ps

NAME

ps - process status

SYNOPSIS

ps [-aAdefFhjHlnwx] [-g sids] [-G grouplist] 
   [-o "format[=head][,format[=head]]..."]
   [-p proclist] [-S sessionlist] [-t ttylist]
   [-u userlist] [-U userlist] [-X{unix|win}]

DESCRIPTION

The ps(1) utility displays a header line followed by lines containing information about your processes that have controlling terminals. (The information is read from the /proc file system.)

The information displayed is selected based on a set of keywords (see the -L -O and -o options). The default output format includes, for each process, the controlling terminal for the process, CPU time (including both user and system time), state, and associated command.

The options are as follows:

-a

Display all processes with controlling terminals, except session leaders.

-A

Display all processes.

-d

Display all processes, except session leaders.

-e

Display all processes (same as -A).

-f

Use full output format.

-F

Display number of open file descriptors for each process. This value is always 0 for Windows processes.

-g sids

Display processes whose session leaders are in the list sids; this is a comma- or blank-separated list.

-G grouplist

Display processes whose real group identifiers (IDs) are given in grouplist; this is a comma- or blank-separated list.

-h

Display help for command options.

-H

Display help for output formats.

-i

Indent output to display the process hierarchy. The indentation represents the process tree. Each process listed is followed by its children (recursively); the content of the CMD column is indented one character for the children; a grandchild of a process is therefore indented two spaces, and so on.

-j

Include the process group ID and the session ID in the output.

-l

Use long output format.

-n

Display user and group IDs in numeric format.

-o format

Specify output format; this overrides the other output format options (-fjl). The format string supplied with the -o option is a blank- or comma-separated list of format specifiers. Each specifier is a field name or has the form fieldname=title, where title is the string displayed in the header that ps(1) prints as its first line of output. For example, -o user=NAME causes the user field in the output to have the title NAME.

-p proclist

Display processes whose process IDs are given in proclist; this is a comma-separated list.

-S sessionlist

Display Windows sessions whose session IDs are given in sessionlist; this is a comma-separated list. Session 0 exists whenever Windows is running. Additional sessions typically identify Terminal Server sessions. See "Output format" for information about displaying Windows session numbers.

-t ttylist

Display processes whose ttys are given in the list ttylist; this is a comma- or blank-separated list.

-u userlist

Display processes whose real user identifiers are given in userlist; this is a comma- or blank-separated list.

-U userlist

Same as -u userlist; this is a comma- or blank-separated list; if blanks are used, the list must be quoted.

-w

Use 132 columns instead of 80. It also expands the user, ruser, group, and rgroup fields to a default width of 20 characters. -ww means no line-width limit.

-x

Display processes belonging to the current user (equivalent to ps -u $USER). The command ps -ax displays all processes for the current user and is equivalent to ps -e. If any process-selection option other than -a is combined with -x, -x has no effect.

-Xunix

Display processes associated with the Interix subsystem.

-Xwin

Display processes associated with the Windows subsystem.

OUTPUT FORMAT

Output comes in three formats: default, full, and long. The options -f, -j, -l, and -o change the default format. The section Format later in this topic describes all of the possible output fields. Very long lines of output are truncated to 80 characters, unless either -w or -ww options is given.

Default output

For each process, the default output format displays the following:

• The process ID.
• The name of the tty; the n prefix indicates an Interix process; S identifies a Windows session.
• The processor time used by the command.
• The command line.

  $ ps -a
     PID TTY	 TIME CMD
    8515 n00  0:00.06 ksh
    8579 n00  0:00.01 ps
  	 8 S00  0:30.40 SystemProcess
     200 S00  0:00.64 csrss.exe
     224 S00  0:11.20 winlogon.exe
     252 S00  0:12.26 services.exe
     264 S00  1:13.64 lsass.exe
  ...
  

Full output

For each process, the full output format displays the following:

• The user's name.
• The process ID.
• The process ID of the parent process (PPID).
• Elapsed time since the process was started.
• The tty name; the n prefix indicates an Interix process; S identifies a Windows session.
• Cumulative CPU time used by the process.
• The command line.

  $ ps -af
  	 UID	PID   PPID	STIME TTY	 TIME CMD
  	 kim   8259   8515 12:43:31 n00  0:00.01 ps -af
  	 kim   8515   8131 12:41:06 n00  0:00.07 ksh
     +SYSTEM	8	0   Jul 27 S00  0:30.43 SystemProcess
     +SYSTEM	200	172   Jul 27 S00  0:00.64 F:\WINNT\system32\csrss.exe F:\W
     +SYSTEM	224	172   Jul 27 S00  0:11.22 F:\WINNT\system32\winlogon.exe w
     +SYSTEM	252	224   Jul 27 S00  0:12.27 F:\WINNT\system32\services.exe F
     +SYSTEM	264	224   Jul 27 S00  1:13.68 F:\WINNT\system32\lsass.exe F:\W
  ...
  

