fbpx

Comandos Linux – Comando ps

Comando ps do Linux

comando ps

Relata um instantâneo do status dos processos atualmente em execução .

Descrição

Em todo sistema operacional semelhante ao UNIX , o comando de status do processo ( ps ) exibe informações sobre processos ativos. A versão de cada sistema operacional do ps é um pouco diferente; portanto, consulte sua documentação para opções específicas.

Esta documentação descreve uma versão do ps comum a muitas distribuições do Linux . Aceita vários tipos de opções:

  1. Opções UNIX, que podem ser agrupadas e devem ser precedidas por um traço (”  “).
  2. Opções de BSD , que podem ser agrupadas e não devem ser usadas com um traço.
  3. Opções longas do GNU , precedidas por dois traços (”  “).

Opções de tipos diferentes podem ser livremente misturadas, mas podem causar conflitos. Existem algumas opções sinônimas, que são funcionalmente idênticas, devido aos muitos padrões e implementações ps compatíveis .

Note que ” ps -aux ” é diferente de ” ps aux “. Os padrões POSIX e UNIX exigem que ” ps -aux ” imprima todos os processos pertencentes a um usuário chamado ” x “, bem como imprima todos os processos que seriam selecionados pela opção -a . Se o usuário chamado ” x ” não existir, ps poderá interpretar o comando como ” ps aux ” e imprimir um aviso. Esse comportamento visa ajudar na transição de scripts herdados, mas está sujeito a alterações e, portanto, não deve ser invocado.

Por padrão, ps seleciona todos os processos com o mesmo ID de usuário efetivo ( euid = EUID ) que o usuário atual e associado ao mesmo terminal que o invocador. Ele exibe a identificação do processo ( pid = PID ), o terminal associado ao processo ( tname = TTY ), o tempo acumulado da CPU no formato [ DD- ] hh: mm: ss ( time = TIME ) e o nome do executável ( ucmd = CMD ). A saída não é classificada por padrão.

O uso de opções no estilo BSD adicionará o estado do processo ( stat = STAT ) à exibição padrão e mostrará os argumentos do comando ( args = COMMAND ) em vez do nome do executável. Você pode substituir isso pela variável de ambiente PS_FORMAT . O uso de opções no estilo BSD também mudará a seleção do processo para incluir processos em outros terminais (TTYs) que pertencem a você; alternativamente, isso pode ser descrito como definir a seleção como o conjunto de todos os processos filtrados para excluir processos pertencentes a outros usuários ou não em um terminal. Esses efeitos não são considerados quando as opções são descritas como “idênticas” abaixo; portanto, -M será considerado idêntico a Z e assim por diante.

Exceto conforme descrito abaixo, as opções de seleção de processo são aditivas. A seleção padrão é descartada e os processos selecionados são adicionados ao conjunto de processos a serem exibidos. Um processo será mostrado, se atender a algum dos critérios de seleção fornecidos.

Sintaxe

ps [ opções ]

Opções: seleção simples de processos

umaLevante a restrição “somente você” no estilo BSD, que é imposta ao conjunto de todos os processos quando algumas opções no estilo BSD (sem ”  “) são usadas ou quando a configuração de personalidade ps é semelhante ao BSD. O conjunto de processos selecionados dessa maneira é um acréscimo ao conjunto de processos selecionados por outros meios. Uma descrição alternativa é que essa opção faz com que ps liste todos os processos com um terminal ( tty ) ou liste todos os processos quando usado junto com a opção x .
-UMASelecione todos os processos. Idêntico a -e .
-umaSelecione todos os processos, exceto os líderes da sessão e os processos não associados a um terminal.
-dSelecione todos os processos, exceto os líderes da sessão.
–deselectSelecione todos os processos, exceto aqueles que atendem às condições especificadas (nega a seleção). Idêntico a -N .
-eSelecione todos os processos. Idêntico a -A .
gRealmente todos os processos, até líderes de sessão. Este sinalizador está obsoleto e pode ser descontinuado em uma versão futura. Normalmente, está implícito na bandeira a e é útil apenas quando estiver operando na personalidade do SunOS4 .
-NSelecione todos os processos, exceto aqueles que atendem às condições especificadas (nega a seleção). Idêntico a –deselecione .
TSelecione todos os processos associados a este terminal. Idêntico à opção t sem nenhum argumento.
rRestrinja a seleção apenas aos processos em execução.
xLift the BSD-style “must have a tty” restriction, which is imposed upon the set of all processes when some BSD-style (without ““) options are used or when the ps personality setting is BSD-like. The set of processes selected in this manner is in addition to the set of processes selected by other means. An alternate description is that this option causes ps to list all processes owned by you (same EUID as ps), or to list all processes when used together with the an option.

