Lesson 9.1: Processes and ps

What a process is and how it differs from a program, process IDs (PID) and parent processes (PPID), PID 1 (systemd), listing processes with ps, ps aux and ps -ef and reading their columns, the process tree with pstree, finding processes by name with pgrep, and /proc.

17 min

You will learn to

Explain program, process, PID and PPID
List your own processes and every process on the system
Read the USER, PID, %CPU, %MEM, STAT and COMMAND columns
Follow a process's ancestry with ps -ef and pstree
Find a process ID with pgrep
Look a process up in /proc

Key terms

Program: An executable file on disk, for example /usr/bin/ls. It does nothing until it is started.
Process: A running instance of a program: its code in memory plus its own state (open files, variables, owner, current directory). One program can run as many processes at once.
PID: Process ID: the unique number the kernel gives each process. Numbers are reused after a process ends.
PPID and parent process: Every process is started by another one, its parent; PPID is the parent's PID. Your commands are children of your shell.
PID 1: init / systemd: The first process the kernel starts at boot. It starts the services and adopts processes whose parent has ended. On Ubuntu and Rocky Linux it is systemd.
Daemon: A background process without a terminal that provides a service: sshd, cron, rsyslogd. Names often end in d.
ps aux columns: USER owner · PID · %CPU share of processor time · %MEM share of RAM · VSZ virtual memory (KiB) · RSS resident memory actually used (KiB) · TTY terminal (? = none) · STAT state · START start time · TIME CPU time used · COMMAND the command line.
STAT codes: R running · S sleeping (waiting for something) · D uninterruptible wait (usually disk) · T stopped · Z zombie (ended, parent hasn't collected it). Extra letters: s session leader, + in the foreground, l multi-threaded, < high priority, N low priority.
BSD and UNIX options: ps accepts two option styles: BSD without a dash (ps aux) and UNIX with a dash (ps -ef). Both list everything; -ef shows PPID.
/proc: A virtual filesystem the kernel generates: /proc/PID/ for each process (status, cmdline, open files), plus system files like /proc/cpuinfo and /proc/meminfo.

← Working efficiently in Vim · All lessons · Monitoring the system: top, uptime and free →