ps — display
ps utility displays information about
active processes. When given no options,
information about processes of the current user that have a controlling
The information displayed is selected based on a set of keywords
(and for even more control, see the
-o options). The
default output format includes, for each process, the process's ID,
controlling terminal, state, CPU time (including both user and system time),
and associated command.
The options are as follows:
- Display information about processes for all users, including those without
- Display information about processes for all users with controlling
- Do not display full command with arguments, but only the executable name.
This may be somewhat confusing; for example, all
sh(1) scripts will show as
- Display the environment as well.
- Also display information about kernel visible threads.
- Repeat the information header as often as necessary to guarantee one
header per page of information.
- Print information associated with the following keywords: user, pid, ppid,
pgid, sess, jobc, state, tt, time, and command.
- Also display information about kernel threads.
- List the set of available keywords. This option should not be specified
with other options.
- Display information associated with the following keywords: uid, pid,
ppid, cpu, pri, nice, vsz, rss, wchan, state, tt, time, and command.
- Extract values associated with the name list from the specified core
instead of the running kernel.
- Sort by memory usage, instead of by start time ID.
- Extract the name list from the specified system instead of the running
- Add the information associated with the space or comma separated list of
keywords specified, after the process ID, in the default information
display. Keywords may be appended with an equals sign (‘=’)
and a string. This causes the printed header to use the specified string
instead of the standard header.
- Display information associated with the space or comma separated list of
keywords specified. Keywords may be appended with an equals sign
(‘=’) and a string. This causes the printed header to use
the specified string instead of the standard header.
- Display information associated with the specified process ID.
- Sort by current CPU usage, instead of by start time ID.
- Change the way the process time is calculated by summing all exited
children to their parent process.
- Display information about processes attached to the device associated with
the standard input.
- Display information about processes attached to the specified terminal
- Display the processes belonging to the specified
- Display information associated with the following keywords: user, pid,
%cpu, %mem, vsz, rss, tt, state, start, time, and command. The
-u option implies the
- Display information associated with the following keywords: pid, state,
time, sl, re, pagein, vsz, rss, lim, tsiz, %cpu, %mem, and command. The
-v option implies the
- When not using the running kernel, extract swap information from the
- Use 132 columns to display information, instead of the default, which is
the window size. If the
-w option is specified
more than once,
ps will use as many columns as
necessary without regard for window size.
- Display information about processes without controlling terminals.
The following is a complete list of the available keywords and
their meanings. Several of them have aliases, which are also noted.
pcpu. The CPU utilization of the process;
this is a decaying average over up to a minute of previous (real) time.
Since the time base over which this is computed varies (since processes
may be very young) it is possible for the sum of all
%cpu fields to exceed 100%.
pmem. The percentage of real memory used by
acflg. Accounting flag.
args. Command and arguments.
- Short-term CPU usage factor (for scheduling).
- CPU ID (zero on single processor systems).
- Current working directory.
- Data size, in Kilobytes.
- Name of system call emulation environment.
- Elapsed time since the process was started.
f. The thread flags (in hexadecimal), as
defined in the include file
P_INKTR 0x1 writing ktrace(2) record
P_PROFPEND 0x2 this thread needs SIGPROF
P_ALRMPEND 0x4 this thread needs SIGVTALRM
P_SIGSUSPEND 0x8 need to restore before-suspend mask
P_CANTSLEEP 0x10 this thread is not permitted to sleep
P_SELECT 0x40 selecting; wakeup/waiting danger
P_SINTR 0x80 sleep is interruptible
P_SYSTEM 0x200 system process: no sigs, stats, or
P_TIMEOUT 0x400 timing out during sleep
P_WEXIT 0x2000 working on exiting
P_OWEUPC 0x8000 profiling sample needs recording
P_SUSPSINGLE 0x80000 need to suspend for single threading
P_CONTINUED 0x800000 thread has continued after a stop
P_THREAD 0x4000000 not the original thread
P_SUSPSIG 0x8000000 stopped because of a signal
P_SOFTDEP 0x10000000 stuck processing softdep worklist
P_CPUPEG 0x40000000 do not move to another cpu
- Effective group.
- Text name of effective group ID.
inblock. Total blocks read.
- Job control count.
- Tracing flags.
- Tracing vnode.
- The soft limit on memory used, specified via a call to
login. Login name of user who started the
- The exact time the command started, using the “%c” format
described in strftime(3).
- Total page faults.
- Maximum resident set size (in 1024 byte units).
- Total page reclaims.
- Total messages received (reads from pipes/sockets).
- Total messages sent (writes on pipes/sockets).
ni. The process scheduling increment (see
- Total involuntary context switches.
nsignals. Total signals taken.
- Total swaps in/out.
- Total voluntary context switches.
- Wait channel (as an address).
oublock. Total blocks written.
- Resource usage (valid only for zombie processes).
- Swap address.
- Pageins (same as
- Process group number.
- Process ID.
- Comma separated list of active
- Parent process ID.
- Scheduling priority.