Options: Process Selection By List

These options accept a single argument in the form of a blank-separated or comma-separated list, and they can be used multiple times. For example:

ps -p "1 2" -p 3,4

…is a valid command.

Options which select processes by list are as follows:

123Identical to “–pid 123“.
123Identical to “–pid 123“.
-C cmdlistSelect by command name. This selects the processes whose executable name is given in cmdlist.
-G grplistSelect by real group ID (RGID) or name. This selects the processes whose real group name or ID is in the grplist list. The real group ID identifies the group of the user who created the process.
-g grplistSelect by session OR by effective group name. Selection by session is specified by many standards, but selection by effective group is the logical behavior that other operating systems use. This ps will select by session when the list is completely numeric (as sessions are). Group ID numbers will work only when some group names are also specified. See the -s and –group options.
–Group grplistSelect by real group ID (RGID) or name. Identical to -G.
–group grplistSelect by effective group ID (EGID) or name. This selects the processes whose effective group name or ID is in grouplist. The effective group ID describes the group whose file access permissions are used by the process. The -g option is often an alternative to –group.
p pidlistSelect by process ID. Identical to -p and –pid.
-p pidlistSelect by PID. This selects the processes whose process ID numbers appear in pidlist. Identical to p and –pid.
–pid pidlistSelect by process ID. Identical to -p and p.
–ppid pidlistSelect by parent process ID. This selects the processes with a parent process ID in pidlist. That is, it selects processes that are children of those listed in pidlist.
-s sesslistSelect by session ID. This selects the processes with a session ID specified in sesslist.
–sid sesslistSelect by session ID. Identical to -s.
t ttylistSelect by tty. Nearly identical to -t and –tty, but can also be used with an empty ttylist to indicate the terminal associated with ps. Using the T option is considered cleaner than using t with an empty ttylist.
-t ttylistSelect by tty. This selects the processes associated with the terminals given in ttylist. Terminals (ttys, or screens for text output) can be specified in several forms: /dev/ttyS1ttyS1S1. A plain “” may be used to select processes not attached to any terminal.
–tty ttylistSelect by terminal. Identical to -t and t.
U userlistSelect by effective user ID (EUID) or name. This selects the processes whose effective username or ID is in userlist. The effective user ID describes the user whose file access permissions are used by the process. Identical to -u and –user.
-U userlistSelect by real user ID (RUID) or name. It selects the processes whose real username or ID is in the userlist list. The real user ID identifies the user who created the process.
-u userlistSelect by effective user ID (EUID) or name. This selects the processes whose effective username or ID is in userlist.

The effective user ID describes the user whose file access permissions are used by the process. Identical to U and –user.

–User userlistSelect by real user ID (RUID) or name. Identical to -U.
–user userlistSelect by effective user ID (EUID) or name. Identical to -u and U.

Options: Output Format Control

These options are used to choose the information displayed by ps. The output may differ from version to version.

