ps¶

ps shows a list of processes in a unix system.

Examples¶

Show the name of the shell you are running in¶

ps -p $$ -o comm=

Show the exact command used to start all process¶

ps axwwo command

Show a process tree view¶

ps auxf

Show only all running processes¶

This excludes sleeping processes and threads.

ps auxr

Show process list sorted by process start time¶

ps hax -o lstart,pid,args |
  while read -r a b c d e f g ; do
    echo "$(date -d "$a $b $c $d $e" "+%F %T%z") $f $g" ;
  done |
  sort

Show all processes not owned by a user, and no threads, including cgroup name¶

-N after a condition makes hides the results of that condition
All linux kernel threads have parent pid 2 (kthreadd)

FILTERED_USER=zerocool # user must exist
ps -o pid,ppid,user,comm,flags,%cpu,sz,%mem,cgname --user "${FILTERED_USER}" -N --ppid 2 -N

Show linux kernel namespaces of all processes¶

You have to use sudo to see all processes in all namespaces. awk is to filter out kernel threads, which are irrelevant in this context.

sudo ps -axe -o user,pid,ipcns,mntns,netns,pidns,userns,utsns,comm | awk '$3!="-"'

The output will look like:

$ sudo ps -axe -o user,pid,ipcns,mntns,netns,pidns,userns,utsns,comm | awk '$3!="-"' | grep -E "udevd|init|MNTNS|dockerd"
USER         PID      IPCNS      MNTNS      NETNS      PIDNS     USERNS      UTSNS COMMAND
root         477 4026531839 4026532239 4026531840 4026531836 4026531837 4026532259 systemd-udevd
root         748 4026531839 4026531841 4026531840 4026531836 4026531837 4026531838 dockerd
root       17781 4026532479 4026532477 4026531840 4026532480 4026531837 4026532478 s6-linux-init-s