ps Cheatsheet - Filters, Columns & Process Tree
Locating a process, finding what is eating memory, or obtaining a PID to pass to kill almost always starts with ps. The sheet is organised into basic viewing, filtering, custom output, process trees, threads and common scenarios, and its central concern is the difference between the BSD and System V dialects. ps aux reports user, PID, CPU%, memory%, VSZ, RSS, TTY, state and command, while ps -ef selects all processes with -e and prints a full-format line; both see everything, but the columns differ. Choosing one and staying with it matters more than learning both. To find memory consumers use --sort=-%mem, and the trap to avoid is confusing RSS with VSZ: RSS is resident memory in kilobytes, mixing them is the main source of wrong answers to "how much is this using". Process trees expose parent-child relationships, and a zombie in state Z cannot be killed, so the parent must be dealt with or the host restarted.
Basic View 6
psps auxps -efps -eps -fps -lFilter 7
ps -p 1234ps -p 1234,5678ps -u usernameps -U usernameps -g groupnameps -C nginxps --ppid 1234Custom Format 7
ps -eo pid,comm,userps -eo pid,ppid,comm,%cpu,%memps -eo pid,comm,etimeps -eo pid,comm,statps aux --sort=-%cpups aux --sort=%memps aux --sort=-rssProcess Tree 5
ps -ejHps axjfpstreepstree -ppstree -uThreads 4
ps -eLfps -p 1234 -Lps -eTps -H -p 1234Common Patterns 6
ps aux | grep nginxps aux --sort=-%cpu | headps aux --sort=-%mem | headps -ef | grep defunctps -eo pid,comm,etime | grep -v defunctps -u username -o pid,comm,%cpu,%memCommand Examples
Print the five busiest CPU processes
ps aux --sort=-%cpu | head -6The --sort flag takes -key for descending and key for ascending. Piping into head yields a top-N list without ever entering interactive top.
Output
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.1 168404 12164 ? Ss Aug29 0:03 systemd tom 3120 48.2 8.1 1258300 318204 ? Sl 10:12 2:14 node
Inspect the process tree to find the parent
pstree -p $(pgrep -f "node server.js")pstree -p prints PIDs, which makes the parent obvious at a glance. For the questions of who started this process and why it keeps coming back after a kill, the tree beats ps -ef.
Output
bash [1201] ├─ node [3120] │ └─ node [3121] └─ pm2 [1200]
Order by the exact column you care about
ps -eo pid,ppid,comm,%cpu,%mem --sort=-%cpu | head -10-eo selects the columns yourself, so the output stays narrow and sortable; adding ppid exposes the parent-child relationship. The long command paths and arguments that ps aux prints get in the way of ordering and are of no use here.
Output
PID PPID COMMAND %CPU %MEM 3120 1200 node 48.2 8.1 1452 840 chrome 18.2 12.4 2031 1200 electron 12.7 6.8
Common Pitfalls
- ps aux | grep xxx also matches the grep process itself; add grep -v grep or use pgrep.
- ps shows only an instantaneous snapshot — use top -d or sar for sustained high usage.
- kill sends SIGTERM for a graceful shutdown; -9 is SIGKILL and can lose unsaved data.
- Zombie processes have already-dead parents, so killing the child does nothing — the parent or a reboot must reap them.
- ps -ef and ps aux are different output formats with different columns; mixing them in scripts invites parse errors.
Tips
- Both ps aux and ps -ef list all processes; aux is BSD style, -ef is System V style.
- ps is a snapshot; top/htop show live data.
- Zombie state is Z; you can't kill it — kill its parent or reboot.
Official References
Each command links to its official documentation below, so you can verify the latest usage and read deeper.
Maintained by LaoHand
Publicly updated on Jul 21, 2026, continuously proofread against official docs.
Contact Us
Wrong command or description? Send us corrections, business inquiries or product feedback by email.
Contact Us