-cShow different scheduler information for the -l option.
–contextDisplay security context format (when using SE Linux).
-fDo full-format listing. This option can be combined with other UNIX-style options to add additional columns. It also causes the command arguments to be printed. When used with -L, the NLWP (number of threads) and LWP (thread ID) columns will be added. See the c option, the format keyword args, and the format keyword comm.
-FExtra full format. See the -f option, which -F implies.
–format formatuser-defined format. Identical to -o and o.
jBSD job control format.
-jJobs format.
lDisplay BSD long format.
-lLong format. The -y option is often useful with this.
-MAdd a column of security data. Identical to Z (for SE Linux).
O formatis preloaded o (overloaded). The BSD O option can act like -O (user-defined output format with some common fields predefined) or can be used to specify sort order. Heuristics are used to determine the behavior of this option. To ensure that the desired behavior is obtained (sorting or formatting), specify the option in some other way (e.g., with -O or –sort). When used as a formatting option, it is identical to -O, with the BSD personality.
-O formatLike -o, but preloaded with some default columns. Identical to “-o pid,format,state,tname,time,command” or “-o pid,format,tname,time,cmd“; see -o, below.
o formatSpecify user-defined format. Identical to -o and –format.
-o formatUser-defined format. format is a single argument in the form of a blank-separated or comma-separated list, which offers a way to specify individual output columns. The recognized keywords are described in the STANDARD FORMAT SPECIFIERS section below. Headers may be renamed (“ps -o pid,ruser=RealUser -o comm=Command“) as desired. If all column headers are empty (“ps -o pid= -o comm=“) then the header line will not be output. Column width will increase as needed for wide headers; this may be used to widen up columns such as WCHAN (“ps -o pid,wchan=WIDE- WCHAN-COLUMN -o comm“). Explicit width control (“ps opid,wchan:42,cmd“) is offered too. The behavior of “ps -o pid=X,comm=Y” varies with personality; output may be one column named “X,comm=Y” or two columns named “X” and “Y“. Use multiple -o options when in doubt. Use the PS_FORMAT environment variable to specify a default as desired; DefSysV and DefBSD are macros that may be used to choose the default UNIX or BSD columns.
sDisplay signal format.
uDisplay user-oriented format.
vDisplay virtual memory format.
XRegister format.
-yDo not show flags; show rss in place of addr. This option can only be used with -l.
ZAdd a column of security data. Identical to -M (for SE Linux).

Options: Output Modifiers

cShow the true command name. This is derived from the name of the executable file, rather than from the argv value. Command arguments and any modifications to them are thus not shown. This option effectively turns the args format keyword into the comm format keyword; it is useful with the -f format option and with the various BSD-style format options, which all normally display the command arguments. See the -f option, the format keyword args, and the format keyword comm.
–cols nSet screen width.
–columns nSet screen width.
–cumulativeInclude some dead child process data (as a sum with the parent).
eShow the environment after the command.
fASCII art process hierarchy (as many trees, also referred to as a “forest”).
–forestASCII art process tree.
hNo header. (or, one header per screen in the BSD personality). The h option is problematic. Standard BSD ps uses this option to print a header on each page of output, but older Linux ps uses this option to totally disable the header. Linux ps follows the standard usage of not printing the header unless the BSD personality has been selected, in which case it prints a header on each page of output. Regardless of the current personality, you can use the long options –headers and –no-headers to enable printing headers each page or disable headers entirely, respectively.
-HShow process hierarchy (forest).
–headersRepeat header lines, one per page of output.
k specSpecify sorting order. Sorting syntax is “[+|]key[,[+|]key[,…]]”. Choose a multi-letter key from the STANDARD FORMAT SPECIFIERS section. The “+” is optional since default direction is increasing numerical or lexicographic order. Identical to –sort.

Examples:

ps jaxkuid,-ppid,+pid
ps axk comm o comm,args
ps kstart_time -ef
–lines nSet screen height.
-n namelistSet namelist file. Identical to N. The namelist file is needed for a proper WCHAN display, and must match the current Linux kernel exactly for correct output. Without this option, the default search path for the namelist is:

  • $PS_SYSMAP
  • $PS_SYSTEM_MAP
  • /proc/*/wchan
  • /boot/System.map-$(uname -r)
  • /boot/System.map
  • /lib/modules/$(uname -r)/System.map
  • /usr/src/linux/System.map
  • /System.map
nNumeric output for WCHAN and USER (including all types of UID and GID).
N namelistSpecify namelist file. Identical to -n; see -n, above.
–no-headersPrint no header line at all. –no-heading is an alias for this option.
O orderSorting order (overloaded). The BSD O option can act like -O (user-defined output format with some common fields predefined) or can be used to specify sort order. Heuristics are used to determine the behavior of this option. To ensure that the desired behavior is obtained (sorting or formatting), specify the option in some other way (e.g., with -O or –sort).

For sorting, obsolete BSD O option syntax is “O[+|]k1[,[+|]k2[,…]]”. It orders the processes listing according to the multilevel sort specified by the sequence of one-letter short keys k1,k2, … described in the OBSOLETE SORT KEYS section below. The “+” is currently optional, merely re-iterating the default direction on a key, but may help to distinguish an O sort from an O format. The “” reverses direction only on the key it precedes.

