CHAPTER 12
The ps command is used to list the currently running processes on a Linux system. If you run ps without any arguments, it displays the processes that are running as you and associated with your terminal. If you were to connect to a Linux server twice, you would see different output from the ps command. You might see the following for the first session, which is using pts/0 (pseudo terminal 0).
$ ps PID TTY TIME CMD 1309 pts/0 00:00:00 bash 1635 pts/0 00:00:00 ps $ |
The following is the output from ps on the second connection, which is using pts/1.
$ ps PID TTY TIME CMD 1721 pts/1 00:00:00 bash 1821 pts/1 00:00:00 ps $ |
If you want to display all of your running processes, regardless of the associated terminal or lack thereof, use the command ps -u username.
$ ps -u jason PID TTY TIME CMD 1308 ? 00:00:00 sshd 1309 pts/0 00:00:00 bash 1720 ? 00:00:00 sshd 1721 pts/1 00:00:00 bash $ |
To see every process running on the system, use the command ps -e.
$ ps -e | head PID TTY TIME CMD 1 ? 00:00:00 init 2 ? 00:00:00 kthreadd 3 ? 00:00:00 ksoftirqd/0 6 ? 00:00:00 migration/0 7 ? 00:00:00 watchdog/0 8 ? 00:00:00 cpuset 9 ? 00:00:00 khelper 10 ? 00:00:00 kdevtmpfs 11 ? 00:00:00 netns $ |
By default, the information provided by ps is rather sparse. Typically when using ps you will supply additional arguments to display more detailed information. The following are some of the most common options to use with ps.
Description | Option |
|---|---|
Display all processes. | -e |
Use a full format listing. | -f |
Display processes for username | -u <username> |
Display process information for process ID (PID). | -p <PID> |
Display processes in a hierarchy (tree). | -H |
Display processes in a hierarchy using ASCII art. | --forest |
The following table illustrates some useful ways to combine the preceding options.
Description | Command |
|---|---|
Display all processes. | ps -e |
Display all processes using a full format listing. | ps -ef |
Display all processes in a tree format. | ps -eH |
Display all processes in a tree format with ASCII art. | ps -e -forest |
Display processes running for username. | ps -u <username> |
Display a full-format listing for process ID (PID). | ps -fp <PID> |
The following demonstrates output from various ps commands.
$ ps PID TTY TIME CMD 1309 pts/0 00:00:00 bash 2096 pts/0 00:00:00 ps $ ps -f UID PID PPID C STIME TTY TIME CMD jason 1309 1308 0 15:15 pts/0 00:00:00 -bash jason 2102 1309 0 15:45 pts/0 00:00:00 ps -f $ ps -p 1309 PID TTY TIME CMD 1309 pts/0 00:00:00 bash $ ps -fp 1309 UID PID PPID C STIME TTY TIME CMD jason 1309 1308 0 15:15 pts/0 00:00:00 -bash $ ps -e | head PID TTY TIME CMD 1 ? 00:00:00 init 2 ? 00:00:00 kthreadd 3 ? 00:00:00 ksoftirqd/0 6 ? 00:00:00 migration/0 7 ? 00:00:00 watchdog/0 8 ? 00:00:00 cpuset 9 ? 00:00:00 khelper 10 ? 00:00:00 kdevtmpfs 11 ? 00:00:00 netns $ ps -ef | head UID PID PPID C STIME TTY TIME CMD root 1 0 0 15:14 ? 00:00:00 /sbin/init root 2 0 0 15:14 ? 00:00:00 [kthreadd] root 3 2 0 15:14 ? 00:00:00 [ksoftirqd/0] root 6 2 0 15:14 ? 00:00:00 [migration/0] root 7 2 0 15:14 ? 00:00:00 [watchdog/0] root 8 2 0 15:14 ? 00:00:00 [cpuset] root 9 2 0 15:14 ? 00:00:00 [khelper] root 10 2 0 15:14 ? 00:00:00 [kdevtmpfs] root 11 2 0 15:14 ? 00:00:00 [netns] $ ps -fu www-data UID PID PPID C STIME TTY TIME CMD www-data 1060 1057 0 15:15 ? 00:00:00 /usr/sbin/apache2 -k start www-data 1061 1057 0 15:15 ? 00:00:00 /usr/sbin/apache2 -k start www-data 1062 1057 0 15:15 ? 00:00:00 /usr/sbin/apache2 -k start |
A command similar to running ps with the -H or --forest options is pstree.
