List Running Processes on Raspberry Pi with ps

Learn how to use ps, ps -A, and ps aux on Raspberry Pi OS to list processes, read CPU and memory usage, interpret states, and investigate services safely.

A Linux system runs many programs at the same time. To inspect them from a Raspberry Pi terminal, use ps, which stands for process status. This lesson explains how to list processes, understand the output, and investigate a process without stopping it accidentally.

You should already know how to open a terminal and run basic shell commands. See Terminal in Raspbian if you need to review terminal basics.

What is a process?

A process is a running instance of a program managed by the operating system. For example, when you run a command such as ls, the shell starts a process to execute that command. A web server, desktop application, shell, and system service are also processes.

Each process has a numeric process ID, usually abbreviated PID. The PID identifies that particular process while it exists. Processes also run with an owning user and a group context. These credentials affect which files and system resources the process can access.

A background service is often called a daemon. Daemons commonly start during boot and may run without an interactive terminal. This is why a process listing from one terminal does not necessarily show every program running on the Raspberry Pi.

What the ps command does

ps takes a point-in-time snapshot of processes. It prints a listing when you run it and then exits; it does not continuously refresh the screen. For a continuously updating display, use a tool such as top or htop.

A process listing can help you identify:

Which commands are running
Which user owns each process
Each process's PID
CPU and memory use
Whether a process is connected to a terminal
The current or recent process state

View processes from the current terminal with ps

Run the command without options:

ps

The default selection is limited. On a typical Linux system, it generally shows processes associated with the current terminal session, such as the shell and the ps command itself. It does not mean that only those few processes are running on the Raspberry Pi.

  PID TTY          TIME CMD
 2146 pts/0    00:00:00 bash
 2891 pts/0    00:00:00 ps

The basic output commonly includes:

PID: the process identifier
TTY: the terminal associated with the process
TIME: accumulated CPU time
CMD: the command name

List all processes with ps -A

To view processes across the system, use the -A option:

ps -A

This broader listing includes processes started outside the current shell, including system services and other users' processes when the operating system permits them to be displayed. The PID and command name are useful starting points when you are trying to locate a particular application or service.

  PID TTY          TIME CMD
    1 ?        00:00:04 systemd
  721 ?        00:00:00 sshd
 2146 pts/0    00:00:00 bash
 2910 pts/0    00:00:00 ps

Compare common ps command forms

Command	Processes included	Output style	Best use
`ps`	Usually processes associated with the current terminal	Short basic listing	Checking commands in the current shell
`ps -A`	Processes across the system	Basic system-wide listing	Finding services and processes outside the current terminal
`ps aux`	All selectable processes, including those without a controlling terminal	Detailed, user-oriented listing	Investigating ownership, CPU, memory, state, and command lines

Use ps aux for a detailed listing

A commonly used form is:

ps aux

Linux's ps accepts this traditional option style without leading hyphens. In ps aux:

a expands process selection beyond processes belonging to the current terminal. In this traditional form, it includes processes associated with other users.
u selects a user-oriented format with fields such as owner, CPU use, memory use, and start time.
x includes processes without a controlling terminal, which is important for daemons and many background services.

The detailed view is useful when diagnosing high CPU or memory use and when locating the owner of a process.

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
pi        2146  0.0  0.4  10432  5120 pts/0    Ss   09:12   0:00 -bash
pi        3012  0.1  0.2   8420  2688 pts/0    S+   09:20   0:01 tail -f /var/log/syslog
root       721  0.0  0.8  15800  9024 ?        Ss   09:05   0:00 /usr/sbin/sshd

Understand ps aux columns

Column	Meaning	Typical unit or format	Why it matters
USER	User account that owns the process	Account name	Shows whose permissions and credentials the process uses
PID	Process identifier	Number	Distinguishes one process instance from another
%CPU	CPU utilization reported by `ps`	Percentage	Helps identify processor-intensive processes
%MEM	Percentage of physical memory associated with the process	Percentage	Helps compare memory use between processes
VSZ	Virtual memory size used by the process	Usually KiB	Shows the process's virtual address-space size; it is not the same as physical RAM currently held
RSS	Resident set size: physical, non-swapped memory currently held by the process	Usually KiB	Provides a more direct indication of RAM currently resident for the process
TTY	Controlling terminal, if one exists	For example, `pts/0` or `?`	Shows whether the process is connected to an interactive terminal
STAT	Compact process state and attribute field	Letters such as `Ss` or `R+`	Indicates whether the process is running, sleeping, stopped, or a zombie, plus selected attributes
START	When the process started	Clock time for newer processes, or a date for older ones	Helps determine whether the process is recent or long-running
TIME	Total accumulated CPU time consumed	Hours:minutes:seconds	Shows processor time accumulated by the process, not wall-clock age
COMMAND	The invocation used to create the process	Command and arguments	Identifies the executable, options, files, or other arguments involved

