ps Command

Purpose

Shows current status of processes.

Syntax

X/Open Standards

ps [ -A ] [ -N ] [ -a ] [ -d ] [ -e ] [ -f ] [ -k ] [ -l ] [ -F format] [ -o Format ] [ -G Glist ] [ -g Glist ][ -m ] [ -n NameList ] [ -p Plist ] [ -t Tlist ] [ -U Ulist ] [ -u Ulist ]

Berkley Standards

ps [ a ] [ c ] [ e ] [ ew ] [ eww ] [ g ] [ n ] [ U ] [ w ] [ x ] [ l | s | u | v ] [ t Tty ] [ ProcessNumber ]

Description

The ps command writes the current status of active processes and (if the -m flag is given) associated kernel threads to standard output. Note that while the -m flag displays threads associated with processes using extra lines, you must use the -o flag with the THREAD field specifier to display extra thread-related columns.

Without flags, the ps command displays information about the current workstation. The -f, -o, l, -l, s, u, and v flags only determine how much information is provided about a process; they do not determine which processes are listed. The l, s, u, and v flags are mutually exclusive.

With the -o flag, the ps command examines memory or the paging area and determines what the command name and parameters were when the process was created. If the ps command cannot find this information, the command name stored in the kernel is displayed in square brackets.

The COLUMNS environment variable overrides the system-selected, horizontal screen size.

The command-line flags that accept a list of parameters (the -o, -G, -g, -p, -t, -U, and -u flags) are limited to 128 items. For example, the -u Ulist flag can specify no more than 128 users.

Depending on the flags used with the ps command, column headings appear above the information displayed to standard output. The headings are defined in the following list (flags that cause these headings to appear are shown in parentheses):

ADDR

(-l and l flags) Contains the segment number of the process stack, if normal; if a kernel process, the address of the preprocess data area.

BND

(-o THREAD flag) The logical processor number of the processor to which the kernel thread is bound (if any). For a process, this field is shown if all its threads are bound to the same processor.

C

(-f, l, and -l flags) CPU utilization of process or thread, incremented each time the system clock ticks and the process or thread is found to be running. The value is decayed by the scheduler by dividing it by 2 once per second. For the sched_other policy, CPU utilization is used in determining process scheduling priority. Large values indicate a CPU intensive process and result in lower process priority whereas small values indicate an I/O intensive process and result in a more favorable priority.

CMD

(-f, -l, and l flags) Contains the command name. The full command name and its parameters are displayed with the -f flag.

COMMAND

(s, u, and v) Contains the command name. The full command name and its parameters are displayed with the -f flag.

F Field Table
Flags	Hexadecimal Value	Definition
SLOAD	0x00000001	Indicates that the process is operating in core memory.
SNOSWAP	0x00000002	Indicates that the process cannot be swapped out.
STRC	0x00000008	Indicates that the process is being traced.
SWTED	0x00000010	Indicates that the process stopped while being traced.
SFWTED	0x00000020	Indicates that the process stopped after a call to the fork subroutine, while being traced.
SEWTED	0x00000040	Indicates that the process stopped after a call to the exec subroutine, while being traced.
SLWTED	0x00000080	Indicates that the process stopped after a call to the load or unload subroutine, while being traced.
SFIXPRI	0x00000100	Indicates that the process has a fixed priority, ignoring the pcpu field descriptor.
SKPROC	0x00000200	Indicates a Kernel process.
SOMASK	0x00000400	Indicates restoration of the old mask after a signal is received.
SWAKEONSIG	0x00000800	Indicates that the signal will abort the sleep subroutine. The contents must not be equal to those of the PCATCH flag. The contents of both PCATCH and SWAKEONSIG must be greater than those of PMASK.
SUSER	0x00001000	Indicates that the process is in user mode.
SLKDONE	0x00002000	Indicates that the process has done locks.
STRACING	0x00004000	Indicates that the process is a debugging process.
SMPTRACE	0x00008000	Indicates multi-process debugging.
SEXIT	0x00010000	Indicates that the process is exiting.
SSEL	0x00020000	Indicates that the processor is selecting: wakeup/waiting danger.
SORPHANPGRP	0x00040000	Indicates an orphaned process group.
SNOCNTLPROC	0x00080000	Indicates that the session leader relinquished the controlling terminal.
SPPNOCLDSTOP	0x00100000	Indicates that the SIGHLD signal is not sent to the parent process when a child stops.
SEXECED	0x00200000	Indicates that process has been run.
SJOBSESS	0x00400000	Indicates that job control was used in the current session.
SJOBOFF	0x00800000	Indicates that the process is free from job control.
PSIGDELIVERY	0x01000000	Indicates that the process is used by the program-check handler.
SRMSHM	0x02000000	Indicates that the process removed shared memory during a call to the exit subroutine.
SSLOTFREE	0x04000000	Indicates that the process slot is free.
SNOMSG	0x08000000	Indicates that there are no more uprintf subroutine messages.

F

(-l and l flags) Some of the more important F field flags (hexadecimal and additive) associated with processes and threads are shown below:

F Field Table
Flags	Hex Value	Definition
SLOAD	0x00000001	Indicates that the process is operating in core memory.
SNOSWAP	0x00000002	Indicates that the process cannot be swapped out.
STRC	0x00000008	Indicates that the process is being traced.
SKPROC	0x00000200	Indicates a kernel process.
SEXIT	0x00010000	Indicates that the process is exiting.
SEXECED	0x00200000	Indicates that the process has been run.
SEXECING	0x01000000	Indicates that the process is execing (performing an exec).
TKTHREAD	0x00001000	Indicates that the thread is a kernel-only thread.

Note: You can see the definitions all process and thread flags by consulting the p_flags and t_flags fields in the /usr/include/sys/proc.h and /usr/include/sys/thread.h files respectively.

A process that has exited and has a parent that has not yet waited for the process is marked <defunct> . A process that is blocked trying to exit is marked <exiting> . The ps command attempts to determine the file name and arguments given when the process was created by memory or by the swap area.

Notes:

1. The process can change while the ps command is running. Some data displayed for defunct processes is irrelevant.
2. The ps program examines memory to retrieve the file name and arguments used when the process was created. However, a process can destroy information, making this method of retrieving file name and arguments unreliable.

Flags

The following flags are preceded by a - (minus sign):

Field           Field           Default 
Descriptors     Specifiers      Headers
   
%a              args            COMMAND
%c              comm            COMMAND
%t              etime           ELAPSED
%G              group           GROUP
%n              nice            NI
%C              pcpu            %CPU
%r              pgid            PGID
%p              pid             PID
%P              ppid            PPID
%g              rgroup          RGROUP
%u              ruser           RUSER
%x              time            TIME
%y              tty             TTY
%U              user            USER
%z              vsz             VSZ

Options

The following options are not preceded by a - (minus sign):

Exit Status

This command returns the following exit values:

Examples

1. To display all processes, enter:

   ps -e -f

2. To list processes owned by specific users, enter:

   ps -f -l -ujim,jane,su

3. To list processes that are associated with the /dev/console and /dev/tty1 ttys, enter:

   ps -t console,tty/1

4. To list processes not associated with a terminal, enter:

   ps -t -

5. To display a specified format with field specifiers, enter:

   ps -o ruser,pid,ppid=parent,args

   The output is:

   RUSER   PID     parent  COMMAND
   helene  34      12      ps -o ruser,pid,ppid=parent,args

6. To display a specified format with field descriptors, enter:

   ps -o "< %u > %p %y : %a"

   The output is:

   < RUSER  >      PID     TT :    COMMAND
   < helene >      34      pts/3 : ps -o < %u > %p %y : %a

7. To display information about processes and kernel threads controlled by the current terminal , enter:

   ps -lm

   The output is similar to:

        F S UID  PID PPID  C PRI NI ADDR  SZ WCHAN   TTY  TIME  CMD
   240003 A  26 8984 7190  1  60 20 2974 312       pts/1  0:00  -ksh
      400 S   -    -    -  1  60  -    -   -           -     -  -
   200005 A  26 9256 8984 15  67 20 18ed 164       pts/1  0:00  ps
        0 R   -    -    - 15  67  -    -   -           -     -  -

8. To display information about all processes and kernel threads, enter:

   ps -emo THREAD

   The output is similar to:

   USER   PID  PPID  TID S  C PRI SC   WCHAN   FLAG   TTY BND  CMD
   jane  1716 19292    - A 10  60  1       * 260801 pts/7   -  biod
      -     -     - 4863 S  0  60  0 599e9d8   8400     -   -  -
      -     -     - 5537 R 10  60  1 5999e18   2420     -   3  -
   luke 19292 18524    - A  0  60  0 586ad84 200001 pts/7   -  -ksh
      -     -     - 7617 S  0  60  0 586ad84    400     -   -  -
   luke 25864 31168    - A 11  65  0       - 200001 pts/7   -  -
      -     -     - 8993 R 11  65  0       -      0     -   -  -

Files

Related Information

The kill command, nice command.

Using ps to Identify CPU-Intensive Programs in AIX Versions 3.2 and 4 Performance Tuning Guide.