Textbook of Linux

ps (process status) prints a snapshot of the currently running processes. Its flag syntax is notoriously inconsistent because it supports three different argument styles (BSD, Unix, and GNU) for historical reasons. In practice, two incantations cover almost every need.

ps aux                 # BSD style: all processes, full detail
ps -ef                 # Unix style: same idea, different columns
ps -efL                # include threads
ps -p 1234              # specific PID
ps --forest            # tree view
ps -o pid,user,cmd     # custom columns

The columns in ps aux are USER, PID, %CPU, %MEM, VSZ (virtual size), RSS (resident set size), TTY, STAT (state), START, TIME, and COMMAND. Process states include R (running), S (sleeping), D (uninterruptible sleep), Z (zombie), T (stopped), and I (idle kernel thread). The state also includes modifiers like < (high priority), N (low priority / nice), s (session leader), + (foreground), and l (multithreaded).

For an interactive, continually updated view, top or htop are the natural companions. But for scripting—piping, counting, searching—ps is still the tool of choice because its output is predictable.