- The process flags (in hexadecimal), as defined in the include file
PS_CONTROLT 0x1 process has a controlling
PS_EXEC 0x2 process called exec(3)
PS_INEXEC 0x4 process is doing an exec right
PS_EXITING 0x8 process is exiting
PS_SUGID 0x10 process had set ID privileges
since last exec
PS_SUGIDEXEC 0x20 last exec(3) was set[ug]id
PS_PPWAIT 0x40 parent is waiting for process
PS_ISPWAIT 0x80 process is parent of PPWAIT
PS_PROFIL 0x100 process has started profiling
PS_TRACED 0x200 process is being traced
PS_WAITED 0x400 debugging process has waited
PS_COREDUMP 0x800 busy coredumping
PS_SINGLEEXIT 0x1000 other threads must die
PS_SINGLEUNWIND 0x2000 other threads must unwind
PS_NOZOMBIE 0x4000 pid 1 waits for me instead of
PS_STOPPED 0x8000 just stopped, need to send
PS_SYSTEM 0x10000 No signals, stats or swapping
PS_EMBRYO 0x20000 New process, not yet fledged
PS_ZOMBIE 0x40000 Dead and ready to be waited for
PS_NOBROADCASTKILL 0x80000 Process excluded from kill -1
PS_PLEDGE 0x100000 process has called pledge(2)
- Core residency time (in seconds; 127 = infinity).
- Real group ID.
- Text name of real group ID.
- Reverse link on run queue, or 0.
- The real memory (resident set) size of the process (in 1024 byte
rssize. Resident set size + (text size /
text use count).
- Routing table.
- Real user ID.
- User name (from
- Session pointer.
pending. Pending signals.
caught. Caught signals.
ignored. Ignored signals.
blocked. Blocked signals.
- Sleep time (in seconds; 127 = infinity).
- Stack size, in Kilobytes.
- The time the command started. If the command started less than 24 hours
ago, the start time is displayed using the “%l:%M%p” format
described in strftime(3). If the
command started less than 7 days ago, the start time is displayed using
the “%a%I%p” format. Otherwise, the start time is displayed
using the “%e%b%y” format.
stat. The state is given by a sequence of
letters, for example, “RWN”. The first letter indicates the
run state of the process:
- Marks a process in disk (or other short term, uninterruptible)
- Marks a process that is idle (sleeping for longer than about 20
- Marks a runnable process.
- Marks a process that is sleeping for less than about 20 seconds.
- Marks a stopped process.
- Marks a dead process (a “zombie”).
Additional characters after these, if any, indicate additional
- The process is in the foreground process group of its control
- The process has a raised CPU scheduling priority (see
- The process has specified a soft limit on memory requirements and is
currently exceeding that limit; such a process is (necessarily) not
- The process is trying to exit.
- The process is a kernel thread.
- The process has a reduced CPU scheduling priority.
- The process has called
- The process is a session leader.
- The process has unveiled, and
unveil(2) is now locked.
- The process has unveiled, but not yet locked
unveil(2) (could be a program
- The process is suspended during a
- The process is being traced or debugged.
- On multiprocessor machines, specifies processor number
- Saved GID from a setgid executable.
- Saved UID from a setuid executable.
- Control terminal device number.
- Thread ID. Used together with
cputime. Accumulated CPU time, user +
- Control terminal process group ID.
- Control terminal session pointer.
- Text size, in Kilobytes.
- An abbreviation for the pathname of the controlling terminal, if any. The
abbreviation consists of the two letters following
“/dev/tty”, or, for the console, “co”. This is
followed by a ‘-’ if the process can no longer reach that
controlling terminal (i.e. it has been revoked).
- Full name of control terminal.
comm. Name to be used for accounting.
- Effective user ID.
usrpri. Scheduling priority on return from
- User name (from
vsize. Virtual size, in Kilobytes.
- The event (an address in the system) on which a process waits. When
printed numerically, the initial part of the address is trimmed off and
the result is printed in hex; for example, 0x80324000 prints as
- Exit or stop status (valid only for stopped or zombie process).
The following environment variables affect the execution of
- If set to a positive integer, output is formatted to the given width in
ps defaults to the terminal
width minus 1. If none of
stdin are a
terminal, 79 columns are used.
- The character encoding locale(1). It
decides which byte sequences form characters, which characters are
printable, and what their display width is. If unset or set to
"C", "POSIX", or an unsupported value, only printable
ASCII characters are printed. Tabs, newlines, non-printable ASCII
characters, and non-ASCII bytes are encoded with
vis(3). If UTF-8 output is enabled, valid
characters that are not printable are replaced with the Unicode
replacement character U+FFFD. These rules for example apply to command
names, arguments, and environments and to directory, user, and group
- The time zone to use when displaying dates. See
environ(7) for more information.
- special files and device names
- system namelist database
- /dev name database
ps utility exits 0 on success,
and >0 if an error occurs.
Display information on all system processes:
$ ps -auxw
ps utility is compliant with the
IEEE Std 1003.1-2008 (“POSIX.1”)
specification, except that the flag [
unsupported and the flags [
-ptU] support only single
arguments, not lists.
The flags [
-defglnu] are marked by
IEEE Std 1003.1-2008 (“POSIX.1”) as
being an X/Open System Interfaces option. Of these,
-dfgn] are not supported by this implementation of
ps; behaviour for the flags
-elu] differs between this implementation and the
X/Open System Interfaces option of IEEE Std 1003.1-2008
The flags [
extensions to IEEE Std 1003.1-2008
Only the following keywords are recognised by
IEEE Std 1003.1-2008 (“POSIX.1”):
ps command first appeared in
Version 3 AT&T UNIX.
When printing using the
command keyword, a
process that has exited and has a parent that has not yet waited for the
process (in other words, a zombie) is listed as
“⟨defunct⟩”, and a process which is blocked
while trying to exit is listed as “⟨exiting⟩”.
ps makes an educated guess as to the file name and
arguments given when the process was created by examining memory or the swap
area. The method is inherently somewhat unreliable and in any event a
process is entitled to destroy this information, so the names cannot be
depended on too much. The
ucomm (accounting) keyword
can, however, be depended on.
The information displayed is only a snapshot of a constantly