Table of Contents
Understanding How Processes Are Shown
When you work on the command line, you rarely see programs as windows. Instead, you see them as processes. Viewing processes means asking the system what is currently running, who started it, and how it is using resources such as CPU and memory.
This chapter focuses only on tools and options that show you processes. Starting, stopping, and controlling them is covered in other chapters in this section.
A process is typically identified by a number called the process ID, written as PID. Many tools you will use show at least the PID, the user who owns the process, the command that started it, and sometimes CPU and memory usage.
Important: Every running program has a unique PID at any given moment. Many process tools use PIDs as input to select or act on specific processes.
The `ps` Command: A Snapshot of Processes
The most basic tool to view processes is ps. By default, if you run ps with no options, it shows only processes attached to your current terminal. For example, you might see something like this:
psThe output usually contains columns such as PID and the command name. This default view is limited, so you often add options.
On Linux, you will see two main styles of ps options. Some are traditional Unix style, such as ps aux, and some are POSIX style, such as ps -ef. Both show a global list of processes but in a slightly different format.
To see every process on the system in a detailed format, a very common choice is:
ps aux
In many distributions, this output includes columns like the user, PID, CPU usage, memory usage, and the command. The letter a asks for processes that have a terminal, u requests a user oriented format, and x includes processes without a controlling terminal, such as background services.
An alternative that is also very common is:
ps -efThis form shows a full listing for every process. The columns differ slightly, for example you might see PPID, which is the parent process ID. The parent is the process that started another process.
For beginners, you can consider ps aux and ps -ef as two different ways to get a similar global list. You do not need to learn every option at once. Focus on recognizing PIDs and commands.
Searching Within `ps` Output
When many processes are running, the output of ps aux or ps -ef can be long. One practical approach is to combine ps with the grep command to filter the list for a specific program name.
For example, to search for processes related to ssh:
ps aux | grep ssh
This uses a pipeline. ps aux writes a long list of lines, and grep ssh keeps only the lines that contain the text ssh. Often you will also see the grep process itself in the result. That is normal, since the word ssh also appears in the command line of the grep command.
To reduce noise, some people use patterns that avoid matching the grep line, such as:
ps aux | grep '[s]sh'
The important part for this chapter is the idea of combining ps with other commands to make the output more focused.
Formatting `ps` Output
ps can also be told exactly which columns you want to see. This helps when you want a simpler view. For example, you can show just PID and the command:
ps -eo pid,cmd
The option -e selects all processes, and -o controls the output columns. Column names like pid, cmd, user, %cpu, and %mem are commonly used.
You can also sort the result. For example, to sort by CPU usage in descending order:
ps -eo pid,cmd,%cpu --sort=-%cpu
The double hyphen in --sort is part of the option name. A minus sign before a column name means reverse order, so higher values are first.
Rule: Use ps -eo ... to select columns, and --sort=... to order the list without changing which processes are shown.
Using `top` for a Live Process View
While ps shows a snapshot, top shows a live, updating view of processes. It is interactive and runs inside your terminal. To start it, type:
top
top usually refreshes every few seconds. At the top of the screen you see a summary of system load, CPU usage, memory usage, and more. Below that you see a table of processes with columns like PID, user, CPU percentage, memory percentage, and the command.
The list in top is typically sorted by CPU usage, with the most CPU hungry processes at the top. You can change this while top is running. For example, pressing the M key switches sorting to memory usage in many versions of top. Pressing P usually returns to sorting by CPU usage.
To exit top, press q. This returns you to the normal shell prompt.
top also supports filtering and searching, but for now it is enough to understand that it is a constantly updating process viewer, useful for seeing which programs are using the system while you watch.
`htop`: A Friendlier Process Viewer
On many systems, you can install and use htop, which is a more graphical process viewer for the terminal. It shows colored bars, makes it easier to scroll with arrow keys, and allows you to search and sort with function keys.
Once it is installed, you start it with:
htop
Like top, it refreshes regularly. You can scroll up and down through the process list, and left and right to see more columns. Often there is a shortcut menu at the bottom of the screen showing function key labels such as F3 for search, F6 for sort, and F10 to quit.
The details of key bindings can vary slightly by version, so read the hints on screen. For this chapter, the main idea is that htop is an alternative to top that many users find easier to read and navigate.
Viewing Processes for a Single User
Sometimes you only care about processes that belong to a specific user. You can ask ps to filter by user directly.
To see all processes for your current user, run:
ps -u "$USER"
Here $USER is an environment variable that holds your username. The -u option selects processes that belong to that user. You can also specify a name explicitly, for example:
ps -u alice
This shows only processes that the user alice owns, if such a user exists on the system.
You can also use top in user mode. One simple method is:
top -u alice
This starts top with a filter that keeps only processes belonging to user alice. To stop this filter in an interactive top session, there is a special key sequence, but the exact detail belongs to interactive usage which you will explore by experimentation or by using help within top.
Showing the Process Tree
Processes are not isolated. Many of them are started by other processes. To see this structure, you can use a tree view. Some systems provide the pstree command. When installed, you can run:
pstreeThe result is a visual tree where indentation or branching shows which processes started which other processes. At the top you often see the first process that the kernel started after boot, and below it many child processes.
To see PIDs next to each process in the tree, many versions support an option such as:
pstree -pIn this view, you can see both the hierarchy and the numeric PIDs. This is useful when you want to understand which processes are related, especially when looking at server daemons and their helper processes.
Filtering and Paging Process Lists
When a process list is long, it scrolls out of sight quickly. A common technique is to view the list through a pager program, such as less. For example:
ps aux | less
Here, ps aux writes the full list, and less allows you to scroll up and down using arrow keys or Page Up and Page Down. You can quit less with the q key.
You can also search while inside less. Typing /word searches for word forward. This is similar to how you searched with grep, but now the searching happens within the viewer.
Combining the commands in this way keeps long process lists manageable, especially on multi user or server systems.
Linking PIDs With Commands
When you view processes, the link between the PID and the command line is essential. If you later use a command that needs a PID, such as a tool that sends signals to a process, you obtain the PID from one of the viewers described here.
For example, if you want to know the PID of all firefox processes, you can use:
ps -C firefox
In many implementations, -C selects processes by command name. The output shows the PIDs of all matching processes. Another common utility that focuses only on PIDs is pgrep. Typing:
pgrep firefox
prints one PID per line for all processes whose name matches firefox. In this chapter, it is enough to understand that there are tools that specialize in mapping names to PIDs. Using them well becomes important when you start to manage and control processes explicitly.
Key idea: First use a viewer such as ps, top, htop, or pstree to identify processes and their PIDs, then use other commands to act on them if needed.
By learning these viewing tools, you gain the ability to see what is running and how it behaves in real time, which is the foundation for all later work with processes.