VMware ESXi and vSphere Cluster Management

How to List All Running Processes in Linux

Learn how to list and interpret Linux processes with ps, ps aux, ps -ef, pgrep, and top, including filtering, sorting, process states, and safe troubleshooting.

What Is a Linux Process?

A process is a running instance of a program. A program file is stored on disk, while a process is that program after the operating system has loaded it and begun executing it.

For example, nginx may be a program installed on the system. When the web server starts, Linux creates one or more nginx processes. Each process has its own:

PID: a numeric process identifier.
Owner: the user account running it.
Resource usage: such as CPU time and memory.
Parent process: the process that started it, identified by its PPID.
Execution state: such as running, sleeping, stopped, or zombie.
Terminal relationship: an associated controlling terminal, if it has one.

A command is an instruction you type into a shell. Running that command may create a process, but the command, program file, and process are not identical concepts.

Introducing the `ps` Command

ps means process status. It reports process status information such as identifiers, owners, states, resource usage, terminals, and commands.

ps produces a point-in-time snapshot. It does not continuously refresh the display. Run it again to obtain another snapshot, or use top for an interactive, continuously updated view.

The general syntax is:

ps [options]

Linux systems support several option conventions. Traditional UNIX options usually use a hyphen, BSD options commonly do not, and GNU-style long options use two hyphens. Therefore, ps -ef and ps aux use different option styles even though both produce detailed process listings.

View Processes from the Current Shell

Run ps without options:

ps

Plain ps generally shows processes associated with the current terminal or session. The output commonly includes:

PID: the process ID.
TTY: the controlling terminal.
TIME: accumulated CPU time.
CMD: the command that started the process.

You will often see the current shell and the ps command itself. The view is intentionally limited, so a service running elsewhere may not appear.

List Every Process on the System

Use ps -A to request all processes:

ps -A

ps -e is an equivalent all-process form on commonly used Linux implementations:

ps -e

The expanded listing can include processes owned by root, service accounts, system users, and logged-in users. Background services and daemons generally appear even when they are unrelated to your terminal.

Use the Common BSD-Style Form: `ps aux`

The command below is one of the most widely used ways to display a detailed list across users and terminal states:

ps aux

Its options have these meanings:

a: include processes for users with terminals, rather than limiting the view to your own processes.
u: use a user-oriented output format with fields such as USER, %CPU, and %MEM.
x: include processes without a controlling terminal, including many daemons and background services.

Because of a and x, ps aux usually provides a broad view of processes regardless of their owner or terminal.

Another Detailed Format: `ps -ef`

ps -ef uses a traditional UNIX-style option format and requests a full listing:

ps -ef

This format commonly includes the user, PID, PPID, start time, terminal, accumulated CPU time, and full command. It is particularly useful when you need to see parent-child relationships or a longer command line.

Compare Common Process Commands

Command	Scope	Refresh behavior	Best use case	Notes
`ps`	Processes associated with the current terminal	One snapshot	Quickly inspect the current shell session	Limited default output
`ps -A`	All system processes	One snapshot	Find processes missing from plain `ps`	`ps -e` is an equivalent common form
`ps aux`	All users, including processes without terminals	One snapshot	Detailed broad inspection	BSD-style options
`ps -ef`	All processes	One snapshot	Full UNIX-style listing and parent IDs	Uses hyphenated UNIX-style options
`top`	Processes and system activity	Continuously refreshes	Investigate changing CPU or memory usage	Press `q` to quit
`pgrep -a`	Processes matching a name or attribute	One lookup	Find PIDs without parsing a complete listing	Includes matching command lines with `-a`

Understand `ps` Output

Exact columns depend on the options and operating system implementation. These are common fields:

Field	Meaning	How to interpret it
USER	The account that owns the process	Shows whether the process belongs to you, a service account, or an administrator.
PID	Process ID	The numeric identifier used to inspect or address a specific process.
PPID	Parent process ID	Identifies the process that started this process.
%CPU	CPU-usage indicator	Use it as a diagnostic clue; a single snapshot may capture a temporary spike.
%MEM	Memory-usage indicator	Shows the process's proportion of system memory according to the selected format.
VSZ	Virtual memory size	The process's virtual address-space size; it is not the same as physical RAM in active use.
RSS	Resident set size	Memory currently resident in physical RAM, at a high level.
TTY	Controlling terminal	A question mark, often shown as `?`, commonly means the process has no controlling terminal.
STAT	Compact state and flag field	Shows whether the process is running, sleeping, stopped, a zombie, or in another state.
START or STIME	Process start time or date	The representation varies with the process age and the selected format.
TIME	Accumulated CPU time	It is CPU time consumed, not the wall-clock time since the process started.
COMMAND or CMD	Executable and, depending on format, its arguments	Use a full-command format when arguments are important or the displayed value is truncated.

Interpret Process States

The STAT field begins with a primary state letter. Additional letters may be flags, and the exact details can vary by Linux version and implementation.

Code	State	Practical meaning
`R`	Runnable or running	The process is executing or waiting in the run queue for CPU time.
`S`	Interruptible sleep	The process is waiting for an event and can normally be interrupted.
`D`	Uninterruptible sleep	Usually waiting for a kernel or device operation; it may not respond immediately to signals.
`T`	Stopped or traced	The process has been stopped, often by a job-control action or debugger.
`Z`	Zombie	The process has exited, but its parent has not yet collected its exit status.
`I`	Idle	Commonly indicates an idle kernel thread where supported.

A single state snapshot can be misleading. A process marked R may finish quickly, and a high CPU value may be a short-lived burst. Repeat the command or use top when behavior over time matters.

Find and Narrow Process Results

Search with `grep`

You can filter a detailed listing with a pipe and grep:

ps aux | grep '[n]ginx'

The bracketed pattern normally prevents the grep command itself from matching its own search text. Always confirm a match by checking its PID, owner, and full command line.

Use `pgrep` for Name-Based Lookup

pgrep is often cleaner when you want matching process IDs. The -a option also prints the matched command line:

pgrep -a nginx

This avoids parsing a complete ps listing, but process-name matching still requires confirmation because names can be similar.

Filter by User

Replace username with a local account name:

ps -u username

This limits the result to processes owned by that user.

Inspect One PID with Selected Fields

When you know a PID, request only the fields useful for diagnosis:

ps -p 1234 -o pid,ppid,user,stat,%cpu,%mem,etime,cmd

Replace 1234 with the actual PID. This example includes the parent PID, owner, state, resource indicators, elapsed time, and command line.

Sort by CPU or Memory

GNU-style ps supports sorting detailed output. A leading minus sign requests descending order:

ps aux --sort=-%cpu | head

ps aux --sort=-%mem | head

These commands identify processes with the highest reported CPU or memory values near the top. Treat the result as a starting point for investigation, not automatic proof that a process is faulty.

Request Full Command Lines

Terminal width and the selected format can truncate command information. Use a full listing:

ps -ef

For one process, an explicit field selection can help:

ps -p 1234 -o cmd=

The equals sign suppresses the column heading and leaves the command value.

Monitor Processes Live with `top`

top is an interactive monitor that repeatedly refreshes process and system resource information:

top

Use top when you are investigating an actively changing CPU or memory consumer. It can reveal whether a value remains high across multiple updates instead of relying on one ps snapshot. During a session, use the available sorting keys shown by your system; commonly, CPU and memory sorting can be selected interactively. Press q to quit.

Safe Process Troubleshooting Workflow

Start with a broad listing such as ps aux or ps -ef.
Identify the suspected service or command and note its PID.
Verify the full command line, owner, PPID, state, and resource values.
Use top or repeated snapshots to determine whether the behavior persists.
Only then decide whether the process needs further investigation or an authorized administrative action.

Ordinary users may see limited details about other users' processes and may be unable to manage them. Permission limits depend on the system's security settings. Use administrative privileges only when authorized, and verify the target PID before acting.

Troubleshooting Common Problems

A Process Is Missing from Plain `ps`

Plain ps commonly shows only processes tied to the current terminal. Expand the scope:

ps -A

You can also use ps -e, ps aux, or ps -ef.

A Service Has No Terminal

Daemons commonly have no controlling terminal, so their TTY field appears as ?. This is normally expected. Use ps aux or ps -A to include these processes.

`grep` Appears in Its Own Result

The search command can match its own search text. Use a bracketed pattern such as:

ps aux | grep '[n]ginx'

For name-based lookup, prefer:

pgrep -a nginx

A Process Shows High CPU

A snapshot may capture a temporary spike. Check the complete command and owner, then observe the process with top. High usage is a clue to investigate, not by itself a reason to terminate the process.

A Process Is in State `Z`

A zombie process has already exited. It remains listed until its parent collects its exit status. Inspect the parent:

ps -p 1234 -o pid,ppid,user,stat,cmd

Replace 1234 with the zombie's PID. Investigate the parent process or service rather than treating the zombie as an actively running program.

Permission Errors Occur

Visibility and process management are constrained by user privileges and system security settings. If authorized, use the appropriate administrative privileges, but verify the process identity and command before inspecting or managing it.

Quick Reference

Current terminal view: ps
All processes: ps -A or ps -e
Detailed all-user view: ps aux
Detailed UNIX-style view: ps -ef
Find a name and command line: pgrep -a process-name
Inspect selected fields for one PID: ps -p PID -o pid,ppid,user,stat,%cpu,%mem,etime,cmd
Watch changing activity: top

For a practical starting point, use this Linux process-listing guide as a reference while comparing snapshots, filtering results, and verifying processes safely.