ps Cheatsheet - Linux Process Management Reference
Locating a process, finding what is eating memory, or obtaining a PID to pass to kill almost always starts with ps. The sheet is organised into basic viewing, filtering, custom output, process trees, threads and common scenarios, and its central concern is the difference between the BSD and System V dialects. ps aux reports user, PID, CPU%, memory%, VSZ, RSS, TTY, state and command, while ps -ef selects all processes with -e and prints a full-format line; both see everything, but the columns differ. Choosing one and staying with it matters more than learning both. To find memory consumers use --sort=-%mem, and the trap to avoid is confusing RSS with VSZ: RSS is resident memory in kilobytes, mixing them is the main source of wrong answers to "how much is this using". Process trees expose parent-child relationships, and a zombie in state Z cannot be killed, so the parent must be dealt with or the host restarted.
Basic View 6
psps auxps -efps -eps -fps -lFilter 7
ps -p 1234ps -p 1234,5678ps -u usernameps -U usernameps -g groupnameps -C nginxps --ppid 1234Custom Format 7
ps -eo pid,comm,userps -eo pid,ppid,comm,%cpu,%memps -eo pid,comm,etimeps -eo pid,comm,statps aux --sort=-%cpups aux --sort=%memps aux --sort=-rssProcess Tree 5
ps -ejHps axjfpstreepstree -ppstree -uThreads 4
ps -eLfps -p 1234 -Lps -eTps -H -p 1234Common Patterns 6
ps aux | grep nginxps aux --sort=-%cpu | headps aux --sort=-%mem | headps -ef | grep defunctps -eo pid,comm,etime | grep -v defunctps -u username -o pid,comm,%cpu,%memCommand Examples
Print the five busiest CPU processes
ps aux --sort=-%cpu | head -6--sort 支持 -key 降序、key 升序。管道接 head 就能拿到 Top N，不必进交互式 top。
Output
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.1 168404 12164 ? Ss Aug29 0:03 systemd tom 3120 48.2 8.1 1258300 318204 ? Sl 10:12 2:14 node
Inspect the process tree to find the parent
pstree -p $(pgrep -f "node server.js")pstree -p 显示 PID，能直观看出父进程是谁。排查「进程被谁启动的」「为什么杀了又起」这类问题时比 ps -ef 更直观。
Output
bash [1201] ├─ node [3120] │ └─ node [3121] └─ pm2 [1200]
Order by the exact column you care about
ps -eo pid,ppid,comm,%cpu,%mem --sort=-%cpu | head -10-eo 自定义列，输出干净可控；加 ppid 能看出进程父子关系。ps aux 里那串长路径和启动参数对排序没有帮助。
Output
PID PPID COMMAND %CPU %MEM 3120 1200 node 48.2 8.1 1452 840 chrome 18.2 12.4 2031 1200 electron 12.7 6.8
Common Pitfalls
- ps aux | grep xxx also matches the grep process itself; add grep -v grep or use pgrep.
- ps shows only an instantaneous snapshot — use top -d or sar for sustained high usage.
- kill sends SIGTERM for a graceful shutdown; -9 is SIGKILL and can lose unsaved data.
- Zombie processes have already-dead parents, so killing the child does nothing — the parent or a reboot must reap them.
- ps -ef and ps aux are different output formats with different columns; mixing them in scripts invites parse errors.
Tips
- Both ps aux and ps -ef list all processes; aux is BSD style, -ef is System V style.
- ps is a snapshot; top/htop show live data.
- Zombie state is Z; you can't kill it — kill its parent or reboot.
Official References
Each command links to its official documentation below, so you can verify the latest usage and read deeper.
Maintained by LaoHand
Publicly updated on Jul 21, 2026, continuously proofread against official docs.
Contact Us
Wrong command or description? Send us corrections, business inquiries or product feedback by email.
Contact Us