–rows nSet screen height.
SSum up some information, such as CPU usage, from dead child processes into their parent. This is useful for examining a system where a parent process repeatedly forks off short-lived children to do work.
–sort specSpecify sorting order. Sorting syntax is “[+|]key[,[+|]key[,…]]”. Choose a multi-letter key from the STANDARD FORMAT SPECIFIERS section. The “+” is optional since default direction is increasing numerical or lexicographic order. Identical to k. For example: “ps jax –sort=uid, -ppid,+pid
wWide output. Use this option twice for unlimited width.
-wWide output. Use this option twice for unlimited width.
–width nSet screen width.

Options: Thread Display

HShow threads as if they were processes.
-LShow threads, possibly with LWP and NLWP columns.
mShow threads after processes.
-mShow threads after processes.
-TShow threads, possibly with SPID column.

Options: Displaying Other Information

–help sectionPrint a help message. The section argument can be one of simplelistoutputthreadsmisc or all. The argument can be shortened to one of the underlined letters as in: s|l|o|t|m|a.
–infoPrint debugging info.
LList all format specifiers.
VPrint the procps-ng version.
-VPrint the procps-ng version.
–versionPrint the procps-ng version.

Notes

ps works by reading the virtual files in /procps does not need to be setuid kmem or have any privileges to run. Do not give this ps any special permissions.

This ps needs access to namelist data for proper WCHAN display. For kernels prior to 2.6, the System.map file must be installed.

CPU usage is currently expressed as the percentage of time spent running during the entire lifetime of a process. This is not ideal, and it does not conform to the standards of ps. CPU usage is unlikely to add up to exactly 100%.

The SIZE and RSS fields don’t count some parts of a process including the page tables, kernel stack, struct thread_info, and struct task_struct. This is usually at least 20 KiB of memory that is always resident. SIZE is the virtual size of the process (code+data+stack).

Processes marked <defunct> are dead processes (so-called “zombies”) that remain because their parent has not destroyed them properly. These processes will be destroyed by init if the parent process exits.

If the length of the username is greater than the length of the display column, the numeric user ID is displayed instead.

Process Flags

The sum of these values is displayed in the “F” column, which is provided by the flags output specifier:

1forked but didn’t exec
4used super-user privileges

Process State Codes

Here are the different values that the sstat and state output specifiers (header “STAT” or “S“) display to describe the state of a process:

Duninterruptible sleep (usually IO)
Rrunning or runnable (on run queue)
Sinterruptible sleep (waiting for an event to complete)
Tstopped, either by a job control signal or because it is being traced
Wpaging (not valid since the 2.6.xx kernel)
Xdead (should never be seen)
Zdefunct (“zombie”) process, terminated but not reaped by its parent

For BSD formats and when the stat keyword is used, additional characters may be displayed:

<high-priority (not nice to other users)
Nlow-priority (nice to other users)
Lhas pages locked into memory (for real-time and custom IO)
sis a session leader
lis multi-threaded (using CLONE_THREAD, like NPTL pthreads do)
+is in the foreground process group

Obsolete Sort Keys

These keys are used by the BSD O option (when it is used for sorting). The GNU –sort option doesn’t use these keys, but the specifiers described below in the STANDARD FORMAT SPECIFIERS section. Note that the values used in sorting are the internal values ps uses and not the “cooked” values used in some of the output format fields (e.g., sorting on tty will sort into device number, not according to the terminal name displayed). Pipe ps output into the sort command if you want to sort the cooked values.

keylong namedescription
ccmdsimple name of executable
CpcpuCPU utilization
fflagsflags as in long format F field
gpgrpprocess group ID
Gtpgidcontrolando o ID do grupo de processos tty
jcutimetempo acumulado do usuário
Jcstimetempo acumulado do sistema
kutimehora do usuário
mmin_fltnúmero de falhas menores na página
Mmaj_fltnúmero de falhas principais da página
ncmin_fltfalhas secundárias acumuladas na página
Ncmaj_fltfalhas cumulativas na página principal
osessãoidentificação de sessão
ppidID do processo
PppidID do processo pai
rrsstamanho do conjunto residente
Rresidentepáginas residentes
sTamanhotamanho da memória em kilobytes
Scompartilharquantidade de páginas compartilhadas
tttyo número do dispositivo do controle tty
Tstart_timeprocesso de tempo foi iniciado
vocêuidnúmero de identificação do usuário
vocêdo utilizadornome de usuário
vvsizetamanho total da VM em KiB
yprioridadeprioridade de agendamento do kernel

