These classnotes are depreciated. As of 2005, I no longer teach the classes. Notes will remain online for legacy purposes

UNIX01/Viewing Running Processes

Classnotes | UNIX01 | RecentChanges | Preferences

The ps Command

If you want to know what processes are currently running, you can use ps (this stands for process status). By itself, ps, doesn't return much information; but there are a large number of options available to help you determine what processes are running. Perhaps the best group of options is -au, which lists all processes (the "a") along with the name of the user (the "u") who started it.

 [selfg@localhost selfg]$ ps -au

 USER    PID %CPU %MEM   VSZ  RSS TTY    STAT START   TIME COMMAND
 selfg  2273  0.8  1.1  4244 1400 pts/0  S    12:10   0:00 bash 
 selfg  2306  0.0  0.5  2540  676 pts/0  R    12:11   0:00 ps -au

 [selfg@localhost selfg]$

When you look at this listing you'll notice several columns of information:

USER
This who started the process - and is, thus, the owner of that process. You'll note, for example, selfg owns both of the processes listed.
PID
The process identification number. A unique number identifies each process and it is this number that is used to work with a process (to kill it, for example). You'll note that PID 2273 is my bash shell. The PID is a "one-up" number, so as new processes are started they will get constantly higher numbers. Therefore, the PID for some process on your computer will be different from those you see in this listing.
%CPU
This is how much CPU time the process is using. Remember, this is a snapshot and will change from second to second as processes are started and stopped. You'll notice that the bash shell is only taking .8% of my CPU capacity.
%MEM
This is how much memory the process is using.
VSZ
The amount of virtual memory needed by the process. We will cover virtual memory in the next class.
RSS
The amount of actual (or "real") memory needed by the process.
TTY
What terminal the process is using. (The "TTY" comes from the industry-wide abbreviation for "Teletype" since original Unix computers used these devices for input and output.) The processes on this page are attached to the default terminal used when the computer was booted. We will look at TTYs later.
STAT
The current status of the process. In Linux, processes have several possible statuses:
    • R. Running. This process is actually executing.
    • S. Sleeping. This process is ready to run but must wait for the operating system to give it some CPU time.
    • D. Uninterruptible sleep. Usually this is some sort of input process that can only be awakened by the input device. For example, if your modem is constantly "on" but just waiting on a signal from outside we would say that is in an uninterruptible sleep status. This status is about like a "blocked" state discussed in the theory section.
    • T. Trace. This process is being debugged by a programmer and is temporarily halted.
    • Z. Zombie. This is a process that is no longer valid. Normally this is due to a poorly written program where a parent process was killed and its child processes was left in a "zombie" status. If nothing else, Unix has some cool names for process status - where else could you claim you killed a zombie created by a daemon?
START
The time the process started.
TIME
The amount of time the process has spent on the CPU.
COMMAND
The command used to start the process.

Let's take a look at another ps listing:

