Check Processes with ps

To find the answer to "What is my system doing?," use ps -ef. This command provides information about every running process on your system. If, for instance, you want to know about telnet connections, simply type ps -ef and look for telnet. Although ps tells you every process that is running on your system, it doesn't provide a good summary of the level of system resources being consumed. I would guess that ps is the most often issued system administration command. You can use a number of options with ps. I normally use e and f, which provide information about every (e) running process and lists this information in full (f). ps outputs are almost identical going from system to system. The following shows the output of a ps command:

 # ps -ef UID        PID  PPID  C STIME TTY          TIME CMD root         1     0  0  2002 ?        00:00:05 init [5] root         2     1  0  2002 ?        00:00:00 [keventd] root         3     1  0  2002 ?        00:00:00 [kapmd] root         4     1  0  2002 ?        00:00:00 [ksoftirqd_CPU0] root         5     1  0  2002 ?        00:01:03 [kswapd] root         6     1  0  2002 ?        00:00:00 [bdflush] root         7     1  0  2002 ?        00:00:00 [kupdated] root         8     1  0  2002 ?        00:00:00 [mdrecoveryd] root        12     1  0  2002 ?        00:00:08 [kjournald] root        64     1  0  2002 ?        00:00:00 [khubd] root       158     1  0  2002 ?        00:00:00 [kjournald] root       159     1  0  2002 ?        00:00:00 [kjournald] root       160     1  0  2002 ?        00:00:01 [kjournald] root       161     1  0  2002 ?        00:00:05 [kjournald] root       162     1  0  2002 ?        00:00:10 [kjournald] root       459     1  0  2002 ?        00:00:04 syslogd -m 0 root       463     1  0  2002 ?        00:00:00 klogd -x rpc        474     1  0  2002 ?        00:00:00 portmap rpcuser    493     1  0  2002 ?        00:00:00 rpc.statd root      556      1  0  2002 ?       00:00:00 /usr/sbin/apmd -p 10 -w 5 -W -P /etc/sysco root       594     1  0  2002 ?        00:00:00 /usr/sbin/sshd root      608     1  0  2002 ?        00:00:00 xinetd -stayalive -reuse -pidfile /var/run root       631     1  0  2002 ?        00:00:03 sendmail: accepting connections smmsp      641    1  0  2002 ?        00:00:00 sendmail: Queue runner@01:00:00 for /var/s root       651     1  0  2002 ?        00:00:01 gpm -t ps/2 -m /dev/mouse bin        661     1  0  2002 ?        00:00:00 cannaserver -syslog -u bin root       670     1  0  2002 ?        00:00:00 crond root       679     1  0  2002 ?        00:00:00 smbd -D root       683     1  0  2002 ?        00:00:08 nmbd -D xfs        730     1  0  2002 ?        00:00:34 xfs -droppriv -daemon daemon     748     1  0  2002 ?        00:00:00 /usr/sbin/atd root      770     1  0  2002 ?        00:00:09 /usr/bin/perl /usr/libexec/webmin/miniserv root       774     1  0  2002 tty1     00:00:00 /sbin/mingetty tty1 root       775     1  0  2002 tty2     00:00:00 /sbin/mingetty tty2 root       776     1  0  2002 tty3     00:00:00 /sbin/mingetty tty3 root       777     1  0  2002 tty4     00:00:00 /sbin/mingetty tty4 root       778     1  0  2002 tty5     00:00:00 /sbin/mingetty tty5 root       779     1  0  2002 tty6     00:00:00 /sbin/mingetty tty6 root       780      1  0  2002 ?        00:00:00 /usr/bin/gdm-binary -nodaemon root       813    780  0  2002 ?        00:00:00 /usr/bin/gdm-binary -nodaemon root       814  813  3  2002 ?        07:40:10 /usr/X11R6/bin/X :0 -auth /var/gdm/:0.Xaut root       823     813  0  2002 ?        00:00:02 /usr/bin/gnome-session root      882     823  0  2002 ?     00:00:00 /usr/bin/ssh-agent /etc/X11/xinit/Xclients root        893     1  0  2002 ?        00:00:02 /usr/libexec/gconfd-2 9 root       895     1  0  2002 ?     00:00:00 /usr/libexec/bonobo-activation-server --ac root       897     1  0  2002 ?     00:00:39 metacity --sm-save-file 1034946228-887-262 root       899     1  0  2002 ?     00:00:03 gnome-settings-daemon --oaf-activate-iid=O root         901    608  0  2002 ?      00:00:01 fam root        917     1  0  2002 ?    00:17:06 magicdev --sm-config-prefix /magicdev-Nu4T root        919     1  0  2002 ?    00:00:14 nautilus --sm-config-prefix /nautilus-vsLM root        921     1  0  2002 ?    00:01:41 gnome-panel --sm-config-prefix /gnome-pane root        924     1  0  2002 ?    00:45:40 gnome-terminal --sm-config-prefix /gnome-t root        926     1  0  2002 ?    00:00:11 /usr/bin/pam-panel-icon --sm-client-id 11c root        928     1  1  2002 ?    02:09:49 /usr/bin/python /usr/bin/rhn-applet-gui -- root         929    926  0  2002 ?      00:00:02 /sbin/pam_timestamp_check -d root root         930    924  0  2002 pts/0  00:00:01 bash root        1112   924   0  2002 pts/2  00:00:00 bash root        1977     1   0  2002 ?      00:08:52 gaim root       2279    1  0   2002 ?    00:00:01 /usr/libexec/nautilus-throbber --oaf-activ root        3555   924  0  2002 pts/1   00:00:01 bash root       28895  608  0 18:37 ?      00:00:00 in.telnetd: F4457MXP root       28896  28895  0  18:37 ?     00:00:00 login -- linuxconnect 501        28897  28896  0  18:37 pts/3 00:00:00 -bash root       28927  28897  0  18:37 pts/3 00:00:00 su - root       28928  28927  1  18:37 pts/3 00:00:00 -bash root       28964  28928  0  18:37 pts/3 00:00:00 ps -ef # 

