WCC logo

CIS120Linux Fundementals

ps and top Commands

Lesson: Understanding the ps and top Commands in Linux

In Linux, monitoring system processes is crucial for managing system performance and troubleshooting issues. The ps and top commands are essential tools for this task, providing detailed information about running processes. Understanding these commands and their options allows administrators to efficiently manage system resources.

The ps Command

The ps (process status) command is used to display information about active processes. It provides a snapshot of the current processes, allowing users to see details such as process IDs (PIDs), CPU and memory usage, and the commands that started the processes.

Basic usage of ps:

ps

This command displays information about the processes running in the current shell session.

Common options for ps:

Option Description
-e Show information about all processes.
-f Display full format listing (detailed).
-u Display processes for a specific user.
-l Display long format listing.
-aux Show all processes with detailed information.
--sort Sort processes based on a specified field.

Examples of ps usage:

To display all processes:

ps -e

Output:

  PID TTY          TIME CMD
    1 ?        00:00:02 systemd
    2 ?        00:00:00 kthreadd
    3 ?        00:00:00 rcu_gp
    ...

To display detailed information about all processes:

ps -ef

Output:

UID          PID    PPID  C STIME TTY          TIME CMD
root           1       0  0 14:19 ?        00:00:02 /sbin/init
root           2       0  0 14:19 ?        00:00:00 [kthreadd]
root           3       2  0 14:19 ?        00:00:00 [rcu_gp]
...

To display processes for a specific user:

ps -u alice

Output:

  PID TTY          TIME CMD
 1234 ?        00:00:00 bash
 2345 ?        00:00:01 firefox
 ...

To display processes in long format:

ps -l

Output:

F S UID        PID  PPID  C PRI  NI ADDR SZ WCHAN  TTY          TIME CMD
4 S root         1     0  0  80   0 -  5466 -      ?        00:00:02 systemd
1 S root         2     0  0  80   0 -     0 -      ?        00:00:00 kthreadd
1 S root         3     2  0  80   0 -     0 -      ?        00:00:00 rcu_gp
...

To show all processes with detailed information:

ps aux

Output:

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.1 169936  1232 ?        Ss   14:19   0:02 /sbin/init
root         2  0.0  0.0      0     0 ?        S    14:19   0:00 [kthreadd]
root         3  0.0  0.0      0     0 ?        I<   14:19   0:00 [rcu_gp]
...

To sort processes by CPU usage:

ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%cpu

Output:

  PID  PPID CMD                         %MEM %CPU
 2345     1 /usr/bin/firefox             2.3 10.5
 1234     1 /usr/bin/bash                0.1  1.0
 ...

Columns in ps Command Output

Column Description
PID Process ID, a unique identifier for each process.
TTY Terminal type associated with the process.
TIME Cumulative CPU time used by the process.
CMD Command that initiated the process.
UID User ID of the process owner.
PPID Parent process ID.
%CPU Percentage of CPU time used by the process.
%MEM Percentage of physical memory used by the process.
C CPU utilization of the process.
STIME Start time of the process.
VSZ Virtual memory size of the process.
RSS Resident Set Size, the non-swappable physical memory used by the process.
STAT Process state code.

Here is a list of the common Process state codes ps:

Code Description
R Running or runnable (on run queue)
S Sleeping (waiting for an event to complete)
D Uninterruptible sleep (usually waiting for I/O)
Z Zombie (terminated but not reaped by parent)
T Stopped, either by a job control signal or because it is being traced
t Stopped by debugger during the tracing
X Dead (should never be seen)
K Wakekill (woken up by a fatal signal while in an uninterruptible sleep)
W Paging (not valid since Linux 2.6.x)
P Parked (used by real-time threads that are parked)
I Idle kernel thread
L Locked (process is waiting for CPU lock or I/O operation to finish)
< High-priority process (has a real-time priority or is in high-priority scheduling class)
N Low-priority process (has a lower priority than normal)
s Session leader (a process that is a session leader)
l Multi-threaded (using CLONE_THREAD, so that it shares the thread group)
+ Process is in the foreground process group

This format makes the process state codes stand out for easier reference.

The top Command

The top command provides a real-time, dynamic view of the system's running processes. It continuously updates the display, showing which processes are using the most system resources. top is highly configurable and allows users to sort and filter processes based on various criteria.

Basic usage of top:

top

This command opens the top interface, displaying information about the most resource-intensive processes.

Common options for top:

Option Description
-d Set the delay between updates (in seconds).
-u Show processes for a specific user.
-p Monitor specific PIDs.
-n Number of iterations before top exits.
-b Run top in batch mode (useful for logging).
-o Sort processes based on a specified field.

Examples of top usage:

To run top with the default settings:

top

Output:

top - 14:29:03 up  1:10,  2 users,  load average: 0.48, 0.34, 0.23
Tasks: 193 total,   1 running, 192 sleeping,   0 stopped,   0 zombie
%Cpu(s):  1.0 us,  0.5 sy,  0.0 ni, 98.0 id,  0.0 wa,  0.0 hi,  0.5 si,  0.0 st
KiB Mem :  8000224 total,  3145752 free,  2392308 used,  2462164 buff/cache
KiB Swap:  8191996 total,  8191996 free,        0 used.  5062348 avail Mem

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND
 2345 alice     20   0 2674292 473240 100768 S  10.5  5.9   1:23.45 firefox
 1234 bob       20   0   43456   3824   3236 S   1.0  0.1   0:00.75 bash
...

