cd0              0.0       0.0       0.0          0         0 tty:      tin         tout   avg-cpu:  % user    % sys     % idle    % iowait           0.0        108.4               0.2      0.8       99.0       0.0 Disks:        % tm_act     Kbps      tps    Kb_read   Kb_wrtn hdisk0           0.0       0.0       0.0          0         0 hdisk1           0.0       0.0       0.0          0         0 hdisk2           0.0       0.0       0.0          0         0 hdisk3           0.0       0.0       0.0          0         0 cd0              0.0       0.0       0.0          0         0 tty:      tin         tout   avg-cpu:  % user    % sys     % idle    % iowait           0.0        108.4               0.4      0.2       99.4       0.0 Disks:        % tm_act     Kbps      tps    Kb_read   Kb_wrtn hdisk0           0.0       0.0       0.0          0         0 hdisk1           0.0       0.0       0.0          0         0 hdisk2           0.0       0.0       0.0          0         0 hdisk3           0.0       0.0       0.0          0         0 cd0              0.0       0.0       0.0          0         0 tty:      tin         tout   avg-cpu:  % user    % sys     % idle    % iowait           0.0        108.2               0.4      0.6       99.0       0.0 Disks:        % tm_act     Kbps      tps    Kb_read   Kb_wrtn hdisk0           0.0       0.0       0.0          0         0 hdisk1           0.0       0.0       0.0          0         0 hdisk2           0.0       0.0       0.0          0         0 hdisk3           0.0       0.0       0.0          0         0 cd0              0.0       0.0       0.0          0         0 tty:      tin         tout   avg-cpu:  % user    % sys     % idle    % iowait           0.0        108.4               0.0      0.4       99.6       0.0 Disks:        % tm_act     Kbps      tps    Kb_read   Kb_wrtn hdisk0           0.0       0.0       0.0          0         0 hdisk1           0.0       0.0       0.0          0         0 hdisk2           0.0       0.0       0.0          0         0 hdisk3           0.0       0.0       0.0          0         0 cd0              0.0       0.0       0.0          0         0 tty:      tin         tout   avg-cpu:  % user    % sys     % idle    % iowait           0.0        108.4               0.6      0.0       99.4       0.0 Disks:        % tm_act     Kbps      tps    Kb_read   Kb_wrtn hdisk0           0.0       0.0       0.0          0         0 hdisk1           0.0       0.0       0.0          0         0 hdisk2           0.0       0.0       0.0          0         0 hdisk3           0.0       0.0       0.0          0         0 cd0              0.0       0.0       0.0          0         0 tty:      tin         tout   avg-cpu:  % user    % sys     % idle    % iowait           0.0        108.2               0.2      0.8       99.0       0.0 Disks:        % tm_act     Kbps      tps    Kb_read   Kb_wrtn hdisk0           0.0       0.0       0.0          0         0 hdisk1           0.0       0.0       0.0          0         0 hdisk2           0.0       0.0       0.0          0         0 hdisk3           0.0       0.0       0.0          0         0 cd0              0.0       0.0       0.0          0         0 tty:      tin         tout   avg-cpu:  % user    % sys     % idle    % iowait           0.0        108.4               0.4      0.0       99.6       0.0 Disks:        % tm_act     Kbps      tps    Kb_read   Kb_wrtn hdisk0           0.0       0.0       0.0          0         0 hdisk1           0.0       0.0       0.0          0         0 hdisk2           0.0       0.0       0.0          0         0 hdisk3           0.0       0.0       0.0          0         0 cd0              0.0       0.0       0.0          0         0 tty:      tin         tout   avg-cpu:  % user    % sys     % idle    % iowait           0.0        108.4               0.4      0.4       99.2       0.0 Disks:        % tm_act     Kbps      tps    Kb_read   Kb_wrtn hdisk0           0.0       0.0       0.0          0         0 hdisk1           0.0       0.0       0.0          0         0 hdisk2           0.0       0.0       0.0          0         0 hdisk3           0.0       0.0       0.0          0         0 cd0              0.0       0.0       0.0          0         0 

The following are descriptions of the reports you receive with iostat for terminals, the CPU, and mounted file systems. Because the reports are somewhat different, I have included detailed information from the HP-UX output. A more detailed description of these fields is included in the iostat manual page in Appendix A. Most of the fields appear in the outputs; however, the outputs of the commands differ somewhat among UNIX variants.

For every terminal you have connected ( tty ), you see a "tin" and "tout," which represent the number of characters read from your terminal and the number of characters written to your terminal, respectively.

For your CPU, you see the percentage of time spent in user mode ("us"), the percentage of time spent running user processes at a low priority called nice ("ni"), the percentage of time spent in system mode ("sy"), and the percentage of time the CPU is idle ("id").

For every locally mounted file system, you receive information on the kilobytes transferred per second ("bps"), number of seeks per second ("sps"), and number of milliseconds per average seek ("msps"). For disks that are NFS-mounted or disks on client nodes of your server, you will not receive a report; iostat reports only on locally mounted file systems.

When viewing the output of iostat , there are some parameters to take note of.

First, note that the time that your CPU is spending in the four categories shown. The CPU report is produced with the -t option. I have worked on systems with poor performance that the administrator assumed to be a result of a slow CPU because the "id" number was very high, indicating that the CPU was actually idle most of the time. If the CPU is mostly idle, the chances are that the bottleneck is not the CPU, but may be I/O, memory, or networking. If the CPU is indeed busy most of the time ("id" is very low), see whether any processes are running "nice" (check the "ni" number). It may be that there are some background processes consuming a lot of CPU time that can be changed to run "nice."