Here is a brief description of the headings:

UID	The user ID of the process owner
PID	The process ID (use this number to kill the process)
PPID	The process ID of the parent process
C	Process utilization for scheduling
STIME	Start time of the process
TTY	The controlling terminal for the process, if any
TIME	The cumulative execution time for the process
COMMAND	The command name and arguments

ps quickly profiles the processes running on your system. To get more detailed information, you can use the l option, which includes a lot of useful additional information, as shown in the following example showing only Bash processes:

 # ps -efl   F S UID        PID  PPID  C PRI   NI  ADDR   SZ WCHAN  STIME TTY          TIME CMD 000 S root       930   924  0  75    0     - 1056 schedu  2002 pts/0    00:00:01 bash 000 S root      1112   924  0  75    0     - 1066 schedu  2002 pts/2    00:00:00 bash 100 S root      3555   924  0  75    0     - 1081 schedu  2002 pts/1    00:00:01 bash 100 S 501      28897 28896  0  75    0     - 1033 wait4  18:37 pts/3    00:00:00 -bash 100 S root     28928 28927  0  75    0     - 1047 wait4  18:37 pts/3    00:00:00 -bash 000 S root     28977 28928  0  76    0     -  813 pipe_w 18:49 pts/3    00:00:00 grep bash                      .                      .                      . 

In this example, the first column is F for flags. F provides octal information about whether the process is swapped, in core, a system process, and so on. The octal value sometimes varies from system to system, so check the manual pages for your system to see the octal value of the flags.

S is for state. The state can be sleeping, as indicated by S for the processes shown in the example, waiting, running, intermediate, terminated, and so on. Again, some of these values can vary from system to system, so check your manual pages.

Some additional useful information in this output is: NI for the nice value; ADDR for the memory address of the process; SZ for the size in physical pages of the process; and WCHAN, which is the event for which the process is waiting.