VMware ESXi and vSphere Cluster Management

List Running Processes on Raspberry Pi with ps

Learn how to use ps, ps -A, and ps aux on Raspberry Pi OS to list processes, identify PIDs and owners, and investigate CPU and memory usage.

On Raspberry Pi OS, programs such as terminal shells, desktop applications, services, and scripts run as processes. The ps command—short for process status—lets you inspect those processes from a terminal.

This guide covers the basic ps command, system-wide listings with ps -A, and the detailed ps aux format commonly used on Raspberry Pi OS and other Linux systems.

What is a process?

A program is executable code that can be run. A process is a currently executing instance of that program. For example, the tail program is executable code, while a particular tail -f /var/log/syslog command running now is a process.

Launching a terminal command normally creates a process. The shell may wait for that process to finish, or it may start it in the background and continue accepting commands.

Every running process receives a numeric process ID (PID). The PID identifies that particular process when you inspect it or perform a later administrative action. Processes also run under a user account and associated group identities. These identities affect which files, devices, and other resources the process can access.

The following relationship is useful to remember:

A user account launches a command.
The command runs a program.
The operating system creates a process.
The operating system assigns the process a PID.

Introduction to ps

ps reports process status as a point-in-time listing. It takes a snapshot when you run it; the display does not continuously refresh. For a continuously updating view, a tool such as top or htop is more appropriate.

The basic command structure is:

ps [options]

With no options, ps uses its default selection and output format. Options change which processes are selected, which columns are displayed, or how the output is formatted. Linux systems support several option conventions, so -A and aux do not look identical syntactically: -A is a Unix-style option, while aux is a commonly used BSD-style combination. The procps implementation supplied on Raspberry Pi OS accepts the commonly used ps aux form.

View processes connected to the current terminal with ps

Run:

ps

Typical output resembles:

    PID TTY          TIME CMD
   1842 pts/0    00:00:00 bash
   2917 pts/0    00:00:00 ps

The exact PIDs, terminal name, and commands will differ. The common columns are:

PID: the process identifier.
TTY: the terminal associated with the process.
TIME: accumulated CPU time used by the process.
CMD: the command name.

The shell, such as bash, normally appears because it is the process interpreting your commands. The ps command may also appear because it is running while the snapshot is taken.

Only a small number of rows may appear because plain ps normally selects processes associated with the current terminal session. It may not show desktop applications, system services, scheduled jobs, or other users' processes that are not connected to that terminal.

List every process with ps -A

To display processes across the system, use the -A option:

ps -A

This output includes processes from the current terminal as well as services and background processes started elsewhere. It is useful when you need to locate a PID or see which commands started processes throughout the system.

    PID TTY          TIME CMD
      1 ?        00:00:04 systemd
    612 ?        00:00:01 sshd
   1842 pts/0    00:00:00 bash
   3091 pts/0    00:00:00 ps

A ? in the TTY column means that the process has no controlling terminal associated with the displayed process. This is normal for many services and background tasks.

Use ps aux for detailed process information

The commonly used command below requests an all-process listing with user-oriented details:

ps aux

In this form:

a includes processes associated with terminals, including processes belonging to other users.
u selects a user-oriented format with owner, resource, timing, and state fields.
x includes processes that do not have a controlling terminal.

Together, these options provide a practical view of interactive programs, services, desktop components, and other background processes. Use ps when you need a quick view of the current terminal, ps -A when you mainly need a system-wide process and command list, and ps aux when you also need ownership and resource information.

An illustrative row might look like this:

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
pi        3174  0.1  0.2  10240  4096 pts/0    S+   10:24  00:00 tail -f /var/log/syslog

This example shows a process owned by pi, with PID 3174, running a log-monitoring command in the current terminal.

How to read ps aux columns

Column	Meaning	Units or format	How to use it when diagnosing activity
USER	The account that owns the process.	User name	Distinguish your processes from system or service processes. Ownership also indicates which permissions the process normally has.
PID	The process identifier.	Number	Use it to identify one exact process before taking any administrative action.
%CPU	CPU consumption relative to the process's elapsed runtime.	Percentage	Look for unusually high values when investigating processor load. A snapshot is not the same as a continuously updated measurement.
%MEM	The proportion of physical memory represented by the process's resident memory.	Percentage	Help identify processes with a large current memory footprint.
VSZ	Total virtual memory size associated with the process.	Usually KiB	Shows virtual address-space allocation, but does not by itself mean that all of that memory occupies RAM.
RSS	Resident set size: memory held in physical RAM and not swapped out.	Usually KiB	Use it with %MEM to investigate current physical-memory use. RSS is generally more directly useful than VSZ for this purpose.
TTY	The controlling terminal associated with the process.	Terminal name or `?`	Identify interactive shell activity. A question mark commonly indicates a service or background process without a controlling terminal.
STAT	A compact process-state indicator and related attributes.	Short code, such as `S` or `R`	Use it as a clue about whether a process is sleeping, running, stopped, or has other attributes. Consult local `ps` documentation for every state-code detail.
START	The recorded time or date when the process started.	Time or date	Determine whether a process is recent or long-running.
TIME	Cumulative CPU time consumed by the process.	Usually hours:minutes:seconds	Distinguish how much processor time a process has actually used from how long it has existed.
COMMAND	The executable and arguments used to launch the process.	Command line	Confirm what the process is doing and whether it belongs to a shell command, application, or service.

KiB means kibibytes, a binary memory unit commonly used in Linux output. In particular, do not interpret a large VSZ as an equal amount of RAM currently consumed. A process can reserve or map a large virtual address space while only a smaller portion is resident, as shown by RSS.

Filter a process listing with grep

If you know part of a program name or command line, pipe the detailed listing to grep:

ps aux | grep '[t]ail'

The pipe sends the output of ps aux to grep, which prints lines containing the selected text. The bracket pattern matches the letters in tail, but the literal search text in the grep command itself is written as [t]ail, so that command normally does not match its own output.

Replace tail with a distinctive executable name or command fragment. Filtering does not change system state; it only reduces what is displayed. Treat a match as a starting point for verification. Check the PID, USER, and complete COMMAND field before concluding that it is the process you intended to find.

Use process information for troubleshooting

Observed clue	Relevant ps field	Likely interpretation	Safe next check
Unexpected CPU usage	%CPU, PID, COMMAND	A process may be performing intensive work or repeatedly waking up.	Run another snapshot, confirm the PID and full command, and check whether the activity is expected.
High memory use	%MEM, RSS, VSZ	The process may have a large resident footprint. VSZ may be much larger than the RAM currently in use.	Compare RSS and %MEM across processes, then inspect the owner and command.
Unknown process owner	USER, PID, COMMAND	The process may belong to a system account, service, another user, or installed software.	Record the PID, owner, and full command, then verify the associated software before managing it.
No controlling terminal	TTY, USER, START, COMMAND	The process may be a service, daemon, desktop component, or background task.	Review the other fields together. A missing terminal is not automatically a problem.
Recently started process	START, PID, COMMAND	A new application, scheduled task, service restart, or background job may explain the process.	Check whether the command and owner match an action or service expected at that time.

Example: a slow or unresponsive Raspberry Pi

Start with a detailed snapshot:

ps aux

Look for unusually high %CPU values.
Compare %MEM and RSS to find processes occupying substantial physical memory.
Use USER to distinguish a personal application from a system or service process.
Read COMMAND to understand what was launched and with which arguments.
Use START and TIME together: a process can have existed for a long time without consuming much CPU, or it can have accumulated substantial CPU time.

Example: a process without a terminal

A TTY value of ? often appears for services, daemons, graphical-session components, and other background tasks. Review USER, START, and COMMAND together. Do not assume that the missing terminal indicates a failure.

Safe process-inspection practices

Important: Listing processes with ps is non-destructive. It reads process information and does not stop, restart, or modify a process.

Do not terminate an unfamiliar process solely because it appears in the output. Raspberry Pi OS normally has operating-system services, networking components, scheduled tasks, and graphical-session processes running in the background.

Before any process-management action, confirm:

The exact PID, rather than relying only on a command name.
The USER account that owns it.
The complete COMMAND line and its arguments.
Whether the process is an expected service, application, or background task.

Process IDs can be reused after a process exits, so recheck the PID immediately before taking administrative action. Inspection should come first; management commands such as signals or service controls require a separate, deliberate decision.

Which ps form should you use?

Command	Scope of processes shown	Detail level	Best use
`ps`	Processes associated with the current terminal session.	Compact: PID, TTY, CPU time, and command.	Quickly see the current shell and commands running in that terminal.
`ps -A`	All processes on the system.	System-wide but relatively compact.	Locate PIDs and command names, including services and background processes.
`ps aux`	All processes, including those without controlling terminals.	Detailed user-oriented fields and command lines.	Investigate ownership, CPU, memory, terminal, state, start time, and accumulated CPU time.

Common problems and their causes

Plain ps shows only the shell and ps

This is usually expected: the default selection is limited to the active terminal. Run ps -A for a system-wide list, or use ps aux when you need owners and resource fields.

The Pi feels slow

Review %CPU and %MEM in ps aux. Compare RSS values to identify physical-memory use, then inspect USER and COMMAND before deciding whether a process is unexpected.

VSZ is high but RSS is lower

This means the process has a larger virtual address-space allocation than the amount currently resident in physical RAM. Use RSS and %MEM as more direct indicators of the current RAM footprint; do not interpret VSZ alone as active RAM consumption.

An unfamiliar command appears

It may be a legitimate service, package component, personal application, or scheduled task. Record its PID, owner, and full command line, then verify which installed software or service is associated with it before attempting process management.

Key points

A process is an executing instance of a program, and its PID identifies it.
Processes run under user and group identities that affect permissions and ownership.
ps provides a snapshot, not a continuously updating display.
Plain ps is limited to the current terminal session.
ps -A lists processes across the system.
ps aux is useful for detailed ownership, CPU, memory, terminal, state, timing, and command information.
Always confirm the PID, USER, and full COMMAND before taking process-management action.

For more process-listing practice, return to the Raspberry Pi process-listing guide.