Second, compare the number of transfers taking place. These are usually indicated by something like blocks per second (bps), transfers per second ( tps ), or seeks per second ( sps) . These numbers give an indication of the amount of activity taking place on a disk. If one volume is consistently much higher than other volumes , then it may be performing an inordinate amout of the workload. Notice on HP-UX that the milliseconds per average seek ( msps ) for all disks is always equal to one.

Virtual Memory Statistics with vmstat

vmstat provides virtual memory statistics. It provides information on the status of processes, virtual memory, paging activity, faults, and a breakdown of the percentage of CPU time. vmstat acts somewhat differently among UNIX variants. The following examples show issuing vmstat on a Solaris system, an HP-UX system, an AIX system, and a Linux system. You will, of course, have to determine the best options for your needs on your UNIX variant. In the following examples, the output was produced nine times at five-second intervals. The first argument to the vmstat command is the interval; the second is the number of times you would like the output produced.

Solaris example:

 #  vmstat 5 9  procs     memory            page            disk          faults      cpu  r b w   swap  free  re  mf pi po fr de sr f0 s1 s3 s6   in   sy   cs us sy id  0 0 0   4480  4696   0   0  1  0  0  0  0  0  0  0 79  864  130  297  0  7 92  0 0 0 133020  5916   0   3  0  0  0  0  0  0  0  3  0  102   42   24  0  2 98  0 0 0 133020  5916   0   0  0  0  0  0  0  0  0  0  0   70   48   24  0  0 100  0 0 0 133020  5916   0   0  0  0  0  0  0  0  0  0  0   74   42   24  0  0 100  0 0 0 133020  5916   0   0  0  0  0  0  0  0  0  0  0   35   45   23  0  0 99  0 0 0 133020  5916   0   0  0  0  0  0  0  0  0  0  0   65   66   26  0  0 100  0 0 0 133020  5916   0   0  0  0  0  0  0  0  0  0  0   52   44   23  0  1 99  0 0 0 133020  5916   0   0  0  0  0  0  0  0  0  0  0   53   54   24  0  1 99  0 0 0 133020  5916   0   0  0  0  0  0  0  0  0  1  0   60   53   25  0  2 98 

HP-UX example:

 #  vmstat 5 9  procs       memory                   page                    faults         cpu r  b  w   avm    free   re  at   pi   po   fr   de   sr    in     sy    cs  us sy id 5 240 0 17646    3979    2   0    0    0    0    0    0     0    778   193  17  3 80 4 242 0 16722    4106    0   0    0    0    0    0    0   814  20649   258  89 10  2 4 240 0 16649    4106    0   0    0    0    0    0    0    83  18384   218  91  9  0 4 240 0 16468    4106    0   0    0    0    0    0    0   792  19552   273  89 11  1 5 239 0 15630    4012    9   0    0    0    0    0    0   804  18295   270  93  8 -1 5 241 0 16087    3934    6   0    0    0    0    0    0   920  21044   392  89 10  0 5 241 0 15313    3952   11   0    0    0    0    0    0   968  20239   431  90 10  0 4 242 0 16577    4043    3   0    0    0    0    0    0   926  19230   409  89 10  0 6 238 0 17453    4122    0   0    0    0    0    0    0   837  19269   299  89  9  2 

AIX example:

 martyp $ vmstat 5 9 kthr     memory             page              faults        cpu ----- ----------- ------------------------ ------------ -----------  r  b   avm   fre  re  pi  po  fr   sr  cy  in   sy  cs us sy id wa  0  0 16604   246   0   0   0   0    2   0 149   79  36  0  1 98  0  0  0 16604   246   0   0   0   0    0   0 153  125  41  0  0 99  0  0  0 16604   246   0   0   0   0    0   0 143   83  33  0  0 99  0  0  0 16604   246   0   0   0   0    0   0 140   94  35  0  1 99  0  0  0 16604   246   0   0   0   0    0   0 166   62  32  0  0 99  0  0  0 16604   246   0   0   0   0    0   0 150  102  38  1  0 99  0  0  0 16604   246   0   0   0   0    0   0 183   78  34  0  0 99  0  0  0 16604   246   0   0   0   0    0   0 132   87  33  0  1 99  0  0  0 16604   246   0   0   0   0    0   0 147   84  38  0  0 99  0 

Linux example:

 #  vmstat 5 5  procs                      memory    swap          io     system         cpu  r  b  w   swpd   free   buff  cache  si  so    bi    bo   in    cs  us  sy  id  1  0  0   9432   1160    656  12024   1   2    14     1  138   274   3   1  96  1  0  0   9684    828    652  12148   0  50     0    14  205  8499  82  18   0  1  0  0   9684    784    652  11508   0   0     0     1  103  8682  81  19   0  1  0  0   9684    800    652  10996   0   0     0     0  101  8683  80  20   0  0  0  0   9772    796    652   9824  12  18     3     4  160  6577  66  17  18 

You certainly get a lot for your money out of the vmstat command. Here is a brief description of the categories of information produced by vmstat . I have included a description of the fields in the HP-UX example because of the manual page that appears in Appendix A for HP-UX. You can see, however, that the outputs are very similar.

Processes are classified into one of three categories: runnable ("r"), blocked on I/O or short- term resources ("b"), or swapped ("w").

Next you will see information about memory. "avm" is the number of virtual memory pages owned by processes that have run within the last 20 seconds. If this number is roughly the size of physical memory minus your kernel, then you are near forced paging. The "free" column indicates the number of pages on the system's free list. It doesn't mean that the process is finished running and these pages won't be accessed again; it just means that they have not been accessed recently. I suggest that you ignore this column.

Next is paging activity. The first field ("re") shows the pages that were reclaimed. These pages made it to the free list but were later referenced and had to be salvaged.

Next you see the number of faults in three categories: interrupts per second, which usually come from hardware ("in"), system calls per second ("sy"), and context switches per second ("cs").

The final output is CPU usage percentage for user ("us"), system ("sy"), and idle ("id"). This is not as complete as the iostat output, which also shows nice entries.

If you are running an I/O intensive workload you may indeed see a lot of activity in runnable processes ("r"), blocked processes("b"), and the runnable but swapped ("w") processes. If you have many runnable but swapped processes, then you probably have an I/O bottleneck.

Network Statistics with netstat

netstat provides information related to network statistics. Because network bandwidth has as much to do with performance as the CPU and memory in some networks, you want to get an idea of the level of network traffic you have.

I use two forms of netstat to obtain network statistics. The first is netstat -i , which shows the state of interfaces that are autoconfigured. Although netstat -i gives a good rundown of the primary LAN interface, such as the network it is on, its name , and so on, it does not show useful statistical information.

The following shows the output of netstat -i :

# netstat -i
Name	Mtu	Network	Address	Ipkts	Ierrs	Opkts	Oerrs	Col
lan0	1497	151.150	a4410.e.h.c	242194	120	107665	23	19884

netstat provides a concise output. Put another way, most of what you get from netstat is useful. Here is a description of the nine fields in the netstat example:

Name	The name of your network interface (Name), in this case, "lan0."
Mtu	The "maximum transmission unit," which is the maximum packet size sent by the interface card.
Network	The network address of the LAN to which the interface card is connected (151.150).
Address	The host name of your system. This is the symbolic name of your system as it appears in the /etc/ hosts file if your networking is configured to use /etc/hosts .

Below is the statistical information. Depending on the system you are using, or revision of OS, you may not see some of these commands:

Ipkts	The number of packets received by the interface card, in this case, "lan0."
Ierrs	The number of errors detected on incoming packets by the interface card.
Opkts	The number of packets transmitted by the interface card.
Oerrs	The number of errors detected during the transmission of packets by the interface card.
Col	The number of collisions that resulted from packet traffic.

netstat provides cumulative data since the node was last powered up; therefore you might have a long elapsed time over which data was accumulated . If you are interested in seeing useful statistical information, you can use netstat with different options. You can also specify an interval to report statistics. I usually ignore the first entry, because it shows all data since the system was last powered up. This means that the data includes non-prime hours when the system was idle. I prefer to view data at the time the system is working its hardest. The following examples show running netstat -I and specifying the lan interface for Solaris, HP-UX, and AIX. These outputs are nearly identical, although the name of the network interface does vary among UNIX variants. The netstat command is run at an interval of five seconds. The Linux version of this command, which is not shown, does not allow me to specify an interval.

Solaris example:

 #  netstat -I le0 5  input   le0       output           input  (Total)    output packets errs  packets errs  colls  packets errs  packets errs  colls 116817990 0     3299582 11899 1653100 116993185 0     3474777 11899 1653100 185     0     3       0     0      185     0     3       0     0 273     0     8       0     0      273     0     8       0     0 153     0     3       0     0      153     0     3       0     0 154     0     3       0     0      154     0     3       0     0 126     0     3       0     0      126     0     3       0     0 378     0     2       0     0      378     0     2       0     0 399     0     4       0     0      399     0     4       0     0 286     0     2       0     0      286     0     2       0     0 

HP-UX example:

 #  netstat -I lan0 5  (lan0)-> input            output          (Total)-> input           output        packets  errs  packets   errs  colls       packets  errs  packets  errs  colls       269841735 27   256627585   1    5092223    281472199  27   268258048 1    5092223           1602     0     1238      0      49         1673     0     1309     0     49           1223     0     1048      0      25         1235     0     1060     0     25           1516     0     1151      0      42         1560     0     1195     0     42           1553     0     1188      0      17         1565     0     1200     0     17           2539     0     2180      0      44         2628     0     2269     0     44           3000     0     2193      0     228         3000     0     2193     0    228           2959     0     2213      0     118         3003     0     2257     0    118           2423     0     1981      0      75         2435     0     1993     0     75 

AIX example:

 #  netstat -I en0 5  input    (en0)     output           input   (Total)    output  packets  errs  packets  errs colls  packets  errs  packets  errs colls 46333531     0  1785025     0     0 47426087     0  2913405     0     0      203     0        1     0     0      204     0        2     0     0      298     0        1     0     0      298     0        1     0     0      293     0        1     0     0      304     0       12     0     0      191     0        1     0     0      191     0        1     0     0      150     0        2     0     0      151     0        3     0     0      207     0        3     0     0      218     0       15     0     0      162     0        3     0     0      162     0        4     0     0      120     0        2     0     0      120     0        2     0     0 

With this example, you get multiple outputs of what is taking place on the LAN interface, including the totals on the right side of the output. As I mentioned earlier, you may want to ignore the first output, because it includes information over a long time period. This may include a time when your network was idle, and therefore the data may not be important to you.

You can specify the network interface on which you want statistics reported by using -I interface ; in the case of the example, it was -I and either le0, lan0 , or en0 . An interval of five seconds was also used in this example.

Analyzing netstat statistical information is intuitive. You want to verify that the collisions (Colls) are much lower than the packets transmitted (Opkts). Collisions occur on output from your LAN interface. Every collision your LAN interface encounters slows down the network. You will get varying opinions about what is too many collisions. If your collisions are less than 5 percent of "Opkts," you're probably in good shape and better off spending your time analyzing some other system resource. If this number is high, you may want to consider segmenting your network in some way such as installing networking equipment between portions of the network that don't share a lot of data.

As a rule of thumb, if you reduce the number of packets you are receiving and transmitting ("Ipkts" and "Opkts"), then you will have less overall network traffic and fewer collisions. Keep this in mind as you plan your network or upgrades to your systems. You may want to have two LAN cards in systems that are in constant communication. That way, these systems have a "private" LAN over which to communicate and do not adversely affect the performance of other systems on the network. One LAN interface on each system is devoted to intrasystem communication. This provides a "tight" communication path among systems that usually act as servers. The second LAN interface is used to communicate with any systems that are usually clients on a larger network.

You can also obtain information related to routing with netstat (see Chapter 12). The -r option to netstat shows the routing tables, which you usually want to know about, and the -n option can be used to print network addresses as numbers rather than as names . In the following examples, netstat is issued with the -r option (this will be used when describing the netstat output) and the -rn options, so that you can compare the two outputs:

$ netstat -r

Routing tables
Destination	Gateway	Flags	Refs	Use	Interface	Pmtu
hp700	localhost	UH		28	lo0	4608
default	router1	UG			lan0	4608
128.185.61	system1	U	347	28668	lan0	1500

$ netstat -rn

Routing tables
Destination	Gateway	Flags	Refs	Use	Interface	Pmtu
127.0.0.1	127.0.0.1	UH		28	lo0	4608
default	128.185.61.1	UG			lan0	4608
128.185.61	128.185.61.2	U	347	28668	lan0	1500

With netstat , some information is provided about the router, which is the middle entry. The -r option shows information about routing, but there are many other useful options to this command are available. Of particular interest in this output is "Flags," which defines the type of routing that takes place. Here are descriptions of the most common flags, which may be different among UNIX variants, from the manual page in Appendix A.

1= U	Route to a network via a gateway that is the local host itself.
3= UG	Route to a network via a gateway that is the remote host.
5= UH	Route to a host via a gateway that is the local host itself.
7= UGH	Route to a host via a remote gateway that is a host.

The first line is for the local host, or loopback interface called, lo0 at address 127.0.0.1 (you can see this address in the netstat -rn example). The UH flags indicate that the destination address is the local host itself. This Class A address allows a client and server on the same host to communicate with one another via TCP/IP. A datagram sent to the loopback interface won't go out onto the network; it will simply go through the loopback.

The second line is for the default route. This entry says to send packets to Router 1 if a more specific route can't be found. In this case, the router has a UG under Flags . Some routers are configured with a U ; others, such as the one in this example, with a UG. I've found that I usually end up determining through trial and error whether a U or UG is required. If there is a U in Flags and I am unable to ping a system on the other side of a router, a UG entry usually fixes the problem.

The third line is for the system's network interface, lan0 . This means to use this network interface for packets to be sent to 128.185.61.

Check Processes with ps

Knowing about the processes running on your system, and knowing how to stop them, are important to both system administration and performance.

To find the answer to "What is my system doing?," use ps -ef . This command provides information about every running process on your system. If, for instance, you want to know whether NFS is running, you simply type ps -ef and look for NFS daemons. Although ps tells you every process that is running on your system, it doesn't provide a good summary of the level of system resources being consumed. I would guess that ps is the most often issued system administration command. There are a number of options you can use with ps . I normally use e and f , which provide information about every (" e ") running process and lists this information in full (" f "). ps outputs are almost identical from system to system. The following three examples are from a Solaris, AIX, and HP-UX system, respectively:

Solaris example:

 martyp $  ps -ef  UID   PID  PPID  C    STIME TTY      TIME CMD     root     0     0  0   Feb 18 ?        0:01 sched     root     1     0  0   Feb 18 ?        1:30 /etc/init -     root     2     0  0   Feb 18 ?        0:02 pageout     root     3     0  1   Feb 18 ?       613:44 fsflush     root  3065  3059  0   Feb 22 ?        5:10 /usr/dt/bin/sdtperfmeter -f -H -r     root    88     1  0   Feb 18 ?        0:01 /usr/sbin/in.routed -q     root   478     1  0   Feb 18 ?        0:00 /usr/lib/saf/sac -t 300     root    94     1  0   Feb 18 ?        2:50 /usr/sbin/rpcbind     root   150     1  0   Feb 18 ?        6:03 /usr/sbin/syslogd     root    96     1  0   Feb 18 ?        0:00 /usr/sbin/keyserv     root   144     1  0   Feb 18 ?       50:37 /usr/lib/autofs/automountd     root  1010     1  0   Apr 12 ?        0:00 /opt/perf/bin/midaemon     root   106     1  0   Feb 18 ?        0:02 /usr/lib/netsvc/yp/ypbind -broadt     root   156     1  0   Feb 18 ?        0:03 /usr/sbin/cron     root   176     1  0   Feb 18 ?        0:00 /usr/lib/lpsched     root   129     1  0   Feb 18 ?        0:00 /usr/lib/nfs/lockd   daemon   130     1  0   Feb 18 ?        0:01 /usr/lib/nfs/statd     root 14798     1  0   Mar 09 ?       31:10 /usr/sbin/nscd     root   133     1  0   Feb 18 ?        0:10 /usr/sbin/inetd -s     root   197     1  0   Feb 18 ?        0:00 /usr/lib/power/powerd     root   196     1  0   Feb 18 ?        0:35 /etc/opt/licenses/lmgrd.ste -c /d     root   213     1  0   Feb 18 ?       4903:09 /usr/sbin/vold     root   199   196  0   Feb 18 ?        0:03 suntechd -T  4 -c /etc/optd     root   219     1  0   Feb 18 ?        0:08 /usr/lib/sendmail -bd -q15m     root   209     1  0   Feb 18 ?        0:05 /usr/lib/utmpd     root  2935   266  0   Feb 22 ?       48:08 /usr/openwin/bin/Xsun :0 -nobanna     root 16795 16763  1 07:51:34 pts/4    0:00 ps -ef     root  2963  2954  0   Feb 22 ?        0:17 /usr/openwin/bin/fbconsole     root   479     1  0   Feb 18 console  0:00 /usr/lib/saf/ttymon -g -h -p sunc     root 10976     1  0   Jun 01 ?        0:00 /opt/perf/bin/ttd     root  7468     1  0   Feb 24 ?        0:13 /opt/perf/bin/pvalarmd     root   266     1  0   Feb 18 ?        0:01 /usr/dt/bin/dtlogin -daemon   martyp 16763 16761  0 07:46:46 pts/4    0:01 -ksh     root 10995     1  0   Jun 01 ?        0:01 /opt/perf/bin/perflbd     root   484   478  0   Feb 18 ?        0:00 /usr/lib/saf/ttymon     root   458     1  0   Feb 18 ?       20:06 /usr/lib/snmp/snmpdx -y -c /etc/f     root 16792  3059  0 07:50:37 ?        0:00 /usr/dt/bin/dtscreen -mode blank     root   471     1  0   Feb 18 ?        0:07 /usr/lib/dmi/dmispd     root   474     1  0   Feb 18 ?        0:00 /usr/lib/dmi/snmpXdmid -s     root   485   458  0   Feb 18 ?       739:44 mibiisa -r -p 32874     root  2954  2936  0   Feb 22 ?        0:01 /bin/ksh /usr/dt/bin/Xsession     root  2936   266  0   Feb 22 ?        0:00 /usr/dt/bin/dtlogin -daemon     root  3061  3059  0   Feb 22 ?        1:32 dtwm     root  3058     1  0   Feb 22 pts/2    0:01 /usr/dt/bin/ttsession     root   712   133  0   Feb 18 ?        0:01 rpc.ttdbserverd     root 11001 11000  0                   0:01 <defunct>     root  2938     1  0   Feb 22 ?        0:00 /usr/openwin/bin/fbconsole -d :0     root  2999  2954  0   Feb 22 pts/2    0:16 /usr/dt/bin/sdt_shell -c      unt     root  3059  3002  0   Feb 22 pts/2   283:35 /usr/dt/bin/dtsession     root  3063  3059  0   Feb 22 ?        0:03 /usr/dt/bin/dthelpview -helpVolur     root  3099  3062  0   Feb 22 ?        0:13 /usr/dt/bin/dtfile -geometry +700     root 11000 10995  0   Jun 01 ?        0:02 /opt/perf/bin/agdbserver -t alar/     root  3002  2999  0   Feb 22 pts/2    0:01 -ksh -c      unset DT;     DISPLg     root   730   133  0   Feb 18 ?        1:37 rpc.rstatd     root  3062  3059  0   Feb 22 ?        2:17 /usr/dt/bin/dtfile -geometry +700     root  3067     1  0   Feb 22 ?        0:00 /bin/ksh /usr/dt/bin/sdtvolcheckm     root  3000     1  0   Feb 22 ?        0:00 /usr/dt/bin/dsdm     root  3078  3067  0   Feb 22 ?        0:00 /bin/cat /tmp/.removable/notify0     root 10984     1  0   Jun 01 ?       12:42 /opt/perf/dce/bin/dced -b     root 16761   133  0 07:46:45 ?        0:00 in.telnetd martyp $ 

AIX example:

 martyp $  ps -ef  UID   PID  PPID   C    STIME    TTY  TIME CMD     root     1     0   0   Feb 24      -  5:07 /etc/init     root  2208 15520   0   Feb 24      -  8:21 dtwm     root  2664     1   0   Feb 24      -  0:00 /usr/dt/bin/dtlogin -daemon     root  2882     1   0   Feb 24      - 158:41 /usr/sbin/syncd 60     root  3376  2664   5   Feb 24      - 3598:41 /usr/lpp/X11/bin/X -D /usr/lib/     root  3624  2664   0   Feb 24      -  0:00 dtlogin <:0>        -daemon     root  3950     1   6   Feb 24      - 5550:30 /usr/lpp/perf/bin/llbd     root  4144     1   0   Feb 24      -  0:00 /usr/lpp/perf/bin/midaemon     root  4490     1   0   Feb 24      -  0:48 /usr/lpp/perf/bin/perflbd     root  4906     1   0   Feb 24      -  0:00 /usr/lib/errdemon     root  5172     1   0   Feb 24      -  0:00 /usr/sbin/srcmstr     root  5724  5172   0   Feb 24      -  9:54 /usr/sbin/syslogd     root  6242  5172   0   Feb 24      -  0:00 /usr/sbin/biod 6     root  6450  5172   0   Feb 24      -  0:02 sendmail: accepting connections     root  6710  5172   0   Feb 24      -  7:34 /usr/sbin/portmap     root  6966  5172   0   Feb 24      -  0:23 /usr/sbin/inetd     root  7224  5172   0   Feb 24      -  1:09 /usr/sbin/timed -S     root  7482  5172   0   Feb 24      - 11:55 /usr/sbin/snmpd     root  8000     1   0   Feb 24      -  9:17 ovspmd     root  8516  8782   0   Feb 24      -  0:00 netfmt -CF     root  8782     1   0   Feb 24      -  0:00 /usr/OV/bin/ntl_reader 0 1 1 1     root  9036  8000   0   Feb 24      - 10:09 ovwdb -O -n5000     root  9288  8000   0   Feb 24      -  0:44 pmd -Au -At -Mu -Mt -m     root  9546  8000   0   Feb 24      - 20:05 trapgend -f     root  9804  8000   0   Feb 24      -  0:28 trapd     root 10062  8000   0   Feb 24      -  0:47 orsd     root 10320  8000   0   Feb 24      -  0:33 ovesmd     root 10578  8000   0   Feb 24      -  0:30 ovelmd     root 10836  8000   0   Feb 24      - 13:12 ovtopmd -O     root 11094  8000   0   Feb 24      - 17:50 netmon -P     root 11352  8000   0   Feb 24      -  0:02 snmpCollect     root 11954     1   0   Feb 24      -  1:22 /usr/sbin/cron     root 12140  5172   0   Feb 24      -  0:01 /usr/lib/netsvc/yp/ypbind     root 12394  5172   0   Feb 24      -  1:39 /usr/sbin/rpc.mountd     root 12652  5172   0   Feb 24      -  0:29 /usr/sbin/nfsd 8     root 12908  5172   0   Feb 24      -  0:00 /usr/sbin/rpc.statd     root 13166  5172   0   Feb 24      -  0:29 /usr/sbin/rpc.lockd     root 13428     1   0   Feb 24      -  0:00 /usr/sbin/uprintfd     root 14190  5172   0   Feb 24      - 72:59 /usr/sbin/automountd     root 14452  5172   0   Feb 24      -  0:17 /usr/sbin/qdaemon     root 14714  5172   0   Feb 24      -  0:00 /usr/sbin/writesrv     root 14992     1   0   Feb 24      - 252:26 /usr/lpp/perf/bin/scopeux     root 15520  3624   1   Feb 24      - 15:29 /usr/dt/bin/dtsession     root 15742     1   0   Feb 24      -  0:00 /usr/lpp/diagnostics/bin/diagd     root 15998     1   0   Feb 24   lft0  0:00 /usr/sbin/getty /dev/console     root 16304 18892   0   Feb 24  pts/0  0:00 /bin/ksh     root 16774     1   0   Feb 24      -  0:00 /usr/lpp/perf/bin/ttd     root 17092  4490   0   Feb 24      - 68:54 /usr/lpp/perf/bin/rep_server -t     root 17370 19186   3                  0:00 <defunct>     root 17630 15520   0   Mar 25      -  0:00 /usr/dt/bin/dtexec -open 0 -ttp     root 17898 15520   0   Mar 20      -  0:00 /usr/dt/bin/dtexec -open 0 -ttp     root 18118 19888   0   Feb 24  pts/1  0:00 /bin/ksh     root 18366  6966   0   Feb 24      -  0:00 rpc.ttdbserver 100083 1     root 18446 15520   0   Mar 15      -  0:00 /usr/dt/bin/dtexec -open 0 -ttp     root 18892 15520   0   Feb 24      -  3:46 /usr/dt/bin/dtterm     root 19186 16304   0   Feb 24  pts/0  0:01 /usr/lpp/X11/bin/msmit     root 19450     1   0   Feb 24      - 26:53 /usr/dt/bin/ttsession -s     root 19684  2208   0   Feb 24      -  0:00 /usr/dt/bin/dtexec -open 0 -ttp     root 19888 19684   0   Feb 24      -  0:00 /usr/dt/bin/dtterm     root 20104 15520   0   Feb 27      -  0:00 /usr/dt/bin/dtexec -open 0 -ttp     root 20248 20104   0   Feb 27      -  0:03 /usr/dt/bin/dtscreen     root 20542 29708   0   May 14      -  0:03 /usr/dt/bin/dtscreen     root 20912 26306   0   Apr 05      -  0:03 /usr/dt/bin/dtscreen     root 33558     1   0   May 18      -  3:28 /usr/atria/etc/lockmgr -a /var/     root 33834  6966   3 07:55:49      -  0:00 telnetd     root 34072     1   0   May 18      -  0:00 /usr/atria/etc/albd_server   martyp 36296 36608  13 07:56:07  pts/2  0:00 ps -ef   martyp 36608 33834   1 07:55:50  pts/2  0:00 -ksh     root 37220 15520   0   May 28      -  0:00 /usr/dt/bin/dtexec -open 0 -ttp 

HP-UX example (partial listing):

