ps command in detail


Here are the possible codes when using state "$ ps -e -o state,cmd"


PROCESS STATE CODES
D   uninterruptible sleep (usually IO)
R   runnable (on run queue)
S   sleeping
T   traced or stopped
Z   a defunct ("zombie") process

<    high-priority (not nice to other users)
N    low-priority (nice to other users)
L    has pages locked into memory (for real-time and custom IO)
s    is a session leader
l    is multi-threaded (using CLONE_THREAD, like NPTL pthreads do)
+    is in the foreground process group

For instance:

Note that the -o is for user defined, and -e is for select
all process.

$ ps -e -o pid,state,start,time,etime,cmd

...
9946 S 15:40:45 00:00:00    02:23:29 /bin/bash -i
9985 T 15:41:24 00:00:01    02:22:50 emacs mout2
10003 T 15:43:59 00:00:00    02:20:15 emacs NOTES
10320 T 17:38:42 00:00:00       25:32 emacs stuff.c
...

You may want to command below, without the -e, which will give the
process only under the current terminal.

$ ps -o pid,state,start,time,etime,cmd

Want to find what 's impacting your load?

$ ps -e -o %cpu,pid,state,start,time,etime,%cpu,%mem,cmd|sort -rn|less



$ ps aux

USER       PID %CPU %MEM   VSZ  RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.0  1380  480 ?        S    Aug04   0:00 init [3]
root         2  0.0  0.0     0    0 ?        SWN  Aug04   0:00 [ksoftirqd/0]
root         3  0.0  0.0     0    0 ?        SW<  Aug04   0:00 [events/0]
root         4  0.0  0.0     0    0 ?        SW<  Aug04   0:00 [khelper]
...

Or, if you want to see the environment add the -e option

$ ps aeux

...
chirico   2735  0.0  0.1  4400 1492 pts/0    S    Aug04   0:00 -bash USER=chirico LOGNAME=chirico HOME=/home/chirico PATH=/usr/
chirico   2771  0.0  0.0  4328  924 pts/0    S    Aug04   0:00 screen -e^Pa -D -R HOSTNAME=third-fl-71.localdomain TERM=xterm S
chirico   2772  0.0  0.6  9476 6352 ?        S    Aug04   0:54 SCREEN -e^Pa -D -R HOSTNAME=third-fl-71.localdomain TERM=xterm S
chirico   2773  0.0  0.1  4432 1548 pts/1    S    Aug04   0:10 /bin/bash STY=2772.pts-0.third-fl-71 TERM=screen TERMCAP=SC|scre
chirico   2797  0.0  0.1  4416 1496 pts/2    S    Aug04   0:00 /bin/bash STY=2772.pts-0.third-fl-71 TERM=screen TERMCAP=SC|scre
root      2821  0.0  0.0  4100  952 pts/2    S    Aug04   0:00 su -
root      2822  0.0  0.1  4384 1480 pts/2    S    Aug04   0:00 -bash
chirico   2862  0.0  0.1  4428 1524 pts/3    S    Aug04   0:00 /bin/bash STY=2772.pts-0.third-fl-71 TERM=screen TERMCAP=SC|scre
sporkey   2946  0.0  0.2  6836 2960 ?        S    Aug04   0:15 fetchmail
chirico   2952  0.0  0.1  4436 1552 pts/5    S    Aug04   0:00 /bin/bash STY=2772.pts-0.third-fl-71 TERM=screen TERMCAP=SC|scre
chirico   3880  0.0  0.1  4416 1496 pts/6    S    Aug05   0:00 /bin/bash STY=2772.pts-0.third-fl-71 TERM=screen TERMCAP=SC|scre
root      3904  0.0  0.0  4100  956 pts/6    S    Aug05   0:00 su - donkey
donkey    3905  0.0  0.1  4336 1452 pts/6    S    Aug05   0:00 -bash
donkey    3938  0.0  0.2  6732 2856 ?        S    Aug05   0:14 fetchmail
chirico   3944  0.0  0.1  4416 1496 pts/7    S    Aug05   0:00 /bin/bash STY=2772.pts-0.third-fl-71 TERM=screen TERMCAP=SC|scre
...

There is also a -f "forrest" option. Also note below " -bash" is the start of a login shell.

$ ps aeuxwwf

The ww option above gives a wide format with all variables. Use the above command if you plan
to parse through a Perl script. Otherwise, it may be easier to do a quick read using the command
below, without "ww".   

$ ps aeuxf

...
root      2339  0.0  0.1  3512 1444 ?        S    Dec01   0:00 /usr/sbin/sshd
root     25651  0.0  0.1  6764 1980 ?        S    Dec23   0:00  \_ /usr/sbin/sshd
chirico  25653  0.0  0.2  6840 2236 ?        S    Dec23   0:14      \_ /usr/sbin/sshd
chirico  25654  0.0  0.1  4364 1440 pts/4    S    Dec23   0:00          \_ -bash USER=chirico LOGNAME=chirico HOME=/home/chirico
chirico  25690  0.0  0.0  4328  920 pts/4    S    Dec23   0:00              \_ screen -e^Pa -D -R HOSTNAME=third-fl-71.localdomain TERM=xterm
root      2355  0.0  0.0  2068  904 ?        S    Dec01   0:00 xinetd -stayalive -pidfile /var/run/xinetd.pid
...

It is also possible to list the process by command line. For example, the following command will only list the emacs
processes.

$ ps -fC emacs
UID        PID  PPID  C STIME TTY          TIME CMD
chirico   5049  5020  0 May11 pts/13   00:00:00 emacs -nw Notes
chirico  12368  5104  0 May12 pts/18   00:00:00 emacs -nw dnotify.c
chirico  19792 18028  0 May13 pts/20   00:00:00 emacs -nw hello.c
chirico  14034 27367  0 18:52 pts/8    00:00:00 emacs -nw How_to_Linux_and_Open_Source.txt

You may also want to consider using top in batch mode. Here the "-n 1" means refresh once,
and the "b" is for batch. The "fmt -s" is to put it in a more readable format.

$ top -n 1 b |fmt  -s >>statfile