oreilly.comSafari Books Online.Conferences.


Linux in a Nutshell

This directory of Linux commands is from Linux in a Nutshell, 5th Edition.

Click on any of the 687 commands below to get a description and list of available options. All links in the command summaries point to the online version of the book on Safari Bookshelf.

Buy it now, or read it online on Safari Bookshelf.


ps [options]

Report on active processes. ps has three types of options. GNU long options start with two hyphens, which are required. BSD options may be grouped and do not start with a hyphen, while Unix98 options may be grouped and require an initial hyphen. The meaning of the short options can vary depending on whether or not there is a hyphen. In options, list arguments should either be comma-separated or space-separated and placed inside double quotes. In comparing the amount of output produced, note that e prints more than a and l prints more than f for each entry.


nums, p nums, -p nums, --pid=nums

Include only specified processes, which are given in a space-delimited list.

-nums, -s nums, --sid=nums

Include only specified session IDs, which are given in a space-delimited list.

[-] a

As a, list all processes on a terminal. As -a, list all processes except session leaders and processes not associated with a terminal.

[-] c

As -c, show different scheduler information with -l. As c, show the true command name.

-C cmds

Select by command name.

--cols=cols, --columns=cols

Set the output width (the number of columns to display).


Select all processes except session leaders.

-e, -A

Select all processes.


Include environment information after the command.

[-] f, --forest

As -f, display full listing. As f or --forest, display "forest" family tree format, with ASCII art showing the relationships.


Set extra-full format; implies -f.

-g list, -G list, --group=groups, --Group=groups

For -g, select by session leader if list contains numbers, or by group if it contains group names. For -G, select by the group IDs in list. --group selects by effective group and --Group selects by real group, where groups can be either group names or group IDs.

h, --no-headers

Suppress header. If you select a BSD personality by setting the environment variable PS_PERSONALITY to bsd, then h prints a header on each page.


Display "forest" family tree format, but without ASCII art.


Display threads as if they were processes.


Repeat headers on every output page.


Display help information and exit.


Print debugging information.

[-] j

Jobs format. j prints more information than -j.

-k spec, --sort spec

Specify sort order. Syntax for the specification is:

[+|-] key[,[+|-] key...] ]

The default direction is +, for increasing numerical or alphabetic order. See Format and sort specifiers for possible keys.

[-] l

Produce a long listing. -l prints more information than l and is often used with -y.


Print list of field specifiers that can be used for output formatting or for sorting.


Show threads, possibly with LWP and NLWP columns.

--lines=num, --rows=num

Set the screen height to num lines. If --headers is also set, the headers repeat every num lines.

[-] m

Show threads after processes.


Print user IDs and WCHAN numerically.

-n file, N file

Specify the file for ps to use as a namelist file. The map file must correspond to the Linux kernel—e.g., /boot/

-N, --deselect

Negate the selection, selecting all processes that do not meet the specified conditions.

[-] o fields, --format=fields

As -o, o, or --format, specify user-defined format with a list of fields to display.

[-] O fields

As -O, this option is like -o, but some common fields are predefined. As O, this option can be either the same as -O in specifying fields to display, or can specify single-letter fields for sorting. For sorting, each field specified as a key can optionally have a leading + (return to default sort direction on key) or - (reverse the default direction).


Select by parent process IDs.


Show only processes that are currently running.


Display signal format.

-S, --cumulative

Include some dead child process data in parent total.

[-] tttys, --tty=ttys

Display processes running on the specified terminals. t with no terminal list displays processes for the terminal associated with ps. Specify - to select processes not associated with any terminal.


Display all processes on this terminal. Like t with no argument.


Display threads, possibly with SPID column,

[-] u [users] , --user=users

As u with no argument, display user-oriented output. As -u or --user, display by effective user ID (and also support names), showing results for users. With no argument, -u displays results for the current user.

[-] U users, --User=users

As U, display processes by effective user ID. As -U or --User, display processes for users by real user ID (and also support names).


Display virtual memory format.

[-] V, --version

Display version information and then exit.

[-] w

Wide format. Don't truncate long lines. Use twice to set an unlimited width.


Set screen width.


Display processes without an associated terminal.


Use old Linux i386 register format.


Do not show flags; show rss instead of addr. Requires -l.

Format and sort specifiers

The following are the keywords for formatting and for sorting with --sort, followed by a desciption and the output column header in parentheses:

%cpu, pcpu

Percent of CPU time used recently. (%CPU)

%mem, pmem

Percent of memory used. (%MEM)

args, cmd, command

The command the process is running with all its arguments. (CMD for cmd; otherwise COMMAND)

blocked, sig_block, sigmask

Mask, in hexadecimal, of blocked signals. (BLOCKED)


Command start time. (START)


Accumulated CPU time for user plus system. (TIME)


Integer value of %cpu. (C)

caught, sig_catch, sigcatch

Mask, in hexadecimal, of caught signals. (CAUGHT)

class, cls, policy

Scheduling class. (POL for policy, otherwise CLS). Possible values are:




Unknown value


SCHED_FIFO (first in, first out)


SCHED_RR (round robin)


SCHED_OTHER (standard time-sharing)

comm, ucmd, ucomm

Name of the command executable. (CMD for ucmd, otherwise COMMAND)


Per-mill CPU usage, where mill is 1000. Equivalent to %cpu with no decimal point. (CP)

cputime, time

Cumulative CPU time. (TIME)

egid, gid

Effective group ID number in decimal. (EGID or GID, respectively)

egroup, group

Effective group ID; as text value if it is available and if it fits, otherwise shown as decimal value. (EGROUP or GROUP, respectively)


Effective instruction pointer. (EIP)


Effective stack pointer. (ESP)


Elapsed time since the start of the process. (ELAPSED)

euid, uid

Effective user ID. (EUID or UID, respectively)

euser, uname, user

Effective username; as text value if it is available and if it fits, otherwise shown as decimal value (EUSER for euser; otherwise USER).

f, flag, flags

Process flags. Can be summed. (F) Possible values are:


Forked but didn't exec.


Used superuser privileges.

fgid, fsgid

Filesystem access group ID. (FGID)

fgroup, fsgroup

Filesystem access group ID; as text if available and if it fits, otherwise as a decimal number. (FGROUP)


First eight bytes of the executable's basename. (COMMAND)

fuid, fsuid

Filesystem access user ID. (FUID)


Filesystem access user ID; as text if available and if it fits, otherwise as a decimal number. (FUSER)

ignored, sig_ignore, sigignore

Mask of ignored signals in hexadecimal format. (IGNORED)


Command start time. (LSTART)

lwp, spid, tid

Light-weight process, or thread, ID. (LWP, SPID, TID, respectively)

ni, nice

The nice value of the process. A higher number indicates less CPU time. (NI)

nlwp, thcount

Number of LWPs, or threads, in the process. (NLWP or THCNT, respectively)


Address of kernel function where process is sleeping. See also wchan to get the function by name. (WCHAN)

pending, sig, sig_pend

Mask of pending signals. Use with the m or -m option to see both signals pending on the process and on individual threads. (PENDING)

pgid, pgrp

Process group ID or ID of process group leader, which are equivalent. (PGID or PGRP, respectively)


Process ID. (PID)


Parent process ID. (PPID)


Process's scheduling priority. A higher number indicates lower priority. (PRI)


Current processor that the process is running on. (PSR)


Real group ID. (RGID)


Real group name; as text if available and it fits, otherwise as a decimal number. (RGROUP)

rss, rssize, rsz

Resident set size (the amount of physical memory), in kilobytes. (RSZ for rsz; otherwise RSS)


Real-time priority. (RTPRIO)


Real user ID number. (RUID)


Real user ID; as text if available and it fits, otherwise as a decimal number. (RUSER)

s, state

A single-character state display. See stat for the possible characters or for a multicharacter display. (S)


Scheduling policy. Also see class. (SCH) Possible values are:







sess, session, sid

Session ID, or the process ID of the session leader, which is equivalent. (SID for sid; otherwise SESS)


Processor on which the process is currentlly running, or "*" if the process is not running. (P)

sgid, svgid

Saved group ID. (SGID or SVGID, respectively)


Saved group name; as text if available and it fits, otherwise as a decimal number.


Size of virtual image. Provides a rough estimate of the swapspace required to swap the process out. Note that sz uses the same column header, but has a different meaning. (SZ)


Address of the stack bottom (start of the stack). (STACKP)


Start time of the command. (STARTED)


Starting time or date of the process. (START)


Status. Multiple status characters can appear. See also s to display a single character. (STAT)


Part of foreground process group.


High priority (not "nice").


Asleep and not interruptible.




Pages locked into memory.


Low priority ("nice").




Session leader.






No resident pages (second field).



suid, svuid

Saved user ID. (SUID or SVUID respectively)

suser, svuser

Saved username; as text if it is available and it fits, otherwise as a decimal number. (SUSER or SVUSER respectively)


Physical page size of the core image of the process, including text, data and stack space. (SZ)


ID of the foreground process group on the associated terminal for the process, or -1 if not connected to a terminal. (TPGID)

tt, tty, tname

Associated (controlling) terminal. (TTY for tname; otherwise TT)


User ID. (UID)

vsz, vsize

Virtual memory size, in kilobytes of the entire process. (VSZ)


Kernel function in which process is sleeping, or "-" if running, or "*" if multithreaded process and ps is not displaying threads. (WCHAN)

Linux Resources
  • Linux Online
  • The Linux FAQ
  • Linux Kernel Archives
  • Kernel Traffic

  • Sponsored by: