ps -- check process activity

The ps(C) command obtains information about active processes. It gives a ``snapshot'' picture of what processes are executing, which is useful when you are trying to identify what processes are loading the system. Without options, ps gives information about the login session from which it was invoked. If you use ps as user root, you can obtain information about all the system's processes. The most useful options are as follows:

ps options

Option	Reports on:
-e	print information on all processes
-f	generate a full listing
-l	generate a long listing (includes more fields)
-u	print information on a specified user (or users)

With various combinations of the above options you can, amongst other things, find out about the resource usage, priority and state of a process or groups of processes on the system. For example, below is an extract of output after typing ps -el:

    F S    UID   PID  PPID  C PRI NI   ADDR  SZ     WCHAN  TTY      TIME CMD
   31 S      0     0     0  0  95 20   1f21   0  f0299018  ?        0:00 sched
   20 S      0     1     0  0  66 20    252  40  e0000000  ?       30:37 init
   31 S      0     2     0  0  95 20    254   0  f00c687c  ?        0:01 vhand
   31 S      0     3     0  0  81 20    256   0  f00be318  ?        5:19 bdflush
   ...
   20 S      0   204     1  0  76 20    416  96  f023451a  ?        1:56 cron
   20 S      0   441     1  0  75 20    972  44  f01076b8  03       0:00 getty
   20 S  20213  8783     1  0  73 20   1855  48  f011bae4  006      0:04 ksh
   20 S  13079 25014 24908  0  75 20   155c  48  f010ee28  p4       0:01 ksh
   20 R  13079 25016 24910 22  36 20    506 144  f010ed58  p2       0:03 vi
   20 S  12752 27895 26142  0  73 20    7b0  40  f011f75c  010      0:00 sh
   20 Z  13297 25733 25153  0  51 20                                0:00 <defunct>
   20 R  13297 26089 25148 45  28 20    8a8  48  f012123c  p12      0:01 ksh
   20 S  12752 26142     1  0  73 20   1ce2  48  f01214ec  010      0:04 csh
   20 R  12752 28220 27898 55  25 20   1e16 188  f010f6b0  p25      0:01 email
   20 S  12353 27047 25727  0  73 20   161c  44  f012179c  p13      0:00 ksh
   20 O  13585 28248 28205 36  37 20    cc9  92            p23      0:00 ps
   20 S  20213 28240  8783  0  75 20    711 140  f01156f8  006      0:00 vi
   ...

The field headed F gives information about the status of a process as a combination of one or more octal flags. For example, the sched process at the top has a setting of 31 which is the sum of the flags 1, 10 and 20. This means that the sched process is part of the kernel (1), sleeping at a priority of 77 or more (10), and is loaded in primary memory (20). The priority is confirmed by consulting the PRI field further along the line which displays a priority of 95. In fact both sched (the swapper) and vhand (the paging daemon) are inactive but have the highest possible priority. Should either of them need to run in the future they will do so at the context switch following their waking up as no other process will have a higher priority. For more information on the octal flags displayed and their interpretation see ps(C).

The S column shows the state of each process. The states shown in the example: S, R, O and Z mean sleeping (waiting for an event), ready-to-run, on the processor (running) and zombie (defunct) respectively. There is only one process running, which is the ps command itself (see the penultimate line). Every other process is either waiting to run or waiting for a resource to become available. The exception is the zombie process which is currently terminating; this entry will only disappear from the process table if the parent issues a wait(S) system call.

The current priority of a process is also a useful indicator of what a process is doing. Check the value in the PRI field which can be interpreted as shown in the following table:

Priority values

Priority	Meaning
95	swapping/paging
88	waiting for an inode
81	waiting for I/O
80	waiting for buffer
76	waiting for pipe
75	waiting for tty input
74	waiting for tty output
73	waiting for exit
66	sleeping -- lowest system mode priority
65	highest user mode priority
51	default user mode priority
0	lowest user mode priority

Looking back at the above ps output you can see, for example, that the getty process has a priority of 75, as it is (not surprisingly) waiting for some keyboard input. Whereas priority values between 66 and 95 are fixed for a specific action to be taken, anything lower than 66 indicates a user mode process. The running process in the above example (ps) is at priority 37 and is therefore in user mode.

The C field indicates the recent usage of CPU time by a process. This is useful for determining those processes which are making a machine slow currently.

The NI field shows the nice value of a process. This directly affects the calculation of its priority when it is being scheduled. All processes in the above example are running with the default nice value of 20.

The TIME field shows the minutes and seconds of CPU time used by processes. This is useful for seeing if any processes are CPU hogs, or runaway, gobbling up large amounts of CPU time.

The SZ field shows the swappable size of the process's data and stack in 1KB units. This information is of limited use in determining how much memory is currently occupied by a process as it does not take into account how much of the reported memory usage is shared. Totaling up this field for all memory resident processes will not produce a meaningful figure for current memory usage. It is useful on a per process basis as you can use it to compare the memory usage of different versions of an application.