The Linux Command Tutorial series provides rigorous, upstream-verified references for essential system commands across Linux distributions and UNIX-like environments. Each article focuses on a single executable, combining exhaustive option documentation, verified real-world examples, security boundaries, and best practices directly derived from official source documentation and POSIX standards.

---

1. Introduction

Upstream: procps-ng 4.0.4 | POSIX: POSIX.1-2024 (with GNU extensions) | Safety Tier: safe-read-only | Scope: process-inspection

ps (process status) displays information about active processes currently running on the system. It inspects the Linux /proc virtual pseudo-filesystem, parsing /proc/[pid]/stat, status, cmdline, and cgroups to report CPU, memory, thread hierarchy, and execution states.

• Upstream Project & Provenance: Maintained within the procps-ng project (procps-ng).
• Portability & Standards Baseline: Standardized in IEEE Std 1003.1-2024 (POSIX.1-2024). Linux ps is unique in supporting three distinct syntax conventions: UNIX (prefixed by -), BSD (no hyphen), and GNU long options (prefixed by --).
• Target Research Implementation: Audited against procps-ng 4.0.4 (ps(1)).
• Applicability & Lifecycle: The foundational tool for point-in-time process inspection, monitoring resource usage, and script-based pid resolution.

---

2. Syntax and Command Model

2.1 The Three Syntax Conventions

1. UNIX (POSIX) Style: Options prefixed with a single hyphen (-):

   ps -ef

2. BSD Style: Options specified without hyphens:

   ps aux

3. GNU Long Options: Options prefixed with double hyphens (--):

   ps --forest --sort=-%mem

Note on syntax collision: ps -u (UNIX) queries processes owned by a specific user list; ps u (BSD) activates user-oriented detailed format. Mixing styles without awareness can lead to syntax confusion.

---

3. Options

3.1 Process Selection Flags

Flag	Style	Description	POSIX Defined
-A, -e	UNIX	Select all processes on the system.	Yes
a	BSD	Select all processes with a TTY, including other users' processes.	No
x	BSD	Select processes without controlling TTYs (daemons, background workers).	No
-u user	UNIX	Select processes by effective user ID or name.	Yes
-p pid	UNIX	Select processes by Process ID.	Yes
-C cmd	UNIX	Select by command executable name.	No

3.2 Output Formatting Flags

Flag	Style	Description
-f	UNIX	Full-format listing (UID, PID, PPID, C, STIME, TTY, TIME, CMD).
-l	UNIX	Long format (F, S, UID, PID, PPID, C, PRI, NI, ADDR, SZ, WCHAN, TTY, TIME, CMD).
u	BSD	User-oriented format (USER, PID, %CPU, %MEM, VSZ, RSS, TTY, STAT, START, TIME, COMMAND).
-o format	UNIX	User-defined custom format table.
-H, --forest	Both	Display ASCII process hierarchy tree.

---

4. Basic Usage

4.1 Quick-Reference Cheatsheet Card

Operation	Command	Notes
BSD full snapshot	ps aux	Detailed snapshot of all running processes
POSIX standard listing	ps -ef	All processes with UID, PID, PPID
Top CPU consumers	ps aux --sort=-%cpu | head -n 10	Sorts descending by CPU percentage
Top memory consumers	ps aux --sort=-%mem | head -n 10	Sorts descending by RAM consumption
Process tree view	ps -ef --forest	Shows ASCII parent-child hierarchy
Custom scriptable fields	ps -eo pid,user,%cpu,%mem,comm	Selects precise columns
Inspect threads	ps -T -p <pid>	Lists Lightweight Processes (LWP) for PID

4.2 Standard BSD Process Snapshot (aux)

ps aux | head -n 5

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.1 168340 12892 ?        Ss   Sep10   0:04 /sbin/init
root         2  0.0  0.0      0     0 ?        S    Sep10   0:00 [kthreadd]
root         3  0.0  0.0      0     0 ?        I<   Sep10   0:00 [rcu_gp]
syslog    1120  0.0  0.0 220450  4120 ?        Ssl  Sep10   0:01 /usr/sbin/rsyslogd -n

