10 Advanced ps Commands with Practical Examples in Linux

 

The ps (process status) command is one of the most powerful tools in a Linux administrator's toolkit. While most users know the basics — like ps aux — there are many advanced options that can help you monitor processes, debug performance issues, hunt down zombies, and inspect running services in fine detail.

If you are new to Linux processes, check out our detailed guide on Linux Process Management for Beginners before learning these advanced ps commands.

In this guide you will learn 10 advanced ps commands with practical, real-world examples you can start using right away.

What Is the ps Command in Linux?

The ps command displays information about active processes on your Linux system. It reads data from the /proc filesystem and supports three different syntax styles:

UNIX style — options preceded by a dash: ps -ef

BSD style — options without a dash: ps aux

BSD style — options without a dash: ps aux

You can mix these styles in multiple combinations which makes ps extremely flexible.

Prerequisites

•    A Linux system (Ubuntu, Debian, CentOS, Fedora, Arch, etc.)

•    Terminal access

•     Basic familiarity with the command line

No installation is needed — ps is part of the procps package and comes pre-installed on virtually every Linux distribution.

Basic syntax:

ps <options>

1. Show All Running Processes with Full Details

One of the most commonly used commands is:

ps aux

Output:

What it does:

a - shows processes for all users

u - Displays user-oriented format (CPU, memory, start time)

x - Includes processes not attached to a terminal

Use case: This is your go-to command for a full system wide process audit. Use it when you want to view all that is running in the machine including background daemons.

Pro tip: Pipe it through less for easier reading:

ps aux | less

2. Display Process Hierarchy as a Tree

To display processes in hierarchical tree structure command is:

ps -e --forest

Output:

What it does:

Shows parent-child relationships between processes using ASCII art indentation, making it easy to see which processes spawned which.

Features:

•    Easy to read

•     Visual tree using ASCII characters

•     Best for quickly understanding process relationships

•    Commonly used for troubleshooting

Or

ps -ejH

Output:

What it does

-e - show all processes

-j - jobs format output

-H - show process hierarchy

Features:

More technical/detailed output

Includes:

•   PID

•   PGID

•   SID

•   TTY

•   CPU time

Better is for the scripting and administration.

Which One Should You Use?

Use ps -e --forest command when you require a clean visual process tree.

Use ps -ejH command when you need detailed process/session information for debugging or administration.

Want to become good in Linux administration? Explore more Linux Basic commands for beginners and administrators.

3. Filter Processes by Name Using grep

This command is used to filter processes by name using grep:

ps aux | grep bash

Output:

What it does:

| Pipe gives output of ps aux into grep to filter results by process name, making it easy to check if a specific service is running.

Use case: Quickly confirm whether nginx, mysql, apache2 or any other service is active.

Pro tip: To exclude the grep process itself from results:

ps aux | grep '[b]ash'

4. Sort Processes by CPU Usage

This command sorts processes by CPU usage:

ps aux --sort=-%cpu | head -10

Output:

What it does:

--sort=-%cpu  —  sorts descending by CPU usage (the - means descending)

head -10  —  limits the output to top 10 processes

Use case: Instantly identify which process is consuming the most CPU. Useful when a server is slow and you need to quickly identify the source of the problem.

5. Sort Processes by Memory Usage

To sort processes by memory usage command is:

ps aux --sort=-%mem | head -10

Output:

What it does:

Same as the CPU sort, but ranked by resident memory usage (%MEM column — actual physical RAM consumed).

Use case: Find the memory leaks or determine which service is consuming RAM.

Pro tip: Use rss instead of %mem to sort by raw kilobytes:

ps aux --sort=-rss | head -10

6. Display Custom Output Columns

This command is used to display custom output:

ps -eo pid,ppid,user,%cpu,%mem,comm

Output:

What it does:

The -o flag lets you define exactly which columns to appear. Common fields include:

Field	Description
pid	Process ID
ppid	Parent Process ID
user	Process owner
%cpu	CPU usage percentage
%mem	Memory usage percentage
comm	Command name (short)
cmd	Full command with arguments
etime	Elapsed running time
lstart	Exact start date and time
nice	Nice value (priority)
stat	Process state

Use case: Builds clean output for scripts, log files or monitoring pipelines where you only need specific fields.

7. Watch Processes in a Real Time

This command is used to watch processes in real time:

watch -n 2 'ps aux --sort=-%cpu | head -15'

 What it does:

•     watch -n 2 - re-runs the command every 2 seconds

•     The quoted command refreshes the top 15 CPU consumers continuously

Use case: This provides a lightweight real-time process monitoring — useful on servers where htop is not installed or in scripts that need live output without a dependency.