VSZ and RSS are different. VSZ includes virtual memory mappings and other address-space reservations. RSS measures physical memory currently resident for the process and normally excludes memory that has been swapped out. Neither value alone explains all shared-memory behavior.

Interpret CPU values with context. %CPU expresses CPU use relative to elapsed running time as reported by ps, while TIME is the accumulated amount of actual CPU time consumed. A process can have been running for hours while using very little CPU, or it can accumulate CPU time quickly while doing intensive work.

TTY may contain a value such as pts/0 for a pseudo-terminal, or ? when no controlling terminal exists. A service with ? is not automatically suspicious; this is normal for many daemons.

The COMMAND field can include arguments, so it often gives more information than an executable name alone. It can distinguish, for example, two instances of the same program watching different files.

Read process state information

STAT is a compact field. Its first letter is the primary process state; additional letters describe selected attributes.

State code	General meaning	Administrative interpretation
R	Running or runnable	The process is executing or waiting for CPU time
S	Interruptible sleep	The process is waiting for an event, input, or a timer; this is common and usually normal
D	Uninterruptible sleep	The process is usually waiting for I/O, such as storage or a device; investigate persistent or numerous entries
T	Stopped	The process has been stopped, often by job control or a debugging action
Z	Zombie	The process has terminated but its parent has not yet collected its exit status

Extra letters can indicate attributes such as session leadership, foreground-process-group membership, multithreading, or locked memory. For example, an s may identify a session leader and a + may indicate a foreground process group. Exact flags can vary with the Linux ps implementation, so interpret them with a state-code reference.

Do not judge a process from STAT alone. Consider its CPU use, memory values, start time, accumulated CPU time, owner, and complete command. A sleeping process may simply be waiting for input, and a stopped process may have been intentionally paused.

Example: identify a log-monitoring command

Suppose you intentionally ran a file-following command in a terminal to watch a system log:

tail -f /var/log/syslog

In ps aux, its row might have these characteristics:

The USER value is your interactive account.
The COMMAND field contains tail -f /var/log/syslog.
The TTY value identifies the terminal where you started it.
The process is usually sleeping while it waits for new log content, so CPU use is low.

This example shows why the full command, terminal, owner, and state are more useful together than an executable name by itself.

Safe process-inspection workflow

Start narrowly with ps when checking commands launched from the current shell.
Use ps -A when you need a system-wide list of PIDs and command names.
Use ps aux when you also need owners, CPU and memory values, terminal information, state, and complete invocations.
Before taking administrative action, record the target PID, owner, state, relevant resource values, and complete command.
Investigate an unfamiliar process before stopping it. Do not treat it as disposable merely because it appears in a listing.

Troubleshoot common ps results

The output contains only a few entries

This is normally caused by running ps without selection options. The default view is restricted to the current terminal context. Run ps -A or ps aux to expand the listing.

A background service is missing from ps

Many services were not started from your active shell and have no controlling TTY. Run ps aux, then inspect the TTY and COMMAND columns. A ? in TTY is common for terminal-less services.

A process appears to use substantial memory

Compare its RSS and %MEM values with the other processes. Identify the command and owner, then investigate the related application or service before stopping anything. VSZ alone is not a reliable measure of physical RAM pressure.

A process name is not enough to identify it

Several instances can use similar executable names. Compare the PID, USER, TTY, START, and full COMMAND field to distinguish them.

A state code looks unfamiliar

STAT combines a primary state with optional attribute flags. Consult a state-code reference and assess the process using its command, resource values, and duration rather than the code in isolation.

Quick reference

# Processes associated with the current terminal
ps

# Processes across the system
ps -A

# Detailed listing, including terminal-less processes
ps aux

For interactive monitoring, see List Processes in Real Time. For related command-line practice, see Useful Terminal Commands.