4.3 Standard POSIX Full Listing (-ef)

ps -ef | head -n 4

UID        PID  PPID  C STIME TTY          TIME CMD
root         1     0  0 Sep10 ?        00:00:04 /sbin/init
root         2     0  0 Sep10 ?        00:00:00 [kthreadd]
daemon     412     1  0 Sep10 ?        00:00:00 /usr/sbin/atd -f

---

5. Practical Operations

5.1 Custom Machine-Readable Output via -o

Extracting precisely the PID, memory usage, CPU percentage, and command path:

ps -eo pid,ppid,%cpu,%mem,rss,comm --sort=-rss | head -n 5

  PID  PPID %CPU %MEM   RSS COMMAND
 4512  4500  1.2  8.4 689400 mysqld
 8912     1  0.5  4.2 345000 java
 1204     1  0.0  1.8 148000 node
  412     1  0.0  0.2  16800 systemd-journal

• Technical Analysis: rss reports Resident Set Size (actual physical memory in KiB); --sort=-rss sorts the entire process table descending by RAM consumption.

5.2 Visualizing Parent-Child Process Trees

Inspecting service sub-worker relationships using --forest:

ps -ef --forest | grep -A 4 nginx

root      4512     1  0 08:00 ?        00:00:00 nginx: master process /usr/sbin/nginx
www-data  4513  4512  0 08:00 ?        00:00:04  \_ nginx: worker process
www-data  4514  4512  0 08:00 ?        00:00:04  \_ nginx: worker process
www-data  4515  4512  0 08:00 ?        00:00:04  \_ nginx: worker process

5.3 Thread-Level Process Inspection

Viewing all execution threads (LWP) belonging to a specific multi-threaded application:

ps -T -p 4512

  PID   LWP TTY          TIME CMD
 4512  4512 ?        00:00:01 mysqld
 4512  4513 ?        00:00:14 mysqld
 4512  4514 ?        00:00:00 mysqld

---

6. Advanced Usage

6.1 Decoding the STAT Process State Codes

The STAT column encodes Linux kernel scheduler states:

• Primary States:
  • R: Running or runnable (on run queue).
  • S: Interruptible sleep (waiting for an event/input).
  • D: Uninterruptible sleep (usually blocked on synchronous disk/NFS I/O). Cannot be killed by SIGKILL.
  • Z: Defunct / Zombie (terminated, waiting for parent to call wait()).
  • T: Stopped by job control signal (SIGTSTP or SIGSTOP).
• Additional Modifiers:
  • <: High-priority (nice < 0).
  • N: Low-priority (nice > 0).
  • s: Session leader.
  • l: Multi-threaded.
  • +: Foreground process group.

---

7. Exit Status, Environment, and Configuration

7.1 Exit Status Codes

Exit Code	Meaning
0	Success: process table inspected.
>0	An error occurred (syntax error in -o, PID not found, permission failure).

---

8. Safety, Security, and Portability

8.1 Command-Line Truncation and Environment Leaks

WARNING

Arguments passed to executables appear in cleartext via /proc/[pid]/cmdline and are visible to all users running ps aux. Never pass credentials, passwords, or secret tokens via command-line flags (e.g. mysql -pSECRET). In multi-tenant systems, configure /proc with hidepid=2 to isolate process visibility.

---

9. Best Practices

1. Use ps -eo ... for Shell Automation:
   • Guidance: Avoid parsing ps aux in scripts; use ps -eo pid=,comm=.
   • Authoritative Justification: Appending = suppresses the header row, outputting deterministic whitespace-delimited columns.
2. Sort at the Source via --sort:
   • Guidance: Use ps --sort=-%cpu instead of piping into external sort.
   • Authoritative Justification: procps-ng performs in-memory numeric sorting before output, preserving table alignment.
3. Inspect Zombie Processes Promptly:
   • Guidance: Audit STAT column for Z.
   • Authoritative Justification: Zombie processes retain PID entries in kernel process tables; excess zombies can lead to PID exhaustion.

---

References

1. procps-ng ps(1) Manual: https://man7.org/linux/man-pages/man1/ps.1.html
2. POSIX.1-2024 ps Specification: The Open Group Base Specifications Issue 8. https://pubs.opengroup.org/onlinepubs/9799919799/utilities/ps.html