Descritores de Formato AIX

ps suporta descritores de formato AIX, que funcionam um pouco como os códigos de formatação de printf . Por exemplo, a saída padrão normal pode ser produzida com isso:

ps -eo "% p% y% x% c"

Os descritores de formato AIX são os seguintes:

códigonormalcabeçalho
% Cpcpu%CPU
% GgrupoGRUPO
% PppidPPID
%VOCÊdo utilizadorDO UTILIZADOR
%umaargsCOMANDO
% ccommCOMANDO
% grgroupRGROUP
% nlegaisNI
% ppidPID
% rpgidPGID
% tetimeELAPSED
%vocêruserRUSER
% xTempoTEMPO
% yttyTTY
% zvszVSZ

Especificadores de formato padrão

Aqui estão as diferentes palavras-chave que podem ser usadas para controlar o formato de saída (por exemplo, com a opção -o ) ou para classificar os processos selecionados com a opção GNU-style –sort .

Por exemplo: ” ps -eo pid, user, args –sort user “.

O ps tenta reconhecer a maioria das palavras-chave usadas em outras implementações do ps .

Os seguintes especificadores de formato definido pelo usuário podem conter espaços:

  • args
  • cmd
  • comm
  • comando
  • fname
  • ucmd
  • ucomm
  • lstart
  • bsdstart
  • começar

Algumas palavras-chave podem não estar disponíveis para classificação.

códigocabeçalhodescrição
%CPU%CPUCPU utilization of the process in “##.#” format. Currently, it is the CPU time used divided by the time the process has been running (cputime/real-time ratio), expressed as a percentage. It will not add up to 100% unless you are lucky. (alias: pcpu).
%mem%MEMratio of the process’s resident set size to the physical memory on the machine, expressed as a percentage. (alias: pmem).
argsCOMMANDcommand with all its arguments as a string. Modifications to the arguments may be shown. The output in this column may contain spaces. A process marked <defunct> is partly dead, waiting to be fully destroyed by its parent. Sometimes the process arguments will be unavailable; when this happens, ps will instead print the executable name in brackets. (alias: cmdcommand). See also the comm format keyword, the -f option, and the c option. When specified last, this column will extend to the edge of the display. If ps can not determine display width, as when output is redirected (piped) into a file or another command, the output width is undefined (it may be 80, unlimited, determined by the TERM variable, and so on). The COLUMNS environment variable or –cols option may be used to exactly determine the width in this case. The w or -w option may be also be used to adjust width.
blockedBLOCKEDmask of the blocked signals, see signals. According to the width of the field, a 32 or 64-bit mask in hexadecimal format is displayed. (alias: sig_blocksigmask).
bsdstartSTARTtime the command started. If the process was started less than 24 hours ago, the output format is “HH:MM“, else it is “Mmm:SS” (where Mmm is the three letters of the month). See also lstartstartstart_time, and stime.
bsdtimeTIMEaccumulated CPU time, user + system. The display format is usually “MMM:SS”, but can be shifted to the right if the process used more than 999 minutes of CPU time.
cCprocessor utilization. Currently, this is the integer value of the percent usage over the lifetime of the process. (see %cpu).
caughtCAUGHTmask of the caught signals, see signals. According to the width of the field, a 32 or 64 bits mask in hexadecimal format is displayed. (alias: sig_catchsigcatch).
cgroupCGROUPdisplay control groups to which the process belongs.
classCLSscheduling class of the process. (alias: policycls). Field’s possible values are:

not reported
TSSCHED_OTHER
FFSCHED_FIFO
RRSCHED_RR
BSCHED_BATCH
ISOSCHED_ISO
IDLSCHED_IDLE
?unknown value
clsCLSscheduling class of the process. (alias: policy, class). Field’s possible values are the same as for class, listed above.
cmdCMDsee args. (alias: argscommand).
commCOMMANDcommand name (only the executable name). Modifications to the command name will not be shown. A process marked <defunct> is partly dead, waiting to be fully destroyed by its parent. The output in this column may contain spaces. (alias: ucmducomm). See also the args format keyword, the -f option, and the c option.

When specified last, this column will extend to the edge of the display. If ps can not determine display width, as when output is redirected (piped) into a file or another command, the output width is undefined (it may be 80unlimited, determined by the TERM variable, and so on). The COLUMNS environment variable or –cols option may be used to exactly determine the width in this case. The w or -w option may be also be used to adjust width.

commandCOMMANDSee args. (alias: argscommand).
cpCPper-mill (tenths of a percent) CPU usage. (see %cpu).
cputimeTIMEcumulative CPU time, “[DD-]hh:mm:ss” format. (alias: time).
egidEGIDeffective group ID number of the process as a decimal integer. (alias: <bgid>).
egroupEGROUPeffective group ID of the process. This will be the textual group ID, if it can be obtained and the field width permits, or a decimal representation otherwise. (alias: group).
eipEIPinstruction pointer.
espESPstack pointer.
etimeELAPSEDelapsed time since the process was started, in the form “[[DD-]hh:]mm:ss“.
etimesELAPSEDelapsed time since the process was started, in seconds.
euidEUIDeffective user ID (alias: uid).
euserEUSEReffective username. This will be the textual user ID, if it can be obtained and the field width permits, or a decimal representation otherwise. The n option can be used to force the decimal representation. (alias: unameuser).
fFflags associated with the process, see the PROCESS FLAGS section. (alias: flagflags).
fgidFGIDfilesystem access group ID. (alias: fsgid).
fgroupFGROUPfilesystem access group ID. This will be the textual group ID, if it can be obtained and the field width permits, or a decimal representation otherwise. (alias: fsgroup).
flagFsee f. (alias: fflags).
flagsFsee f. (alias: fflag).
fnameCOMMANDfirst 8 bytes of the base name of the process’s executable file. The output in this column may contain spaces.
fuidFUIDfilesystem access user ID. (alias: fsuid).
fuserFUSERfilesystem access user ID. This will be the textual user ID, if it can be obtained and the field width permits, or a decimal representation otherwise.
gidGIDsee egid. (alias: egid).
groupGROUPsee egroup. (alias: egroup).
ignoredIGNOREDmask of the ignored signals, see signals. According to the width of the field, a 32 or 64 bits mask in hexadecimal format is displayed. (alias: sig_ignoresigignore).
labelLABELsecurity label, most commonly used for SE Linux context data. This is for the Mandatory Access Control (“MAC”) found on high-security systems.
lstartSTARTEDtime the command started. See also bsdstartstartstart_time, and stime.
lwpLWPlight weight process (thread) ID of the dispatchable entity (alias: spidtid). See tid for additional information.
maj_fltMAJFLTThe number of major page faults that have occurred with this process.
min_fltMINFLTThe number of minor page faults that have occurred with this process.
niNInice value. This ranges from 19 (nicest) to -20 (not nice to others). (alias: nice).
niceNIsee ni. (alias: ni).
nlwpNLWPnumber of lwps (threads) in the process. (alias: thcount).
nwchanWCHANaddress of the kernel function where the process is sleeping (use wchan if you want the kernel function name). Running tasks will display a dash (‘‘) in this column.
pcpu%CPUsee %cpu. (alias: %cpu).
pendingPENDINGmask of the pending signals. See signals. Signals pending on the process are distinct from signals pending on individual threads. Use the m option or the -m option to see both. According to the width of the field, a 32 or 64 bits mask in hexadecimal format is displayed. (alias: sig).
pgidPGIDprocess group ID or, equivalently, the process ID of the process group leader. (alias: pgrp).
pgrpPGRPsee pgid. (alias: pgid).
pidPIDa number representing the process ID (alias: tgid).
pmem%MEMsee %mem. (alias: %mem).
policyPOLscheduling class of the process. (alias: classcls). Possible values are:

not reported
TSSCHED_OTHER
FFSCHED_FIFO
RRSCHED_RR
BSCHED_BATCH
ISOSCHED_ISO
IDLSCHED_IDLE
?unknown value
ppidPPIDparent process ID.
priPRIpriority of the process. Higher number means lower priority.
psrPSRprocessor that process is currently assigned to.
rgidRGIDreal group ID.
rgroupRGROUPreal group name. This will be the textual group ID, if it can be obtained and the field width permits, or a decimal representation otherwise.
rssRSSresident set size, the non-swapped physical memory that a task has used (in kilobytes). (alias: rssizersz).
rssizeRSSsee rss. (alias: rssrsz).
rszRSZsee rss. (alias: rssrssize).
rtprioRTPRIOreal-time priority.
ruidRUIDreal user ID.
ruserRUSERreal user ID. This will be the textual user ID, if it can be obtained and the field width permits, or a decimal representation otherwise.
sSminimal state display (one character). See section PROCESS STATE CODES for the different values. See also stat if you want additional information displayed. (alias: state).
schedSCHscheduling policy of the process. The policies SCHED_OTHER (SCHED_NORMAL), SCHED_FIFOSCHED_RRSCHED_BATCHSCHED_ISO, and SCHED_IDLE are respectively displayed as 01234, and 5.
sessSESSsession ID or, equivalently, the process ID of the session leader. (alias: sessionsid).
sgi_pPprocessor that the process is currently executing on. Displays “*” if the process is not currently running or runnable.
sgidSGIDsaved group ID. (alias: svgid).
sgroupSGROUPsaved group name. This will be the textual group ID, if it can be obtained and the field width permits, or a decimal representation otherwise.
sidSIDsee sess. (alias: sesssession).
sigPENDINGsee pending. (alias: pendingsig_pend).
sigcatchCAUGHTsee caught. (alias: caughtsig_catch).
sigignoreIGNOREDsee ignored. (alias: ignoredsig_ignore).
sigmaskBLOCKEDsee blocked. (alias: blockedsig_block).
sizeSIZEapproximate amount of swap space that would be required if the process were to dirty all writable pages and then be swapped out. This approximation is very rough.
spidSPIDsee lwp. (alias: lwptid).
stackpSTACKPaddress of the bottom (start) of stack for the process.
startSTARTEDtime the command started. If the process was started less than 24 hours ago, the output format is “HH:MM:SS“, else it is ” Mmm dd” (where Mmm is a three-letter month name). See also lstartbsdstartstart_time, and stime.
start_timeSTARTstarting time or date of the process. Only the year will be displayed if the process was not started the same year ps was invoked, or “MmmDD” if it was not started the same day, or “HH:MM” otherwise. See also bsdstart, start, lstart, and stime.
statSTATmulti-character process state. See section PROCESS STATE CODES for the different values meaning. See also s and state if you just want the first character displayed.
stateSsee s. (alias: s).
suidSUIDsaved user ID. (alias: svuid).
supgidSUPGIDgroup ids of supplementary groups, if any.
supgrpSUPGRPgroup names of supplementary groups, if any.
suserSUSERsaved username. This will be the textual user ID, if it can be obtained and the field width permits, or a decimal representation otherwise. (alias: svuser).
svgidSVGIDsee sgid. (alias: sgid).
svuidSVUIDsee suid. (alias: suid).
szSZsize in physical pages of the core image of the process. This includes text, data, and stack space. Device mappings are currently excluded; this is subject to change. See vsz and rss.
tgidTGIDa number representing the thread group to which a task belongs (alias: pid). It is the process ID of the thread group leader.
thcountTHCNTsee nlwp. (alias: nlwp). number of kernel threads owned by the process.
tidTIDthe unique number representing an entity (alias: lwpspid). This value may also appear as: a process ID (pid); a process group ID (pgrp); a session ID for the session leader (sid); a thread group ID for the thread group leader (tgid); and a tty process group ID for the process group leader (tpgid).
timeTIMEcumulative CPU time, “[DD-]HH:MM:SS” format. (alias: cputime).
tnameTTYcontrolling tty (terminal). (alias: tttty).
tpgidTPGIDID of the foreground process group on the tty (terminal) that the process is connected to, or -1 if the process is not connected to a tty.
ttTTcontrolling tty (terminal). (alias: tnametty).
ttyTTcontrolling tty (terminal). (alias: tnamett).
ucmdCMDsee comm. (alias: commucomm).
ucommCOMMANDsee comm. (alias: commucmd).
uidUIDsee euid. (alias: euid).
unameUSERsee euser. (alias: euseruser).
userUSERsee euser. (alias: euseruname).
vsizeVSZsee vsz. (alias: vsz).
vszVSZvirtual memory size of the process in KiB (1024-byte units). Device mappings are currently excluded; this is subject to change. (alias: vsize).
wchanWCHANname of the kernel function in which the process is sleeping, a “” if the process is running, or a “*” if the process is multi-threaded and ps is not displaying threads.

Environment Variables

The following environment variables could affect ps:

COLUMNSOverride default display width.
LINESOverride default display height.
PS_PERSONALITYSet to one of posixoldlinuxbsdsundigital… (see section Personality below).
CMD_ENVSet to one of posixoldlinuxbsdsundigital… (see section Personality below).
I_WANT_A_BROKEN_PSForce obsolete command line interpretation.
LC_TIMEDate format.
PS_COLORSNot currently supported.
PS_FORMATDefault output format override. You may set this to a format string of the type used for the -o option. The DefSysV and DefBSD values are particularly useful.
PS_SYSMAPDefault namelist (System.map) location.
PS_SYSTEM_MAPDefault namelist (System.map) location.
POSIXLY_CORRECTDon’t find excuses to ignore bad “features”.
POSIX2When set to “on“, acts as POSIXLY_CORRECT.
UNIX95Don’t find excuses to ignore bad “features”.
_XPGCancel CMD_ENV=irix non-standard behavior.

In general, it is a bad idea to set these variables. The one exception is CMD_ENV or PS_PERSONALITY, which could be set to Linux for normal systems. Without that setting, ps follows the useless and bad parts of the Unix98 standard.

Personality

The following “personalities” affect the output of ps:

390like the OS/390 OpenEdition ps
aixlike AIX ps
bsdlike FreeBSD ps (totally non-standard)
compaqlike Digital Unix ps
debianlike the old Debian ps
digitallike Tru64 (was Digital Unix, was OSF/1) ps
gnulike the old Debian ps
hplike HP-UX ps
hpuxlike HP-UX ps
irixlike Irix ps
linuxThis is the recommended personality for ps.
oldlike the original Linux ps (totally non-standard)
os390like OS/390 Open Edition ps
posixThe personality which conforms to the POSIX standard.
s390like OS/390 Open Edition ps.
scolike SCO ps.
sgilike Irix ps.
solaris2like Solaris 2+ (SunOS 5) ps.
sunos4like SunOS 4 (Solaris 1) ps (totally non-standard).
svr4Standard.
sysvStandard.
tru64like Tru64 (was Digital Unix, was OSF/1) ps.
unixStandard.
unix95Standard.
unix98Standard.

Examples

To see every process running on the system, using the standard syntax:

ps -e
ps -ef
ps -eF
ps -ely

To see every process on the system, using BSD syntax:

ps ax
ps axu

To display a process tree:

ps -ejH
ps axjf

To get info about threads:

ps -eLf
ps axms

To get security info:

ps -eo euser,ruser,suser,fuser,f,comm,label
ps axZ
ps -eM

To see every process running as root (real and effective ID) in user format:

ps -U root -u root u

To see every process with a user-defined format:

ps -eo pid,tid,class,rtprio,ni,pri,psr,pcpu,stat,wchan:14,comm
ps axo stat,euid,ruid,tty,tpgid,sess,pgrp,ppid,pid,pcpu,comm
ps -Ao pid, tt, usuário, fname, tmout, f, wchan

Imprima apenas os IDs de processo de syslogd , o daemon syslog :

ps -C syslogd -o pid =

Imprima apenas o nome do processo ID 15 :

ps -p 15 -o comm =

bg – Reinicie um programa suspenso sem trazê-lo para o primeiro plano.
livre – Exibe a quantidade de memória livre e usada.
fusor – identifique processos usando arquivos ou soquetes.
kill – envia um sinal para um processo, afetando seu comportamento ou matando-o.
killall – mata processos por nome.
nice – Invoque um comando com uma prioridade de agendamento alterada.
pagesize – Mostrar o tamanho de uma página de memória em bytes.
pgrep – consulta processos com base no nome ou em outros atributos.
priocntrl – Exibe ou define os parâmetros de agendamento de um processo no Solaris.
pstree – exibe processos em um formato de árvore.
topo– Exiba uma lista classificável e continuamente atualizada de processos.
tty – Imprima o nome do arquivo do terminal conectado à entrada padrão.
tempo de atividade – Exibe informações sobre há quanto tempo o sistema está em execução.
who – Exibe informações sobre há quanto tempo o sistema está em execução.

21 de novembro de 2019

Sobre nós

A Linux Force Brasil é uma empresa que ama a arte de ensinar. Nossa missão é criar talentos para a área de tecnologia e atender com excelência nossos clientes.

CNPJ: 13.299.207/0001-50
SAC:         0800 721 7901

[email protected]

Comercial  Comercial: (11) 3796-5900

Suporte:    (11) 3796-5900
[email protected]

Copyright © Linux Force Security  - Desde 2011.