ps (process status) displays a snapshot of currently running processes. It is the primary tool for inspecting what is running on a Linux system, finding PIDs, checking CPU and memory usage, and understanding process relationships. Master ps to diagnose and manage your system effectively.
LinuxpsProcessesCLIps aux
a shows processes for all users, u displays user-oriented format (shows %CPU, %MEM, command), and x includes processes without a controlling terminal (daemons). This is the standard starting point for process inspection.ps axjf
f flag renders a visual ASCII tree showing parent-child process relationships. This makes it easy to see which processes spawned which others — useful for understanding how a web server or app server is organized.ps -u $USER
-u username flag filters processes owned by a specific user. Using $USER automatically expands to your current username. Useful for seeing only your own processes on a shared system.ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%cpu
-e selects all processes and -o specifies custom output columns. This shows PID, parent PID, command, memory %, and CPU % sorted by CPU descending. A powerful pattern for tailored process monitoring.ps aux | grep nginx
grep -v grep or use pgrep nginx instead for cleaner output.ps -p 1234
-p flag shows information for a specific PID. You can specify multiple PIDs separated by commas: ps -p 1234,5678. Useful when you already know the PID from a log file or another tool.ps -eLf
-L flag shows individual threads alongside processes. The LWP column shows the thread ID. Use this when diagnosing multi-threaded applications like Java services or Node.js clusters.ps aux --sort=-%cpu | head -11
--sort=-%cpu and pipe to head to show only the top consumers. The header line is included so use head -11 to see 10 processes. Useful for quickly identifying CPU hogs.ps aux --sort=-%mem | head -11
watch to auto-refresh: watch -n 2 'ps aux --sort=-%mem | head -11' for a live updating view.watch -n 1 'ps aux | grep myapp | grep -v grep'
watch command re-runs a command at regular intervals. This refreshes the process list every second, filtered for your app. Useful for monitoring restart behavior, resource trends, or verifying a deployment went live.ps aux to see all running processes with CPU and memory usage.grep name to filter for a specific process.--sort=-%cpu or --sort=-%mem to find resource hogs.pgrep processname as a cleaner alternative to ps aux | grep name.ps takes a single snapshot of the process list at the moment it runs. top (and htop) provide a continuously updating interactive view. Use ps in scripts and one-time inspections; use top/htop for interactive real-time monitoring.
Get the PID from the first column of ps output, then run kill PID to send SIGTERM (graceful shutdown) or kill -9 PID for SIGKILL (force kill). Use pkill processname to kill by name without needing the PID.
If a process is not visible to your user, it may be running as a different user (use sudo ps aux) or it may have already exited. Zombie processes (Z state) appear in ps but have already terminated and are waiting for their parent to collect their exit status.