$ pstree | head init-+-accounts-daemon---{accounts-daemon} |-acpid |-apache2-+-apache2 | `-2*[apache2---26*[{apache2}]] |-at-spi-bus-laun-+-dbus-daemon | `-3*[{at-spi-bus-laun}] |-at-spi2-registr---{at-spi2-registr} |-atd |-console-kit-dae---64*[{console-kit-dae}] |-cron $ |
The ps command displays a point-in-time snapshot of the running processes. If you want an updating display of processes, use top or htop. The top and htop commands provide a system summary and process list. The commands are interactive, so while the program is running, you can sort processes by CPU usage, memory usage, or even kill a given process.
$ top top - 16:05:29 up 50 min, 2 users, load average: 0.00, 0.01, 0.05 Tasks: 88 total, 1 running, 87 sleeping, 0 stopped, 0 zombie Cpu(s): 0.7%us, 0.2%sy, 0.3%ni, 97.9%id, 0.8%wa, 0.0%hi, 0.0%si, 0.0 Mem: 503444k total, 346020k used, 157424k free, 45748k buffers Swap: 0k total, 0k used, 0k free, 176524k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 974 root 20 0 285m 29m 9444 S 2.0 6.0 0:18.67 Xorg 1440 lightdm 20 0 577m 19m 11m S 2.0 3.9 0:07.14 unity-greeter 1 root 20 0 24596 2392 1268 S 0.0 0.5 0:00.34 init ... |
The top command will be on any Linux system you encounter; however, you may have to install the htop command, as it is typically not a part of the base set of packages installed on most distributions.
By default, when you execute a program at the command line, it runs in the foreground. While this program, or foreground process, is running, you aren't able to execute any other commands. Once the program is finished, a new command prompt is displayed, ready to execute your next command. Many commands take anywhere from a fraction of a second to just a few seconds to run. However, you may want to execute a long running program and continue to perform other work in the meantime. To start a program in the background, end the command line with an ampersand. When you start a program in the background, the command prompt is immediately returned and allows you to continue other commands. These background programs and processes are often referred to as jobs.
Description | Command |
|---|---|
Start command in the background. | command & |
Kill the foreground process. | Ctrl-c |
Suspend the foreground process. | Ctrl-z |
Background a suspended process. | bg [%num] |
Foreground a backgrounded process. | fg [%num] |
Kill a process by job number or PID. | kill [%num] |
List all jobs or %num job. | jobs [%num] |
When a program is started in the background, two numbers are returned before the new prompt is displayed. Those two pieces of information are the job number, which is enclosed in brackets, and the process ID (PID). Job numbers can be referenced by preceding them with a percent sign. The following example demonstrates starting multiple processes in the background.
$ ./long-running-proc & [1] 2793 $ ./long-running-proc & [2] 2795 $ ./long-running-proc & [3] 2807 $ ./long-running-proc & [4] 2809 $ jobs [1] Done ./long-running-proc & [2] Running ./long-running-proc & [3]- Running ./long-running-proc & [4]+ Running ./long-running-proc & $ |
In the output of the jobs command, you will notice a plus sign and a minus sign. The plus sign represents the current job, while the minus sign represents what is considered to be the previous job. The current job is the last job that was started in the background or the most recent process that was stopped while it was running in the foreground. You can reference the current job by using double percent signs (%%) or a percent sign followed by a plus sign (%+). The previous job can be accessed by using a percent sign followed by a minus sign (%-). When working with the fg and bg commands, the current job is operated upon unless you explicitly specify a different job.
