ps: list running processes

Updated November 2026

ps shows a snapshot of running processes: their process ID (PID), owner, CPU and memory use, and the command that started them. For a live, updating view use top.

ps [options]

The two classic forms

There are two option styles, and both work on Linux:

ps aux          # BSD style: every process, with user, %CPU, %MEM
ps -ef          # System V style: every process, with parent PID (PPID); works on AIX, Solaris, HP-UX

USER   PID %CPU %MEM    VSZ   RSS TTY  STAT START  TIME COMMAND
root     1  0.0  0.1 168732 13456 ?    Ss   Oct30  0:12 /sbin/init
mysql  950  1.2  8.4 2493108 690412 ? Ssl  Oct30 42:10 /usr/sbin/mariadbd
anna  4122  0.0  0.0  10072  3412 pts/0 R+  09:15  0:00 ps aux

Examples

ps aux | grep [n]ginx                      # find nginx processes (the [n] hides grep itself)
pgrep -a nginx                             # better: PIDs and command lines of matching processes
pgrep -u www-data php-fpm                  # by user and name
pidof sshd                                 # PIDs of a program
ps -u anna                                 # processes of one user
ps -fp 950                                 # details of one PID
ps -ef --forest                            # process tree (GNU)
pstree -p                                  # tree with PIDs
ps aux --sort=-%cpu | head                 # top CPU users (GNU)
ps aux --sort=-rss | head                  # top memory users (GNU)
ps -eo pid,user,etime,pcpu,rss,args        # your own choice of columns
ps -o lstart= -p 950                       # when exactly a process started

Process states

STAT	Meaning
`R`	Running or ready to run
`S`	Sleeping, waiting for something (most processes)
`D`	Uninterruptible sleep, usually waiting for disk or network storage. Many D processes mean an I/O problem.
`T`	Stopped (for example with `Ctrl`+`Z`)
`Z`	Zombie: finished, but its parent has not collected the exit status

Extra letters: s session leader, l multi-threaded, + in the foreground, < high priority, N low priority.

Memory columns

RSS is the physical memory a process uses now, in kilobytes; VSZ is the virtual memory it has reserved, which is usually much larger and not a cause for worry. Shared libraries are counted in every process that uses them, so adding up RSS overstates the total.

Zombies

A zombie uses no resources except a slot in the process table. You cannot kill it, because it is already dead; its parent must collect it. If zombies pile up, restart the parent process (shown in the PPID column of ps -ef).

To stop a process, see kill. For services managed by systemd, use systemctl instead of killing them directly.