ps Cheatsheet - Linux Process Management Reference

Can't see a process, wondering who ate the memory, need a PID — ps is the first step for all of these. Knowing the difference between BSD-style aux and System-V-style -ef, then pairing grep, --sort, and -o custom columns, lets you filter precisely from the noise.

SysOps·35 commands·Last updated 2026-07-21

Basic View 6

ps
Processes in the current terminal
ps aux
All processes (BSD style)
ps -ef
All processes (System V style)
ps -e
All processes
ps -f
Full-format output
ps -l
Long-format output

Filter 7

ps -p 1234
Process by PID
ps -p 1234,5678
Multiple PIDs
ps -u username
Processes of a user (effective)
ps -U username
Processes of a real user
ps -g groupname
Processes of a group
ps -C nginx
Processes by command name
ps --ppid 1234
Child processes of a parent PID

Custom Format 7

ps -eo pid,comm,user
Select output columns
ps -eo pid,ppid,comm,%cpu,%mem
PID, parent, command, CPU and memory
ps -eo pid,comm,etime
Process elapsed time
ps -eo pid,comm,stat
Process state
ps aux --sort=-%cpu
Sort by CPU usage, descending
ps aux --sort=%mem
Sort by memory usage, ascending
ps aux --sort=-rss
Sort by resident memory, descending

Process Tree 5

ps -ejH
Show process tree (System V style)
ps axjf
Show process tree (BSD style)
pstree
Show process tree (needs psmisc)
pstree -p
Process tree with PIDs
pstree -u
Process tree with users

Threads 4

ps -eLf
Show all threads
ps -p 1234 -L
Threads of a given process
ps -eT
Show thread IDs
ps -H -p 1234
Thread hierarchy of a process

Common Patterns 6

ps aux | grep nginx
Find nginx processes
ps aux --sort=-%cpu | head
Top CPU consumers
ps aux --sort=-%mem | head
Top memory consumers
ps -ef | grep defunct
Find zombie processes
ps -eo pid,comm,etime | grep -v defunct
Non-zombie processes with elapsed time
ps -u username -o pid,comm,%cpu,%mem
A user's process resource usage

Tips

  • Both ps aux and ps -ef list all processes; aux is BSD style, -ef is System V style.
  • ps is a snapshot; top/htop show live data.
  • Zombie state is Z; you can't kill it — kill its parent or reboot.

Official References

Each command links to its official documentation below, so you can verify the latest usage and read deeper.

Maintained by LaoHand

Publicly updated on Jul 21, 2026, continuously proofread against official docs.

Contact Us

Wrong command or description? Send us corrections, business inquiries or product feedback by email.

Contact Us