Linux systems handle numerous background tasks, services, and user applications simultaneously. Understanding how to show running processes is a fundamental skill for system administrators, developers, and power users. Monitoring these processes allows for effective troubleshooting, resource management, and security auditing.

There are several command-line utilities available to view processes, ranging from simple static snapshots to sophisticated interactive dashboards. The choice of tool typically depends on whether the goal is a quick identification of a PID (Process ID) or a deep dive into real-time resource consumption.

Understanding What a Process is in Linux

Before diving into the commands, it is essential to define what a process represents. In Linux, a process is an executing instance of a program. Each process is assigned a unique Process ID (PID) and possesses its own memory space and system resources.

Processes operate in a hierarchical structure. Every process (except the initial systemd or init) has a parent process. This relationship is crucial when managing services, as killing a parent process might result in "orphan" or "zombie" child processes. To maintain system health, monitoring tools must display these relationships and the specific resources—CPU, memory, and disk I/O—each process consumes.

Capturing Static Snapshots with the ps Command

The ps (Process Status) command is the most widely used tool for obtaining a static list of running processes. Unlike real-time monitors, ps provides a report of the system state at the exact moment the command is executed.

Understanding Syntax Variations: BSD vs. UNIX Styles

The ps command is unique because it supports three different types of options:

  1. UNIX options, which must be preceded by a dash (e.g., -e).
  2. BSD options, which must not be preceded by a dash (e.g., aux).
  3. GNU long options, which are preceded by two dashes (e.g., --pid).

In professional environments, most administrators use either the BSD style ps aux or the UNIX style ps -ef.

The Ubiquitous ps aux Command

The ps aux command is favored for its comprehensive output.

  • a: Displays processes for all users.
  • u: Displays the user-oriented format, including detailed resource usage.
  • x: Includes processes that are not attached to a terminal (such as background daemons).

When running ps aux, the output includes several critical columns:

  • USER: The owner of the process.
  • PID: The unique identifier for the process.
  • %CPU: The percentage of CPU time used.
  • %MEM: The percentage of physical memory used.
  • VSZ: Virtual memory size in KiB.
  • RSS: Resident Set Size (the non-swapped physical memory a task has used).
  • STAT: The current process state (Running, Sleeping, etc.).
  • START: The time the process started.
  • COMMAND: The full command string that initiated the process.

The Standard UNIX ps -ef Command

The ps -ef command is often preferred when the process hierarchy is the primary concern.

  • -e: Selects all processes.
  • -f: Performs a full-format listing.

This command is particularly useful because it displays the PPID (Parent Process ID). Identifying the PPID is the first step in debugging why a specific service keeps restarting or which script spawned a rogue process.

Customizing ps Output for Better Visibility

Sometimes, the default output of ps contains too much noise. You can use the -o flag to specify exactly which columns you want to see. For example, to focus only on PID, CPU usage, and the command name: