Viewing processes

In this chapter you’ll learn how to see what is currently running on your system from the command line. The goal isn’t to master processes in depth (that’s for the parent chapter), but to become comfortable with the most common tools for listing and inspecting them.

We’ll focus on:

Seeing all running processes.
Filtering and searching for specific processes.
Viewing process trees and relationships.
Inspecting details like CPU, memory, and the user that owns a process.

The most common tools

The main commands you’ll use to view processes are:

ps — snapshot of processes
top — live updating view (interactive)
htop — nicer, more interactive top (often not installed by default)
pgrep — search for processes by name or other properties
pstree — show processes as a tree

You don’t need to memorize everything; pick 1–2 tools to start with (usually ps and top), then expand as you get comfortable.

Using `ps`: snapshot of processes

ps shows a snapshot of processes at the exact moment you run it. It does not update by itself.

Basic usage

Run ps with no options:

ps

Typical output:

  PID TTY          TIME CMD
 1234 pts/0    00:00:00 bash
 1278 pts/0    00:00:00 ps

Common columns:

PID — process ID (unique number for each process)
TTY — terminal associated with the process
TIME — total CPU time used by the process
CMD — command used to start the process

By default, ps only shows processes attached to your current terminal, which is often not what you want when exploring.

Showing all processes: `ps aux`

One of the most common ways to use ps is:

ps aux

This is a BSD-style syntax; don’t worry about the naming, just remember ps aux.

Typical output:

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.1 170740  8824 ?        Ss   09:24   0:03 /sbin/init
user      1324  0.2  1.2 274828 50340 ?        Sl   09:25   0:10 /usr/bin/gnome-shell
user      2890  0.0  0.1  21240  3956 pts/0    Ss   09:30   0:00 bash
user      2935  0.0  0.0  11492  2128 pts/0    R+   09:30   0:00 ps aux

Important columns here:

USER — user that owns the process
PID — process ID
%CPU — CPU usage percentage
%MEM — memory usage percentage
STAT — process state (e.g., Sleeping, Running, Zombie; + and extra letters give more info)
COMMAND — full command line

Memorize ps aux as “show everything in a big list”.

Linux-style `ps` options: `ps -ef`

Another very common variant:

ps -ef

This uses “UNIX (SysV) style” options. -e means “all processes”, -f means “full format”.

Example:

UID        PID  PPID  C STIME TTY          TIME CMD
root         1     0  0 09:24 ?        00:00:03 /sbin/init
user      1324  1200  2 09:25 ?        00:00:10 /usr/bin/gnome-shell
user      2890  2889  0 09:30 pts/0    00:00:00 bash
user      2950  2890  0 09:31 pts/0    00:00:00 ps -ef

Notable columns:

PPID — parent process ID (which process started this one)
C — CPU usage (simplified indicator)
STIME — when the process started

You can use either ps aux or ps -ef. Both are widely used; choose one style and stick with it at first.

Filtering `ps` output with `grep`

Usually you don’t want to scroll through hundreds of lines. Combine ps with grep to search for matching lines.

Example: find processes related to Firefox:

ps aux | grep firefox

You may see a line for the grep command itself. To avoid that, a common trick is to bracket one letter:

ps aux | grep [f]irefox

The shell expands [f]irefox to firefox, but the grep process name no longer matches its own pattern.

You can also filter by user:

ps aux | grep '^user '

This shows only processes whose USER field starts with user .

Viewing process trees with `ps` and `pstree`

Processes are arranged in a parent–child hierarchy. To see this relationship, you can use ps with special options or use pstree.

`ps` tree view: `ps axjf` (or `ps -ejH`)

On many systems, this shows a tree:

ps axjf

Look for indentation that shows which processes were started by which parents.

Alternatively, you might see:

ps -ejH

The exact options that work best can vary slightly by distribution, but the idea is the same: show hierarchy.

`pstree`: dedicated process tree viewer

pstree displays processes in a tree-like format. It may not be installed by default; install via your package manager if needed.

Basic usage:

pstree

Or to show PIDs as well:

pstree -p

And to see all processes including those not attached to terminals:

pstree -a

Tree views are especially helpful when you want to understand what started a given process, or how many child processes it has.

Interactive process viewing with `top`

top is a real-time process viewer. It keeps updating until you quit.

Start top:

top

You’ll see:

A summary section at the top (CPU, memory usage, load averages).
A table of processes below.

Common keys inside top (you *press these while top is running`):

q — quit
h — help (shows available commands)
P — sort by CPU usage (capital P)
M — sort by memory usage (capital M)
u — filter by user (you’ll be prompted for a username)
k — send a signal (usually to kill a process; you’ll be asked for a PID and signal)
1 — toggle showing individual CPU cores (on multi-core systems)

You don’t need to remember everything; knowing how to quit (q) and sort (P/M) is already useful.

Limiting what `top` shows

You can start top showing only your own processes:

top -u yourusername

Or limit the number of processes listed, for example the top 10 by default sort order:

top -n 1 -b | head -n 20

Here:

-b — batch mode (non-interactive)
-n 1 — run 1 iteration and exit
head -n 20 — show only the first 20 lines

Batch mode is useful when you want to capture top output into a file or script.

`htop`: a friendlier alternative to `top`

htop is like top but more colorful and interactive. On many distributions it’s not installed by default.

Install it (examples):

Debian/Ubuntu: sudo apt install htop
Fedora: sudo dnf install htop
Arch: sudo pacman -S htop

Run:

htop

Features:

Use arrow keys to move around the list.
Function keys (F1–F10) control help, filtering, sorting, killing processes, etc.
You can sort by any column by clicking (in some terminals) or by using the F6 key.

While htop is very convenient, be aware that top is more universally available, especially on minimal or server systems.

Searching for processes with `pgrep`

Instead of ps | grep, pgrep gives you a cleaner way to find processes and return their PIDs only.

Basic usage:

pgrep firefox

This prints the PIDs of all processes whose name matches firefox.

To see the command line too:

pgrep -a firefox

Common options:

-u user — only match processes owned by a specific user:

  pgrep -u user bash

-x — match the exact name (no partial matches):

  pgrep -x sshd

You’ll often use pgrep together with other commands, for example:

kill $(pgrep -x myprogram)

(Details about kill belong to the “Killing processes” chapter; here we just show how viewing and searching integrates.)

Viewing detailed info for a specific PID

Once you know a PID (e.g., from ps or pgrep), you can ask ps for more detail:

ps -p 1234 -f

Here:

-p 1234 — select process with PID 1234
-f — full format

Or, if using BSD syntax:

ps aux | grep ' 1234 '

(Watch out for matching other numbers; -p is safer.)

You can also customize columns:

ps -p 1234 -o pid,ppid,user,%cpu,%mem,cmd

Where -o lets you specify exactly which columns to show.

Common viewing scenarios

Here are some typical “recipes” when working with processes:

List all processes owned by your user

ps -u $USER

Or:

ps aux | grep "^$USER "

See the most CPU-hungry processes

With ps:

ps aux --sort=-%cpu | head

With top (interactive):

Start top
Press P to sort by CPU

See the most memory-hungry processes

With ps:

ps aux --sort=-%mem | head

With top:

Start top
Press M to sort by memory

Show process tree for a specific program

With pstree:

pstree -p | grep -i firefox

Or list the full tree and visually locate the program. On some systems you might need:

pstree -ap

Find all processes listening on a port (preview)

The full details of network tools belong to networking chapters, but it’s common to combine process viewing with networking info. On many systems:

ss -tulpn

shows listening sockets along with pid/program-name.

Summary

At this point you should be able to:

Use ps aux or ps -ef to list all processes.
Pipe ps to grep to narrow down results.
View processes as a tree with ps or pstree.
Use top (and optionally htop) to monitor processes interactively.
Use pgrep to quickly find PIDs by name.
Ask ps for detailed information about specific processes using -p and -o.

In later chapters, you’ll use these viewing tools together with commands for controlling and managing processes. For now, practice running these commands, reading their output, and answering simple questions like: