How to List Running Processes in Linux

When a service misbehaves or load spikes, you need a current process list before you can trace PIDs, owners, or parent-child chains. The table below maps common tasks to the command you reach for first; the sections that follow walk through each one with sample output.

Quick Reference: Commands to List Processes in Linux

Use ps when you need a one-time snapshot, top for continuously updated process activity, pgrep to locate processes by name, and pstree to inspect parent-child relationships.

List all running processes with ps

The ps command reads process data from /proc and prints a one-time snapshot. Two listing styles cover most admin work.

ps aux is the BSD-style table most people memorize: user, PID, CPU%, memory%, state, and the full command line.

ps aux

Sample output:

USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root           1  0.0  0.2  44584 16536 ?        Ss   09:24   0:09 /usr/lib/systemd/systemd --switched-root --system --deserialize=43 rhgb
root           2  0.0  0.0      0     0 ?        S    09:24   0:00 [kthreadd]

PID 1 is systemd, the init process; kernel threads such as kthreadd show bracketed names and zero RSS.

In BSD-style syntax, a lifts the "only yourself" restriction, x includes processes without a controlling terminal, and u selects the user-oriented output format. Together, aux provides the familiar system-wide process listing.

SysV-style ps -ef adds parent PID (PPID) and a compact UID column, which helps when you are about to walk a tree:

ps -ef

Sample output:

UID          PID    PPID  C STIME TTY          TIME CMD
root           1       0  0 09:24 ?        00:00:09 /usr/lib/systemd/systemd --switched-root --system --deserialize=43 rhgb
root           2       0  0 09:24 ?        00:00:00 [kthreadd]

Both commands list every process on the host. Plain ps without those flags normally shows only processes tied to your terminal session.

List processes by user

To see what one account is running, filter by effective user with -u:

ps -u root -o pid,ppid,%cpu,%mem,stat,etime,comm

Sample output:

PID    PPID %CPU %MEM STAT     ELAPSED COMMAND
      1       0  0.0  0.2 Ss      06:50:30 systemd
      2       0  0.0  0.0 S       06:50:30 kthreadd
      3       2  0.0  0.0 S       06:50:30 pool_workqueue_release

-u root selects processes whose effective user is root. Replace root with another username. If you specifically need to filter by the real user ID instead, use -U.

Find a process by name

When you know the service name but not the PID, pgrep returns matching process IDs. Add -a to print the command line beside each PID:

pgrep -a sshd

Sample output:

1202 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
2572 sshd-session: root [priv]
2575 sshd-session: root@notty

The listener on PID 1202 is the main sshd daemon; the sshd-session lines are per-connection workers.

ps -C matches the executable name in the comm field and is handy in scripts when you only need PIDs:

ps -C sshd -o pid=

Sample output:

1202

That single PID is the long-running sshd listener when you match on the service name alone.

Look up a process by PID

Given a PID from top, a log line, or ss -tlnp, confirm the process with ps -p:

ps -p 1 -o pid,ppid,user,stat,etime,cmd

Sample output:

PID    PPID USER     STAT     ELAPSED CMD
      1       0 root     Ss      06:19:31 /usr/lib/systemd/systemd --switched-root --system --deserialize=43 rhgb

PPID 0 marks a process with no parent in this listing; Ss means session leader in interruptible sleep.

To resolve a PID back to a short command name only:

ps -p 1 -o comm=

Sample output:

systemd

The empty header (comm=) prints only the short executable name, which is useful in scripts.

Sort the process list by CPU or memory

ps can rank processes for a quick triage without opening a live monitor. Sort by CPU percent:

ps aux --sort=-%cpu | head -6

Sample output:

USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root       19359 90.9 36.8 5352600 2275124 ?     S    09:30  93:11 hugo
root       45265  9.1  0.1  231596  5080 pts/0    R+   15:44   0:00 ps aux --sort=-%cpu
root           1  0.0  0.3  44584 16544 ?        Ss   09:24   0:09 /usr/lib/systemd/systemd --switched-root --system --deserialize=43 rhgb

The leading minus on %cpu puts the highest consumers first. Swap %mem for memory percent, or use -eo with explicit columns:

ps -eo pid,user,%mem,%cpu,comm --sort=-%mem | head -6

Sample output:

PID USER     %MEM %CPU COMMAND
  19359 root     39.8 42.5 hugo
   2772 root      5.8  4.6 node
   5901 golinux+  2.3  0.6 firefox

hugo tops the %MEM column here because it holds the largest resident set in this snapshot.

RSS, PSS, /proc maps, and when %MEM misleads you are covered in check memory usage per process in Linux. This page only shows the sort flags you need for a fast list.

Monitor running processes with top

top refreshes the process table continuously and is the usual choice when numbers keep changing. Start it interactively:

top

The screen refreshes every few seconds with a live task list and summary header. Press P to sort by CPU, M for memory, and q to quit.

If htop is installed, it provides an interactive alternative to top with easier scrolling, searching, sorting, and tree views. Unlike ps and top, htop may need to be installed separately on your distribution.

For a single snapshot in scripts or logs, use batch mode with an explicit descending sort field:

top -b -n 1 -o +%CPU | head -15

Sample output:

top - 16:16:07 up  6:51,  6 users,  load average: 2.05, 1.64, 1.88
Tasks: 321 total,   1 running, 320 sleeping,   0 stopped,   0 zombie
%Cpu(s):  5.9 us, 35.3 sy,  0.0 ni, 32.4 id,  0.0 wa, 23.5 hi,  2.9 si,  0.0 st
MiB Mem :   6069.0 total,   1690.2 free,   3616.1 used,   1051.9 buff/cache
    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND
  52682 root      20   0   32460  29944   3568 S  91.7   0.5   0:00.26 rg
   2772 root      20   0   83.2g 394108  35332 S   8.3   6.3  19:37.78 node

The + prefix on %CPU forces high-to-low order, so the first task line is the current CPU leader. Interactive keys, batch flags, and field reference live in the top command cheat sheet.

View parent and child processes as a tree

A flat ps list hides which daemon spawned a worker. Two tools show parent-child links.

ps -ef --forest indents children under their parent in the CMD column:

ps -ef --forest | head -12

Sample output:

root           2       0  0 09:24 ?        00:00:00 [kthreadd]
root           3       2  0 09:24 ?        00:00:00  \_ [pool_workqueue_release]
root           4       2  0 09:24 ?        00:00:00  \_ [kworker/R-rcu_gp]
root           5       2  0 09:24 ?        00:00:00  \_ [kworker/R-sync_wq]

The \_ prefix marks a child of the PID on the line above.

pstree draws the same hierarchy as an ASCII tree and -p prints PIDs in parentheses, which is often faster to read for a deep service stack:

pstree -p | head -12

Sample output:

systemd(1)-+-ModemManager(1183)-+-{ModemManager}(1189)
           |                    |-{ModemManager}(1190)
           |                    `-{ModemManager}(1192)
           |-NetworkManager(1105)-+-{NetworkManager}(1143)
           |                      |-{NetworkManager}(1145)
           |                      `-{NetworkManager}(1146)
           |-accounts-daemon(1112)-+-{accounts-daemon}(1150)

Limit the tree to one user when a single account owns the workload you are tracing:

pstree -p root | head -8

Sample output:

systemd(1)-+-ModemManager(1183)-+-{ModemManager}(1189)
           |                    |-{ModemManager}(1190)
           |                    `-{ModemManager}(1192)
           |-NetworkManager(1105)-+-{NetworkManager}(1143)
           |                      |-{NetworkManager}(1145)
           |                      `-{NetworkManager}(1146)
           |-accounts-daemon(1112)-+-{accounts-daemon}(1150)

Filtering by user trims unrelated branches so you can follow one service stack without wading through every other account.

ps --forest is a snapshot tied to ps column formats; pstree focuses on structure and thread braces ({name}). Use either when you need to answer who launched a process: follow PPID upward until you hit systemd, a container supervisor, or an interactive shell.

Check process status and process states

The STAT column encodes what the kernel scheduler is doing with each task. A custom ps format keeps the fields you need on one line:

ps -eo pid,ppid,user,stat,comm | head -10

Sample output:

PID    PPID USER     STAT COMMAND
      1       0 root     Ss   systemd
      2       0 root     S    kthreadd
      3       2 root     S    pool_workqueue_release
      4       2 root     I<   kworker/R-rcu_gp

The first character of STAT is the primary state:

Extra characters after the letter (for example s for session leader, < for high priority) modify the base state; see man ps for the full key.

To list processes stopped by a job-control signal system-wide, filter the state column. This catches tasks stopped with kill -STOP or Ctrl+Z:

ps -eo pid,user,state,comm | awk '$3 == "T"'

Sample output (after stopping a test sleep with kill -STOP):

45459 root     T sleep

That filter matches uppercase T only (job-control stop), not lowercase t (debugger trace). jobs is different: it lists only background tasks managed by your current shell session. Use ps when you need every job-control-stopped process on the host, and jobs when you suspended something in the terminal you still have open.

Summary

Use ps aux or ps -ef for a snapshot of current processes and top when you need continuously updated CPU and memory usage. pgrep is the quickest way to locate a process by name, while pstree -p helps trace parent-child relationships.

Filter ps by user or PID when troubleshooting a specific workload, and use --sort=-%cpu or --sort=-%mem to identify the largest resource consumers.

References

• ps(1) — procps-ng
• top(1) — procps-ng
• pgrep(1)
• pstree(1)
• proc(5) — process information pseudo-filesystem