On this page 14 sections
  1. Processes in Linux
  2. ps aux
  3. Understand ps aux columns
  4. Search for a process
  5. Show processes as a tree
  6. Inspect one process
  7. Sort by CPU usage
  8. Processes for a specific user
  9. Custom process output
  10. Long-running processes
  11. Inspect process command line from /proc
  12. Inspect process environment
  13. Find network process relationships
  14. Useful process overview
Lab use only. Apply these techniques only to systems you own or have explicit permission to test.
01

Processes in Linux

Every running program is represented by a process with a PID. Processes also have an owner, parent process, resource usage and command line. Understanding the process tree is useful for administration, troubleshooting and security analysis.

Current shell processes
ps
02

ps aux

ps aux is one of the most common ways to display processes from all users with CPU, memory and command information.

Show all processes
ps aux
03

Understand ps aux columns

USER identifies the owner, PID is the process ID, %CPU and %MEM show resource usage, VSZ and RSS represent memory information, STAT shows process state, START indicates when it started and COMMAND contains the executed command.

04

Search for a process

grep can quickly filter ps output, although pgrep is often cleaner for scriptable process lookup.

Find nginx
ps aux | grep "[n]ginx"
Find SSH processes
ps aux | grep "[s]shd"
Use pgrep
pgrep -a nginx
05

Show processes as a tree

A process tree makes parent-child relationships visible and helps explain which service launched another process.

Process tree with ps
ps auxf
Dedicated tree view
pstree -p
06

Inspect one process

ps can show selected fields for a specific PID instead of printing the complete process list.

Inspect PID
ps -p 1234 -o pid,ppid,user,%cpu,%mem,etime,cmd
07

Sort by CPU usage

ps can sort processes directly, which is useful when investigating performance problems.

Highest CPU usage
ps aux --sort=-%cpu | head
Highest memory usage
ps aux --sort=-%mem | head
08

Processes for a specific user

Processes can be filtered by user to understand which applications or services are running under a particular security context.

Processes owned by root
ps -u root -f
Processes owned by www-data
ps -u www-data -f
09

Custom process output

The -o option allows only useful fields to be displayed, producing much cleaner output for scripts and investigations.

PID, owner and command
ps -eo pid,user,ppid,cmd
Include CPU and memory
ps -eo pid,user,%cpu,%mem,cmd --sort=-%cpu
10

Long-running processes

etimes displays elapsed runtime in seconds. Long-running or unexpectedly new processes can both be interesting depending on the troubleshooting context.

Sort by elapsed runtime
ps -eo pid,user,etimes,cmd --sort=-etimes
11

Inspect process command line from /proc

The proc filesystem exposes detailed information about each running process. cmdline contains the arguments used when starting the process.

Process command line
tr '\0' ' ' < /proc/1234/cmdline
Process executable
readlink -f /proc/1234/exe
12

Inspect process environment

Environment variables associated with a process can be viewed through /proc when permissions allow it. They may contain configuration values relevant to troubleshooting.

Process environment
tr '\0' '\n' < /proc/1234/environ
13

Find network process relationships

ps and ss work well together. ss identifies which PID owns a listening socket and ps can then provide detailed information about that process.

Find listening services
sudo ss -lntp
Inspect discovered PID
ps -p 1234 -o pid,ppid,user,etime,cmd
14

Useful process overview

A clean process listing sorted by user and PID is often easier to review than raw ps aux output.

Process overview
ps -eo user,pid,ppid,%cpu,%mem,etime,cmd --sort=user,pid