Pro tip: Highlight changes between refreshes:

watch -n 2 -d 'ps aux --sort=-%cpu | head -15'

The -d flag brings out a distinction between the current and the previous update.

8. Show Threads of a Specific Process

This command is used to show threads of a specific process:

ps -p <PID> -L -o pid,tid,pcpu,comm

Replace <PID> with your target process ID.

Example:

ps -p 8096 -L -o pid,tid,pcpu,comm

Output:

What it does:

•     -L         —      expands the process into its individual threads

•      tid       —      shows each thread's unique thread ID

•      pcpu   —      shows per-thread CPU usage

Use case: Debugging of multi-threaded applications — Java services, Python async apps and Node.js workers — where one thread might be spinning while others idle.

9.  Filter Processes by Command Name

Instead of using grep, you can directly filter by command name.

ps -C bash

Output:

This method is clean and faster to locate specific applications.

New to Linux? Read Why Learn Linux? Real-World Uses, Career Opportunities and Practical Benefits to understand how Linux skills can help you to grow your IT career.

10. Show Environment Variables of a Process

This command displays environment variables of a process:

ps eww -p <PID>

Example:

ps eww -p 8096

Output:

What it does:

•    e - prints the environment variables of the process

•     ww -  disables line truncation so long environment strings are not cut off

Use case: Security audits (check what secrets or tokens are in a process's environment), verifying runtime configuration of services, and inspecting container entrypoints without exec-ing into the container.

Quick Commands Reference

 

Command	Purpose
ps aux	All processes with full details
ps -e --forest	Display process tree hierarchy
ps aux | grep <name>	Filter processes by name
ps aux --sort=-%cpu | head -10	Show top CPU consuming processes
ps aux --sort=-%mem | head -10	Show top memory consuming processes
ps -eo pid,ppid,user,%cpu,%mem,comm	Display custom output columns
watch -n 2 'ps aux --sort=-%cpu | head -15'	Live process monitoring every 2 seconds
ps -p <PID> -L -o pid,tid,pcpu,comm	Show threads of a specific process
ps -C name	Show processes by command name
ps eww -p <PID>	Display process environment variables

ps vs top vs htop

Linux provides several tools to view and management of processes, but each serves a different purpose.

Tool	Purpose	Real-Time Monitoring	Best Use Case
ps	Displays a snapshot of running processes	No	Filtering, sorting, scripting, and detailed process inspection
top	Shows live system and process activity	Yes	Monitoring CPU and memory usage in real time
htop	Interactive and user-friendly version of top	Yes	Easier process management with a better interface

Frequently Asked Questions (FAQs)

Q1.What is the difference between ps aux and ps -ef?

Both show all processes. ps aux uses BSD syntax and includes %CPU and %MEM columns. ps -ef uses UNIX syntax and includes the parent PID (PPID) and full format listing. They are functionally similar, the choice is mostly personal preference.

Q2.How can I find the PID of a process quickly?

Use pgrep <name> for a quick results or ps aux | grep <name> for more detail.

Q3.Can ps monitor processes in a real time?

Not natively — it takes a snapshot. Combine it with watch (as shown in command 7) for a live refresh, or use top/htop for true real-time monitoring.

Q4.Is ps available on macOS?

 Yes, macOS includes a BSD version of ps. Most options work the same though some GNU-specific flags like --forest and --sort may differ. Use ps aux and ps -ef safely on the both platforms.

Q5. Is ps command available by default on all Linux distributions?

Yes, the ps command is included in almost all Linux distributions including:

•   Ubuntu

•   Debian

•   CentOS

•   RHEL

•   Fedora

•   Arch Linux

📌 Related Articles

• Linux Process Management for Beginners – Complete Guide 2025
• Monitor Linux System Performance with top and htop
• Why Learn Linux? Real-World Uses, Career Opportunities and Practical Benefits

Conclusion

The ps command is capable far more than most Linux users realize. From custom output columns to thread level inspection, from zombie hunting to live process watching, mastering these 10 advanced ps commands will make you significantly more effective at Linux process management, performance debugging and system administration.

Bookmark this guide and keep the quick command reference in mind when next time server will misbehave, you know the exact ps command to use and continue visiting seeklinux.

Author: Aqeel Anwar

SeekLinux Team
Linux Engineers | DevOps | Security Enthusiasts

SeekLinux Team shares practical Linux tutorials, SSL/TLS certificate guides, commands and DevOps solutions. Our goal is to simplify system administration and help you master real-world server and security tasks.

Learn more about us →