The ps command is a crucial tool in Linux for monitoring running processes. It displays information about the processes running on your system, helping you manage system resources, identify issues, and kill unnecessary processes. One of the most commonly used variations of this command is ps -ef.

In this article, we will explore how the ps -ef command works and how to use it effectively, using practical examples.

Understanding the -e and -f Options

The -e option tells ps to display all processes running on the system, not just those associated with the current terminal. The -f option stands for full-format listing, which includes additional details about each process.

To get a comprehensive view of all the processes on your system, you can use the ps -ef command:

ps -ef

Output:

UID        PID  PPID  C STIME TTY          TIME CMD
root         1     0  0 09:22 ?        00:00:02 /sbin/init
root       719     1  0 09:22 ?        00:00:00 /usr/lib/systemd/systemd-journald
root      1369     1  0 09:22 ?        00:00:00 /usr/sbin/sshd -D
user      1421  1369  0 09:22 ?        00:00:00 sshd: user [priv]
user      1422  1421  0 09:22 pts/0    00:00:00 -bash
user      1567  1422  0 09:22 pts/0    00:00:00 ps -ef

This command shows all running processes, regardless of the terminal. Each column in the output provides essential information about the processes.

Here’s what each column in the ps -ef output means:

  • UID: The user ID of the process owner.
  • PID: The Process ID of the running process.
  • PPID: The Parent Process ID, which refers to the process that spawned this one.
  • C: CPU utilization of the process.
  • STIME: Start time of the process.
  • TTY: The terminal associated with the process.
  • TIME: Total CPU time used by the process.
  • CMD: The command that started the process.

Filtering Processes with ps -ef

You can filter specific processes using the grep command with ps -ef. For example, if you want to see all processes related to Apache, you can run:

ps -ef | grep apache

Output:

root      1350     1  0 09:25 ?        00:00:00 /usr/sbin/apache2 -k start
www-data  1352  1350  0 09:25 ?        00:00:00 /usr/sbin/apache2 -k start
www-data  1353  1350  0 09:25 ?        00:00:00 /usr/sbin/apache2 -k start
user      1365  1422  0 09:26 pts/0    00:00:00 grep --color=auto apache

This shows all Apache-related processes. The last line with grep is the actual command we used to search.

Using ps -ef to Find Parent and Child Processes

Every process in Linux is either a parent or a child process. The PPID (Parent Process ID) field helps you identify the parent process of a given child process. You can use the ps -ef command to check the parent-child relationship of processes.

For better visualization, you can use the ps -ef –forest option, which displays a tree of processes:

ps -ef --forest

Output:

root         1     0  0 09:22 ?        00:00:02 /sbin/init
 ├─/usr/lib/systemd/systemd-journald
 ├─/usr/sbin/sshd -D
 │   └─sshd: user [priv]
 │       └─sshd: user [priv]
 │           └─/bin/bash
 └─ps -ef --forest

This tree structure helps you understand how processes are related, which is especially useful when debugging.

Sorting the ps -ef Output

You can sort the output of ps -ef based on different criteria, such as CPU usage, memory usage, or PID. For example, to sort processes by CPU usage in descending order, use:

ps -ef --sort=-pcpu

Output:

UID        PID  PPID  C STIME TTY          TIME CMD
user      1367  1369  2 09:25 pts/0    00:00:02 firefox
user      1345  1341  1 09:22 pts/0    00:00:01 gnome-shell
user      1567  1422  0 09:22 pts/0    00:00:00 ps -ef --sort=-pcpu

This example sorts processes by their CPU usage (represented by the C column).

Listing Processes for a Specific User

To list all processes running under a specific user, you can combine ps -ef with grep. For example, to list all processes run by the current user:

ps -ef | grep $USER

Output:

user      1422  1421  0 09:22 pts/0    00:00:00 -bash
user      1367  1369  2 09:25 pts/0    00:00:02 firefox
user      1567  1422  0 09:22 pts/0    00:00:00

This shows only the processes owned by the logged-in user.

Killing a Process with ps -ef and kill

When you identify a process that needs to be stopped, you can use its PID from the ps -ef output and terminate it with the kill command. For example, to kill a process with PID 1350:

kill 1350

To ensure the process is terminated, you can recheck by running ps -ef again.

Using ps -ef to Monitor System Performance

ps -ef can also be used for performance monitoring by identifying high CPU or memory-consuming processes. For example, to list processes consuming the most memory, use:

ps -ef --sort=-pmem

Output:

UID        PID  PPID  C STIME TTY          TIME CMD
user      1367  1369  1 09:25 pts/0    00:01:05 firefox
root      1001     1  0 09:20 ?        00:00:50 apache2
user      1345  1341  0 09:22 pts/0    00:00:30 gnome-shell

This output helps you identify memory-heavy processes so you can take action if needed.

Conclusion

The ps -ef command is a powerful tool for process management in Linux. It allows you to easily view, filter, and manage running processes. Whether you’re troubleshooting system performance, monitoring resource usage, or managing applications, ps -ef is an essential command to know. You can now use ps -ef command to manage processes on dedicated server hosting from Atlantic.Net!