Long output

For each process, the long output format displays the following:

• The state of the process.
• The user's name.
• The PID.
• The process ID of the parent process (PPID).
• The scheduling priority of the process.
• The size of the working set, in kilobytes.
• Elapsed time since the process was started.
• The tty name; the n prefix indicates an Interix process; S identifies a Windows session.
• Cumulative CPU time used by the process.
• The command line.

  $ ps -al
  STATE		 UID	PID   PPID NI	SZ	WCHAN TTY	 TIME CMD
  Seg			 kim   8515   8131  2   584 4a7aa3a5 n00  0:00.07 ksh
  Seg			 kim   8643   8515  2   424		0 n00  0:00.02 ps
  R		 +SYSTEM	8	0  2   216		0 S00  0:30.44 SystemProcess
  R		 +SYSTEM	200	172 -3  1388		0 S00  0:00.64 csrss.exe
  R		 +SYSTEM	224	172 -3 11440		0 S00  0:11.22 winlogon.exe
  R		 +SYSTEM	252	224  1  5328		0 S00  0:12.27 services.exe
  R		 +SYSTEM	264	224 -3 11596		0 S00  1:13.75 lsass.exe
  ...
  

State

The -l option provides a state field, which consists of a one-letter run state followed by one or more flag letters.

The run state is one of the following:

F

Free. The process has been freed and is no longer active. The ps(1) command should never report this state.

I

Initializing. The process is being created and the process table is being initialized. This state lasts for only a brief period of time.

R

Active. The process is considered active; this is equivalent to a runnable process on traditional systems.

S

In a system call. The process has made a request to the Interix subsystem, is waiting on the reply, and the subsystem is still servicing the request.

T

Stopped. The process has been stopped.

U

Unconnected. A freshly created process briefly passes through this state during process initialization.

W

Waiting. The process is blocked and waiting, either in a wait(3) or a waitpid(3) call.

X

Exiting. The process is currently exiting and not yet ready to be reaped by the parent. This state lasts for only a brief period of time.

Y

Tty. Process is blocked doing tty input/output (I/O).

Z

Exited. This is a zombie process; the process has exited but the parent of the process has not yet waited for the process.

The flag letters can be:

a

The process has posted an asynchronous stop for debugging.

b

Indicates a process that is or was the parent of a vfork(2). The process is temporarily blocking signals (except for SIGKILL) while it waits to receive full control of its process space from the vfork(2) child. Signals that are sent become pending and are acted upon once the parent process receives control of its process space.

D

The process has a debugging port and is starting.

d

The process is currently delivering or receiving a signal by remote procedure call (RPC).

e

The process has called the exec(2) function at some point in its history; that is, it has tried to run another process.

F

The children of the process will inherit its trace flags on fork(3).

f

The process is a Win32 process. (The "f" stands for foreign.)

g

This process slot is currently reserved to allow process group identification.

i

The process has been stopped by a debugger.

L

Kill on last close: the last close of the /proc file of this process will kill the process.

l

(The lowercase letter L.) Run on last close: the process will continue to run normally after the last close(3) on the /proc file of this process.

n

The process has its P_NO_FORK flag set. This flag is set briefly for the period between the receipt of a signal and the response. This condition should not persist.

S

The process is under single-step control for debugging.

s

The process is a session leader.

t

The process is pending termination because the current outstanding signal will be fatal when delivery is completed.

u

The process or one of its ancestors has called one of the set-UID functions (setuser(2) or (setuid(2)).

V

Indicates the child of a process that has performed a vfork(2).

v

Indicates the parent process that has performed a vfork(2).

w

The process has its P_WAITED flag set. This flag is normally unset. It indicates that the process was stopped and was being waited upon, but that the wait(3) or waitpid(3) call has returned. It is cleared if the process is stopped again.

Format specifiers

You can use the -o option to specify the format of the output; the format string consists of field names and optional column titles for those fields.

The following list provides the field names, with their default titles:

If you specify a field that is not implemented, ps(1) displays a hyphen (-).

Since there is no way for a process to change its effective user or group ID, the user and group fields are always identical to the ruser and rgroup fields, respectively.

Note that if your full user name (such as ACCTG+rrichards) is smaller than the width of the USER field, the user name will be printed, and if it is longer, the numeric user ID is printed. The default width is ten characters. To force the user name to be displayed, make sure that the field width for USER is large enough. For example:

ps -ef -o "user=ReallyWideUidHeaderField,pid,ppid,tty,time,comm"

DIAGNOSTICS

The ps(1) utility returns 0 for success and greater than 0 if an error occurred.

BUGS

Because ps(1) cannot run faster than the system, and is run as any other scheduled process, the information it displays can never be exact.

NOTES

The ps(1) command does not display the full command line for other users' processes. This is a security feature: command lines can contain sensitive information, such as a password.

SEE ALSO

kill(1)

exec(2)

setuid(2)

strftime(3)

proc(4)