To set the delay between updates to 5 seconds:

top -d 5

To show processes for a specific user:

top -u alice

Output:

top - 14:31:12 up  1:12,  2 users,  load average: 0.42, 0.32, 0.22
Tasks:  13 total,   1 running,  12 sleeping,   0 stopped,   0 zombie
%Cpu(s):  1.2 us,  0.3 sy,  0.0 ni, 98.0 id,  0.0 wa,  0.0 hi,  0.5 si,  0.0 st
KiB Mem :  8000224 total,  3145752 free,  2392308 used,  2462164 buff/cache
KiB Swap:  8191996 total,  8191996 free,        0 used.  5062348 avail Mem

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND
 2345 alice     20   0 2674292 473240 100768 S  10.5  5.9   1:23.45 firefox
...

To monitor specific PIDs:

top -p 1234,5678

Output:

top - 14:32:45 up  1:14,  2 users,  load average: 0.35, 0.31, 0.21
Tasks:   2 total

,   1 running,   1 sleeping,   0 stopped,   0 zombie
%Cpu(s):  0.7 us,  0.3 sy,  0.0 ni, 99.0 id,  0.0 wa,  0.0 hi,  0.0 si,  0.0 st
KiB Mem :  8000224 total,  3145752 free,  2392308 used,  2462164 buff/cache
KiB Swap:  8191996 total,  8191996 free,        0 used.  5062348 avail Mem

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND
 1234 bob       20   0   43456   3824   3236 S   1.0  0.1   0:00.75 bash
 5678 charlie   20   0  123456  5678    678 S   0.0  0.1   0:00.05 someprocess

To run top for a specific number of iterations:

top -n 10

To run top in batch mode for logging:

top -b -n 1 > top_output.txt

To sort processes by memory usage:

top -o %MEM

Output:

top - 14:34:19 up  1:16,  2 users,  load average: 0.30, 0.28, 0.20
Tasks: 193 total,   1 running, 192 sleeping,   0 stopped,   0 zombie
%Cpu(s):  1.0 us,  0.5 sy,  0.0 ni, 98.0 id,  0.0 wa,  0.0 hi,  0.5 si,  0.0 st
KiB Mem :  8000224 total,  3145752 free,  2392308 used,  2462164 buff/cache
KiB Swap:  8191996 total,  8191996 free,        0 used.  5062348 avail Mem

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND
 2345 alice     20   0 2674292 473240 100768 S  10.5  5.9   1:23.45 firefox
 6789 bob       20   0 1234567 234567  34567 S   1.0  3.0   0:12.34 someotherprocess
...

Columns in top Command Output

Column Description
PID Process ID, a unique identifier for each process.
USER User who owns the process.
PR Priority of the process.
NI Nice value, which affects the process priority.
VIRT Virtual memory size used by the process.
RES Resident Set Size, the non-swappable physical memory used by the process.
SHR Shared memory size used by the process.
S Process state (e.g., running, sleeping).
%CPU Percentage of CPU time used by the process.
%MEM Percentage of physical memory used by the process.
TIME+ Total CPU time used by the process.
COMMAND Command that started the process.

Explanation of Fields

Header Information

Field Description
top - 14:34:19 Current time when top was run.
up 1:16 System uptime, showing how long the system has been running.
2 users Number of users currently logged into the system.
load average: 0.30, 0.28, 0.20 System load averages for the last 1, 5, and 15 minutes.

Task Information

Field Description
Tasks: 193 total Total number of tasks (processes) currently managed by the system.
1 running Number of tasks currently running.
192 sleeping Number of tasks currently sleeping (inactive but not stopped).
0 stopped Number of tasks currently stopped (halted).
0 zombie Number of zombie tasks (terminated but not reaped by parent).

CPU Usage Information

Field Description
%Cpu(s): Overview of CPU usage breakdown.
1.0 us Percentage of CPU time spent in user space.
0.5 sy Percentage of CPU time spent in kernel space (system).
0.0 ni Percentage of CPU time spent on low-priority processes.
98.0 id Percentage of CPU time spent idle.
0.0 wa Percentage of CPU time spent waiting for I/O operations to complete.
0.0 hi Percentage of CPU time spent handling hardware interrupts.
0.5 si Percentage of CPU time spent handling software interrupts.
0.0 st Percentage of CPU time stolen from a virtual machine.

Memory Usage Information

Field Description
KiB Mem : Overview of physical memory usage.
8000224 total Total amount of physical memory.
3145752 free Amount of free memory.
2392308 used Amount of used memory.
2462164 buff/cache Amount of memory used for buffers and cache.

Swap Usage Information

Field Description
KiB Swap: Overview of swap memory usage.
8191996 total Total amount of swap space.
8191996 free Amount of free swap space.
0 used Amount of used swap space.
5062348 avail Mem Amount of memory available for starting new applications, without swapping.

Summary

The ps and top commands are powerful tools for monitoring and managing system processes in Linux. ps provides a static snapshot of current processes, offering various options for detailed views and sorting. top offers a dynamic, real-time view, allowing users to interactively monitor and manage processes. By mastering these commands and their options, administrators can effectively manage system resources and ensure optimal performance.