In the preceding output of the jobs command, job number 1 is reported as being done while the other jobs are in a running state. The shell reports job statuses right before a new prompt is displayed. The shell will not interrupt your current command line, even if it is empty, to report that a job has completed. To force a new prompt to be displayed, press the Enter key. If any of your jobs have completed, a status will be displayed before your new prompt is presented. The following is an example of that behavior.
$ <ENTER> $ <ENTER> [2] Done ./long-running-proc & $ jobs [3]- Running ./long-running-proc & [4]+ Running ./long-running-proc & $ |
In order to return a job to the foreground, use the fg command followed by a percent sign and job number. A shorthand way to perform the exact same task is to type a percent sign followed by the job number on the command line. So, fg %2 and %2 are equivalent.
Remember that the current job can be referenced by %% or %+. Also, the fg command operates on the current job unless another job is supplied. The following four commands are identical.
$ fg $ fg %% $ fg %+ $ %% |
The following demonstrates bringing job number three into the foreground.
$ jobs [3]- Running ./long-running-proc & [4]+ Running ./long-running-proc & $ fg %3 ./long-running-proc |
To pause or suspend the foreground process, type Ctrl-z. A job that has been suspended can be resumed in the background or foreground. To resume a suspended job in the background, type the job specification followed by an ampersand, or use the bg command followed by the job specification. If you want to background the process that was most recently suspended, you can omit the job specification as bg will operate on the current job. To resume the job in the foreground, use the fg command or just the job specification. The following demonstrates these methods.
$ jobs [1] Running ./long-running-proc & [2] Running ./long-running-proc & [3]- Running ./long-running-proc & [4]+ Running ./long-running-proc & $ %2 ./long-running-proc ^Z [2]+ Stopped ./long-running-proc $ fg %3 ./long-running-proc ^Z [3]+ Stopped ./long-running-proc $ jobs [1] Running ./long-running-proc & [2]- Stopped ./long-running-proc [3]+ Stopped ./long-running-proc [4] Running ./long-running-proc & $ bg [3]+ ./long-running-proc & $ jobs [1] Running ./long-running-proc & [2]+ Stopped ./long-running-proc [3] Running ./long-running-proc & [4]- Running ./long-running-proc & $ |
To kill a job that is running in the foreground, type Ctrl-c. To kill a job that has been backgrounded, use the kill command. The kill command takes a job specification or a process ID as an argument. To list the PIDs in addition to the job numbers, use the -l option of the jobs command.
$ jobs [1] Running ./long-running-proc & [2] Running ./long-running-proc & [3]- Running ./long-running-proc & [4]+ Running ./long-running-proc & $ fg %1 ./long-running-proc ^C$ jobs [2] Running ./long-running-proc & [3]- Running ./long-running-proc & [4]+ Running ./long-running-proc & $ kill %3 [3]- Terminated ./long-running-proc $ jobs -l [2]- 2914 Running ./long-running-proc & [4]+ 2918 Running ./long-running-proc & $ kill 2914 [2]- Terminated ./long-running-proc $ |
The kill command simply sends a signal to a running process. The default signal, however, is termination. The termination signal is referred to as SIGTERM or just TERM for short. To display a list of signals and their corresponding numbers, use the kill -l command. To specify a signal to send to a process, follow the kill command with a dash and the signal name or number.
$ kill -l | grep SIGTERM 11) SIGSEGV 12) SIGUSR2 13) SIGPIPE 14) SIGALRM 15) SIGTERM $ kill 123 $ kill -SIGTERM 234 $ kill -TERM 345 $ kill -15 456 |
If a process does not terminate after it has been sent the TERM signal, use the KILL signal. The corresponding number for SIGKILL is 9.
$ ps | grep cannot-stop-me 2994 pts/1 00:00:00 cannot-stop-me $ kill 2994 $ ps | grep cannot-stop-me 2994 pts/1 00:00:00 cannot-stop-me $ kill -9 2994 $ ps | grep cannot-stop-me $ |