Processes · Lesson 1

ps (Processes)

Learn how to take process snapshots with `ps` and monitor changing activity with `top`.

A process is a running instance of a program, together with its memory, credentials, open resources, and execution state. Linux identifies each live process with a numeric process ID, or PID. A PID is unique among processes that exist at the same time, but the kernel can reuse it after a process exits.

Taking a Basic Snapshot

Run ps without options to see a snapshot selected by the implementation's defaults, commonly processes associated with your current terminal and user:

$ ps
    PID TTY          TIME CMD
  41230 pts/4    00:00:00 bash
  51224 pts/4    00:00:00 ps

Typical fields include:

PID: process ID
TTY: controlling terminal, or ? when none is associated
TIME: accumulated CPU time, not elapsed wall-clock duration
CMD: command name or command line, depending on the selected format

Exact columns and selection defaults vary between ps implementations and environments.

What does the PID column identify?

Listing Processes with BSD-Style Options

Linux ps accepts several option styles. BSD-style options are commonly written without a leading dash:

$ ps aux

In this combination:

a expands selection to processes belonging to other users that have terminals.
x also includes processes without controlling terminals and broadens the selection when combined with a.
u selects a user-oriented output format with fields such as USER, %CPU, %MEM, VSZ, and RSS.

Because option meanings can interact, interpret the complete combination rather than treating every letter as an independent command.

In ps aux, which option requests the user-oriented output format?

Using Standard-Style Options

The widely used standard-style command ps -ef writes options with a leading dash:

$ ps -ef

-e selects every process visible to the caller.
-f requests a full-format listing.

The output commonly includes UID, PID, PPID, start time, and command information. PPID is the parent process ID. This listing is not inherently hierarchical; use an option such as --forest where supported, or a dedicated tree viewer such as pstree, when parent-child layout matters.

What does -e request in ps -ef?

Monitoring Activity over Time

ps exits after producing one snapshot. Use top for an interactive view that refreshes periodically:

$ top

top helps identify changing CPU and memory consumers, but its values are samples and can fluctuate. Confirm a suspected problem across multiple observations and relate percentages to the machine's CPU count, memory accounting, and workload.

Which tool introduced here refreshes its process display periodically by default?

For hands-on practice, use Manage and Monitor Linux Processes to compare snapshots with an interactive monitor, or explore sorting and filtering in the Linux top Command lab.

Lesson complete

You finished ps (Processes)

You can now choose a process view and interpret its basic identifiers.

Treat a PID as a reusable identifier for a currently live process.
Use plain ps for a small default snapshot.
Use ps aux or ps -ef for broader selections and richer columns.
Use top when changes over time matter.

Keep your learning progress

Create a free account to save this lesson and continue learning on any device.

Create a free account

Next Lesson

Back to Processes