 martyp $  ps -ef  UID    PID   PPID C  STIME  TTY  TIME   COMMAND     root     0     0  0  Mar  9  ?   107:28 swapper     root     1     0  0  Mar  9  ?    2:27 init     root     2     0  0  Mar  9  ?   14:13 vhand     root     3     0  0  Mar  9  ?   114:55 statdaemon     root     4     0  0  Mar  9  ?    5:57 unhashdaemon     root     7     0  0  Mar  9  ?   154:33 ttisr     root    70     0  0  Mar  9  ?    0:01 lvmkd     root    71     0  0  Mar  9  ?    0:01 lvmkd     root    72     0  0  Mar  9  ?    0:01 lvmkd     root    13     0  0  Mar  9  ?    9:54 vx_sched_thread     root    14     0  0  Mar  9  ?    1:54 vx_iflush_thread     root    15     0  0  Mar  9  ?    2:06 vx_ifree_thread     root    16     0  0  Mar  9  ?    2:27 vx_inactive_cache_thread     root    17     0  0  Mar  9  ?    0:40 vx_delxwri_thread     root    18     0  0  Mar  9  ?    0:33 vx_logflush_thread     root    19     0  0  Mar  9  ?    0:07 vx_attrsync_thread                          .                          .                          .     root    69     0  0  Mar  9  ?    0:09 vx_inactive_thread     root    73     0  0  Mar  9  ?    0:01 lvmkd     root    74     0 19  Mar  9  ?   3605:29 netisr     root    75     0  0  Mar  9  ?    0:18 netisr     root    76     0  0  Mar  9  ?    0:17 netisr     root    77     0  0  Mar  9  ?    0:14 netisr     root    78     0  0  Mar  9  ?    0:48 nvsisr     root    79     0  0  Mar  9  ?    0:00 supsched     root    80     0  0  Mar  9  ?    0:00 smpsched     root    81     0  0  Mar  9  ?    0:00 smpsched     root    82     0  0  Mar  9  ?    0:00 sblksched     root    83     0  0  Mar  9  ?    0:00 sblksched     root    84     0  0  Mar  9  ?    0:00 strmem     root    85     0  0  Mar  9  ?    0:00 strweld     root  3730     1  0 16:39:22 console   0:00 /usr/sbin/getty console console     root   404     1  0  Mar  9  ?    3:57 /usr/sbin/swagentd   oracle   919     1  0 15:23:23 ?    0:00 oraclegprd (LOCAL=NO)     root   289     1  2  Mar  9  ?    78:34 /usr/sbin/syncer     root   426     1  0  Mar  9  ?    0:10 /usr/sbin/syslogd -D     root   576     1  0  Mar  9  ?    0:00 /usr/sbin/portmap     root   429     1  0  Mar  9  ?    0:00 /usr/sbin/ptydaemon     root   590     1  0  Mar  9  ?    0:00 /usr/sbin/biod 4     root   442     1  0  Mar  9  ?    0:00 /usr/lbin/nktl_daemon 0 0 0 0 0 1 -2   oracle  8145     1  0 12:02:48 ?    0:00 oraclegprd (LOCAL=NO)     root   591     1  0  Mar  9  ?    0:00 /usr/sbin/biod 4     root   589     1  0  Mar  9  ?    0:00 /usr/sbin/biod 4     root   592     1  0  Mar  9  ?    0:00 /usr/sbin/biod 4     root   604     1  0  Mar  9  ?    0:00 /usr/sbin/rpc.lockd     root   598     1  0  Mar  9  ?    0:00 /usr/sbin/rpc.statd     root   610     1  0  Mar  9  ?    0:16 /usr/sbin/automount -f /etc/auto_master     root   638     1  0  Mar  9  ?    0:06 sendmail: accepting connections     root   618     1  0  Mar  9  ?    0:02 /usr/sbin/inetd     root   645     1  0  Mar  9  ?    5:01 /usr/sbin/snmpdm     root   661     1  0  Mar  9  ?   11:28 /usr/sbin/fddisubagtd     root   711     1  0  Mar  9  ?   30:59 /opt/dce/sbin/rpcd     root   720     1  0  Mar  9  ?    0:00 /usr/sbin/vtdaemon     root   867   777  1  Mar  9  ?    0:00 <defunct>       lp   733     1  0  Mar  9  ?    0:00 /usr/sbin/lpsched     root   777     1  0  Mar  9  ?    8:55 DIAGMON     root   742     1  0  Mar  9  ?    0:15 /usr/sbin/cron   oracle  7880     1  0 11:43:47 ?    0:00 oraclegprd (LOCAL=NO)     root   842     1  0  Mar  9  ?    0:00 /usr/vue/bin/vuelogin   oracle  5625     1  0 07:00:14 ?    0:01 ora_smon_gprd     root   781     1  0  Mar  9  ?    0:00 /usr/sbin/envd     root   833   777  0  Mar  9  ?    0:00 DEMLOG  DEMLOG;DEMLOG;0;0;     root   813     1  0  Mar  9  ?    0:00 /usr/sbin/nfsd 4     root   807     1  0  Mar  9  ?    0:00 /usr/sbin/rpc.mountd     root   815   813  0  Mar  9  ?    0:00 /usr/sbin/nfsd 4     root   817   813  0  Mar  9  ?    0:00 /usr/sbin/nfsd 4     root   835   777  0  Mar  9  ?    0:13 PSMON  PSMON;PSMON;0;0; 

Here is a brief description of the headings:

UID	The user ID of the process owner.
PID	The process ID (you can use this number to kill the process).
PPID	The process ID of the parent process.
C	Processor utilization. On a multi-processor system, you may see this number go beyond 100%. It could potentially go to 100% per processor, so a two-processor system may show 200% utilization. This varies among UNIX variants.
STIME	The start time of the process.
TTY	The controlling terminal for the process.
TIME	The cumulative execution time for the process.
COMMAND	The command name and arguments.

ps gives a quick profile of the processes running on your system. To get more detailed information, you can include the " l " option, which includes a lot of useful additional information, as shown in the following example:

 martyp $  ps -efl  F S      UID   PID  PPID  C PRI NI     ADDR     SZ    WCHAN    STIME TTY      D 19 T     root     0     0  0   0 SY f026f7f0      0            Feb 18 ?        d  8 S     root     1     0  0  41 20 f5b90808    175 f5b90a30   Feb 18 ?        - 19 S     root     2     0  0   0 SY f5b90108      0 f0283fd0   Feb 18 ?        t 19 S     root     3     0  0   0 SY f5b8fa08      0 f0287a44   Feb 18 ?       6h  8 S     root  3065  3059  0  40 20 f626d040   1639 f62aab96   Feb 22 ?        c  8 S     root    88     1  0  40 20 f5b8d708    377 f5b59df6   Feb 18 ?        q  8 S     root   478     1  0  41 20 f5b8ec08    388 f5b51bb8   Feb 18 ?        0  8 S     root    94     1  0  41 20 f5b8d008    527 f5b59e46   Feb 18 ?        d  8 S     root   150     1  0  41 20 f5da1a10    808 f5b59806   Feb 18 ?        d  8 S     root    96     1  0  67 20 f5da2810    535 f5b59ad6   Feb 18 ?        v  8 S     root   144     1  0  41 20 f5da0c10   2694 ef69f61c   Feb 18 ?       5d  8 S     root  1010     1  0   0 RT f61da330    496 f5dbec1c   Apr 12 ?        n  8 S     root   106     1  0  41 20 f5da1310    485 f5b59e96   Feb 18 ?        s  8 S     root   156     1  0  51 20 f5b8de08    446 f5b51eb8   Feb 18 ?        n  8 S     root   176     1  0  53 20 f5da2110    740 f5b59036   Feb 18 ?        d  8 S     root   129     1  0  56 20 f5d9fe10    447 f5b59cb6   Feb 18 ?        d  8 S   daemon   130     1  0  41 20 f5d9f710    564 f5b59b76   Feb 18 ?        d  8 S     root 14798     1  0  45 20 f5b8e508    616 f5b8e730   Mar 09 ?       3d  8 S     root   133     1  0  51 20 f5e18818    507 f5b59c66   Feb 18 ?        s  8 S     root   197     1  0  63 20 f5e15e18    284 f5e16040   Feb 18 ?        d  8 S     root   196     1  0  41 20 f5da0510    429 f5c68f8e   Feb 18 ?        c  8 S     root   213     1  0  41 20 f5e16518    586 f5c68b2e   Feb 18 ?       4d  8 S     root   199   196  0  41 20 f5e16c18    451 f5b59f86   Feb 18 ?        i  8 S     root   219     1  0  41 20 f5e17318    658 f5b59d06   Feb 18 ?        m  8 S     root   209     1  0  41 20 f5e18118    234 f5c68e4e   Feb 18 ?        d  8 S     root  2935   266  0  40 20 f61db130   2473 f62aaa56   Feb 22 ?       4  8 S     root 16800  3059  1  81 30 f626f340   1466 f61b345e 07:59:40 ?        k  8 S     root  2963  2954  0  40 20 f5f52028    513 f61b313e   Feb 22 ?        e  8 S     root   479     1  0  55 20 f5ee7120    407 f5fde2c6   Feb 18 console  g  8 S     root 10976     1  0  65 20 f5f55828    478 f5c6853e   Jun 01 ?        d  8 S     root  7468     1  0  46 20 f621da38   2851    8306c   Feb 24 ?        d  8 S     root   266     1  0  41 20 f5ee5520   1601 f5c6858e   Feb 18 ?        n  8 S   martyp 16763 16761  0  51 20 f6270140    429 f62701ac 07:46:46 pts/4    h  8 S     root 10995     1  0  41 20 f5b8f308   2350 f5fde5e6   Jun 01 ?        d  8 S     root   484   478  0  41 20 f5ee4e20    408 f5ee5048   Feb 18 ?        n  8 S     root   458     1  0  41 20 f5f54a28    504 f5fde906   Feb 18 ?       2m  8 O     root 16802 16763  1  61 20 f5ee7820    220          08:00:05 pts/4    l  8 S     root   471     1  0  41 20 f5f53c28    658 f5fde726   Feb 18 ?        d  8 S     root   474     1  0  51 20 f5f53528    804 f61a58b6   Feb 18 ?        g  8 S     root   485   458  0  40 20 f5f52e28    734 f607ecde   Feb 18 ?       74  8 S     root  2954  2936  0  40 20 f626e540    433 f626e5ac   Feb 22 ?        n  8 S     root  2936   266  0  66 20 f5ee4720   1637 f5ee478c   Feb 22 ?        n  8 S     root  3061  3059  0  40 20 f5e17a18   2041 f61b359e   Feb 22 ?        m  8 S     root  3058     1  0  40 20 f61daa30   1067 f62aadc6   Feb 22 pts/2    n  8 S     root   712   133  0  41 20 f61d8e30    798 f61b390e   Feb 18 ?        d  8 Z     root 11001 11000  0   0                                               >  8 S     root  2938     1  0  60 20 f5ee6320    513 f601bfb6   Feb 22 ?        0  8 S     root  2999  2954  0  40 20 f621e138   1450 f61b33be   Feb 22 pts/2    t  8 S     root  3059  3002  1  51 20 f626de40   4010 f62aafa6   Feb 22 pts/2   2n  8 S     root  3063  3059  0  50 20 f621e838   1952 f62aa556   Feb 22 ?  8 S     root  3099  3062  0  40 20 f5f52728   2275 f60a1d18   Feb 22 ?        0  8 S     root 11000 10995  0  48 20 f626d740   2312    55694   Jun 01 ?        e  8 S     root  3002  2999  0  43 20 f61d8730    427 f61d879c   Feb 22 pts/2    =  8 S     root   730   133  0  40 20 f61d9530    422 f62aa9b6   Feb 18 ?        d  8 S     root  3062  3059  0  61 20 f621b738   2275 f62aa506   Feb 22 ?        0  8 S     root  3067     1  0  40 20 f5ee5c20    424 f5ee5c8c   Feb 22 ?        d  8 S     root  3000     1  0  40 20 f61d8030    518 f62aa8c6   Feb 22 ?        m  8 S     root  3078  3067  0  40 20 f61d9c30    211 f5b512b8   Feb 22 ?        0  8 S     root 10984     1  0  41 20 f5f54328   2484 eee46e84   Jun 01 ?       1b  8 S     root 16761   133  0  44 20 f5ee4020    411 f5c6894e 07:46:45 ?        d martyp $ 

In this example, the first column is F for flags. F provides octal information about whether the process is swapped, in core , a system process, and so on. The octal value sometimes varies from system to system, so check the manual pages for your system to see the octal value of the flags.

S is for state. The state can be sleeping, as indicated by S for most of the processes shown in the example, waiting, running, intermediate, terminated , and so on. Again, some of these values may vary from system to system, so check your manual pages.

Some additional useful information in this output are: NI for the nice value, ADDR for the memory address of the process, SZ for the size of the process in physical pages, and WCHAN , which is the event for which the process is waiting.