ps - process status


ps [-aAdefFhjHlnwx] [-g sids] [-G grouplist] 
   [-o "format[=head][,format[=head]]..."]
   [-p proclist] [-S sessionlist] [-t ttylist]
   [-u userlist] [-U userlist] [-X{unix|win}]


The ps(1) utility displays a header line followed by lines containing information about your processes that have controlling terminals. (The information is read from the /proc file system.)

The information displayed is selected based on a set of keywords (see the -L -O and -o options). The default output format includes, for each process, the controlling terminal for the process, CPU time (including both user and system time), state, and associated command.

The options are as follows:

Display all processes with controlling terminals, except session leaders.
Display all processes.
Display all processes, except session leaders.
Display all processes (same as -A).
Use full output format.
Display number of open file descriptors for each process. This value is always 0 for Windows processes.
-g sids
Display processes whose session leaders are in the list sids; this is a comma- or blank-separated list.
-G grouplist
Display processes whose real group identifiers (IDs) are given in grouplist; this is a comma- or blank-separated list.
Display help for command options.
Display help for output formats.
Indent output to display the process hierarchy. The indentation represents the process tree. Each process listed is followed by its children (recursively); the content of the CMD column is indented one character for the children; a grandchild of a process is therefore indented two spaces, and so on.
Include the process group ID and the session ID in the output.
Use long output format.
Display user and group IDs in numeric format.
-o format
Specify output format; this overrides the other output format options (-fjl). The format string supplied with the -o option is a blank- or comma-separated list of format specifiers. Each specifier is a field name or has the form fieldname=title, where title is the string displayed in the header that ps(1) prints as its first line of output. For example, -o user=NAME causes the user field in the output to have the title NAME.
-p proclist
Display processes whose process IDs are given in proclist; this is a comma-separated list.
-S sessionlist
Display Windows sessions whose session IDs are given in sessionlist; this is a comma-separated list. Session 0 exists whenever Windows is running. Additional sessions typically identify Terminal Server sessions. See "Output format" for information about displaying Windows session numbers.
-t ttylist
Display processes whose ttys are given in the list ttylist; this is a comma- or blank-separated list.
-u userlist
Display processes whose real user identifiers are given in userlist; this is a comma- or blank-separated list.
-U userlist
Same as -u userlist; this is a comma- or blank-separated list; if blanks are used, the list must be quoted.
Use 132 columns instead of 80. It also expands the user, ruser, group, and rgroup fields to a default width of 20 characters. -ww means no line-width limit.
Display processes belonging to the current user (equivalent to ps -u $USER). The command ps -ax displays all processes for the current user and is equivalent to ps -e. If any process-selection option other than -a is combined with -x, -x has no effect.
Display processes associated with the Interix subsystem.
Display processes associated with the Windows subsystem.


Output comes in three formats: default, full, and long. The options -f, -j, -l, and -o change the default format. The section Format later in this topic describes all of the possible output fields. Very long lines of output are truncated to 80 characters, unless either -w or -ww options is given.

Default output

For each process, the default output format displays the following:

Full output

For each process, the full output format displays the following:

Long output

For each process, the long output format displays the following:


The -l option provides a state field, which consists of a one-letter run state followed by one or more flag letters.

The run state is one of the following:

Free. The process has been freed and is no longer active. The ps(1) command should never report this state.
Initializing. The process is being created and the process table is being initialized. This state lasts for only a brief period of time.
Active. The process is considered active; this is equivalent to a runnable process on traditional systems.
In a system call. The process has made a request to the Interix subsystem, is waiting on the reply, and the subsystem is still servicing the request.
Stopped. The process has been stopped.
Unconnected. A freshly created process briefly passes through this state during process initialization.
Waiting. The process is blocked and waiting, either in a wait(3) or a waitpid(3) call.
Exiting. The process is currently exiting and not yet ready to be reaped by the parent. This state lasts for only a brief period of time.
Tty. Process is blocked doing tty input/output (I/O).
Exited. This is a zombie process; the process has exited but the parent of the process has not yet waited for the process.

The flag letters can be:

The process has posted an asynchronous stop for debugging.
Indicates a process that is or was the parent of a vfork(2). The process is temporarily blocking signals (except for SIGKILL) while it waits to receive full control of its process space from the vfork(2) child. Signals that are sent become pending and are acted upon once the parent process receives control of its process space.
The process has a debugging port and is starting.
The process is currently delivering or receiving a signal by remote procedure call (RPC).
The process has called the exec(2) function at some point in its history; that is, it has tried to run another process.
The children of the process will inherit its trace flags on fork(3).
The process is a Win32 process. (The "f" stands for foreign.)
This process slot is currently reserved to allow process group identification.
The process has been stopped by a debugger.
Kill on last close: the last close of the /proc file of this process will kill the process.
(The lowercase letter L.) Run on last close: the process will continue to run normally after the last close(3) on the /proc file of this process.
The process has its P_NO_FORK flag set. This flag is set briefly for the period between the receipt of a signal and the response. This condition should not persist.
The process is under single-step control for debugging.
The process is a session leader.
The process is pending termination because the current outstanding signal will be fatal when delivery is completed.
The process or one of its ancestors has called one of the set-UID functions (setuser(2) or (setuid(2)).
Indicates the child of a process that has performed a vfork(2).
Indicates the parent process that has performed a vfork(2).
The process has its P_WAITED flag set. This flag is normally unset. It indicates that the process was stopped and was being waited upon, but that the wait(3) or waitpid(3) call has returned. It is cleared if the process is stopped again.

Format specifiers

You can use the -o option to specify the format of the output; the format string consists of field names and optional column titles for those fields.

The following list provides the field names, with their default titles:

Field Title Meaning
addr ADDR address (not implemented)
args COMMAND command and argument list
c C cpu use for scheduling (not implemented)
comm COMMAND argv[0] (the command name)
etime ELAPSED elapsed time
flags F process flags (octal)
group GROUP effective group ID
nice NI scheduling priority
ofdc FDCOUNT number of open file descriptors
pcpu %CPU cpu time used/available
pgid PGID process group ID
pid PID process ID
ppid PPID parent process ID
pri PRI priority (not implemented)
rgroup RGROUP real group ID
ruser RUSER real user ID
s S process state
sid SID session ID
state STATE process state & flags
stime STIME process starting time
sz SZ working set size, in K
time TIME cpu time
tty TT controlling terminal
user USER effective user ID
vsz VSZ virtual memory size, in K
wchan WCHAN even on which process is blocked

If you specify a field that is not implemented, ps(1) displays a hyphen (-).

Since there is no way for a process to change its effective user or group ID, the user and group fields are always identical to the ruser and rgroup fields, respectively.

Note that if your full user name (such as ACCTG+rrichards) is smaller than the width of the USER field, the user name will be printed, and if it is longer, the numeric user ID is printed. The default width is ten characters. To force the user name to be displayed, make sure that the field width for USER is large enough. For example:

ps -ef -o "user=ReallyWideUidHeaderField,pid,ppid,tty,time,comm"


The ps(1) utility returns 0 for success and greater than 0 if an error occurred.


Because ps(1) cannot run faster than the system, and is run as any other scheduled process, the information it displays can never be exact.


The ps(1) command does not display the full command line for other users' processes. This is a security feature: command lines can contain sensitive information, such as a password.