 [selfg@localhost selfg]$ ps -aux

 USER    PID %CPU %MEM   VSZ  RSS TTY   STAT START   TIME COMMAND
 root      1  0.0  0.3  1308  456 ?     S    08:12   0:04 init
 root      2  0.0  0.0     0    0 ?     SW   08:12   0:00 [keventd]
 root      3  0.0  0.0     0    0 ?     SWN  08:12   0:00 [ksoftirqd_CPU0]
 root      8  0.0  0.0     0    0 ?     SW   08:12   0:00 [bdflush]
 root      4  0.0  0.0     0    0 ?     SW   08:12   0:00 [kswapd]
 root      5  0.0  0.0     0    0 ?     SW   08:12   0:00 [kscand/DMA]
 root      6  0.0  0.0     0    0 ?     SW   08:12   0:11 [kscand/Normal?]
 root      7  0.0  0.0     0    0 ?     SW   08:12   0:00 [kscand/HighMem?]
 root      9  0.0  0.0     0    0 ?     SW   08:12   0:00 [kupdated]
 root     10  0.0  0.0     0    0 ?     SW   08:12   0:00 [mdrecoveryd]
 root     14  0.0  0.0     0    0 ?     DW   08:12   0:00 [kjournald]
 selfg  1441  0.0  0.8 18544 1024 ?     S    08:15   0:05 gnome-session
 selfg  1484  0.0  0.0  3068   64 ?     S    08:15   0:00 /usr/bin/ssh-agen
 selfg  1487  0.0  1.5 11188 1896 ?     S    08:15   0:09 /usr/libexec/gcon
 selfg  1489  0.0  0.1  6328  228 ?     S    08:15   0:02 /usr/libexec/bono
 selfg  1491  0.0  0.3 17428  484 ?     S    08:15   0:02 gnome-settings-da
 selfg  1496  0.0  0.1  2544  220 ?     S    08:15   0:00 fam
 selfg  1501  0.0  0.3  3508  424 ?     S    08:15   0:02 xscreensaver -nos
 selfg  1504  0.1  2.2 12848 2788 ?     S    08:15   0:19 metacity --sm-sav
 selfg  1506  0.0  0.3 16500  464 ?     S    08:15   0:03 magicdev --sm-con
 selfg  1508  0.1  2.3 30328 2920 ?     S    08:15   0:17 nautilus --sm-con
 selfg  1510  0.2  3.6 21568 4556 ?     S    08:15   0:38 gnome-panel --sm-
 selfg  1515  0.2  1.0 16888 1312 ?     S    08:15   0:31 eggcups --sm-conf
 selfg  1517  0.0  0.8 11580 1024 ?     S    08:15   0:01 /usr/bin/pam-pane
 selfg  1519  1.7  5.0 27564 6320 ?     S    08:15   4:17 /usr/bin/python /
 root   1609  0.0  0.1  2188  228 ?     S    08:22   0:00 login -- babbagec
 turinga 1700  0.0  0.2  4232  284 tty4  S    09:09   0:00 -bash
 hopperg 1743  0.0  0.2  4232  292 tty5  S    09:17   0:00 -bash
 selfg  2362  3.4  3.8 24188 4824 ?     S    12:14   0:11 evolution
 selfg  2449 35.0  0.5  2644  724 pts/0 R    12:25   0:00 ps -aux

 [selfg@localhost selfg]$

This listing shows all of the process - even those with no terminal (that is what the "x" option does). You'll note that selfg is listed as the owner of several processes. Also notice that near the end of the listing you can see where other users logged on. Process 1441 is where a Gnome session was started and process 2449 is the ps command ran to get this list. You'll note that ps was at 12:25pm, but it did not take much CPU time. (The amount of time for the CPU is listed as 0:00 minutes (the 10th column). The command actually did take a few milliseconds to complete, but not enough time to register for this listing.)

The pstree Command

Sometimes you may want to see some sort of heirarchy of processes. That would allow you to know which processes started (or "spawned") other processes. The command pstree prints to the screen a graphic representation of the various processes on your computer and what process started each. Remember that we are working with a text shell, so the "graphic representation" is a pretty simplified version using only ASCII characters. In the next listing, you can see that init spawned all other processes (recall that init is the first process that runs in Linux; it initializes the entire system). You can see that some process called "X" spawned the Gnome session.

 [selfg@localhost selfg]$ pstree

 init---atd
     |-bdflush
     |-bonobo-activati
     |-bonobo-moniker-
     |-crond
     |-cupsd
     |-dhclient
     |-eggcups
     |-esd
     |-evolution
     |-evolution-addre
     |-evolution-alarm
     |-evolution-calen
     |-evolution-execu
     |-evolution-mail---evolution-mail---5*[evolution-mail]
     |-gconfd-2
     |-gdm-binary---gdm-binary---X
     |                         |-gnome-session---ssh-agent
     |-gnome-panel
     |-gnome-settings-
     |-gnome-terminal---bash---pstree
     |                |-gnome-pty-helpe
     |-gpm
     |-keventd
     |-2*[kjournald]
     |-klogd
     |-kscand/DMA
     |-kscand/HighMem?
     |-kscand/Normal?
     |-ksoftirqd_CPU0
     |-soffice.bin---soffice.bin---4*[soffice.bin]
     |-sshd
     |-syslogd
     |-wombat
     |-xfs
     |-xinetd---fam
     |-xscreensaver

 [selfg@localhost selfg]$

The top Command

It's sometimes useful to be able to monitor processes and see which process at any given moment is using CPU, memory, and other resources. The top command can be used for this purpose. Top runs constantly and displays the current status of the system (updated every five seconds). The next listing shows top running on my computer. Do be careful about running top since it uses a lot of computer resources as it executes. It will slow down your machine, so only use it on occasion or if you suspect some process is a "run-away".

 [selfg@localhost selfg]$ top

 12:30:50  up  4:18,  7 users,  load average: 0.86, 0.81, 0.79
 90 processes: 89 sleeping, 1 running, 0 zombie, 0 stopped
 CPU states:  28.2% user   2.7% system   2.9% nice   0.0% iowait  66.1% idle
 Mem:   126376k av,  122812k used,    3564k free,       0k shrd,   26300k buff
                     89580k actv,      64k in_d,    1616k in_c
 Swap:  257032k av,   61896k used,  195136k free                   36936k cached

  PID USER     PRI  NI  SIZE  RSS SHARE STAT %CPU %MEM   TIME CPU COMMAND
 2465 selfg     20   0  1068 1068   848 R    12.6  0.8   0:00   0 top
 2462 selfg     15   0   712  712   552 D    10.9  0.5   0:04   0 find
 2463 selfg     15   0   716  716   552 D     9.2  0.5   0:02   0 find
 1519 selfg     16   0  8968 4696  1260 S     6.7  3.7   4:23   0 rhn-applet-gui
 1429 root      15   0 15520 5384   800 S     0.8  4.2  60:03   0 X
    1 root      15   0   480  448   424 S     0.0  0.3   0:04   0 init
    2 root      15   0     0    0     0 SW    0.0  0.0   0:00   0 keventd
    3 root      34  19     0    0     0 SWN   0.0  0.0   0:00   0 ksoftirqd_CPU0
    8 root      15   0     0    0     0 SW    0.0  0.0   0:00   0 bdflush
    4 root      15   0     0    0     0 SW    0.0  0.0   0:01   0 kswapd
    5 root      15   0     0    0     0 SW    0.0  0.0   0:00   0 kscand/DMA
    6 root      15   0     0    0     0 SW    0.0  0.0   0:11   0 kscand/Normal?
    7 root      15   0     0    0     0 SW    0.0  0.0   0:00   0 kscand/HighMem?
    9 root      15   0     0    0     0 SW    0.0  0.0   0:00   0 kupdated
   10 root      25   0     0    0     0 SW    0.0  0.0   0:00   0 mdrecoveryd
   14 root      15   0     0    0     0 SW    0.0  0.0   0:01   0 kjournald
  658 root      15   0     0    0     0 SW    0.0  0.0   0:00   0 kjournald
  981 root      15   0   816  612   544 S     0.0  0.4   0:00   0 dhclient
 1040 root      15   0   536  472   456 S     0.0  0.3   0:00   0 syslogd
 1044 root      15   0   412  396   356 S     0.0  0.3   0:00   0 klogd
 1062 rpc       15   0   496  428   424 S     0.0  0.3   0:00   0 portmap
 1081 rpcuser   25   0   632  552   548 S     0.0  0.4   0:00   0 rpc.statd
 1177 root      25   0   740  504   500 S     0.0  0.3   0:04   0 sshd
 1191 root      15   0   724  576   572 S     0.0  0.4   0:00   0 xinetd
 1210 ntp       15   0  2312 2312  2076 S     0.0  1.8   0:00   0 ntpd
 1230 root      15   0   896  392   244 S     0.0  0.3   0:00   0 sendmail
 1239 smmsp     15   0   592  104    56 S     0.0  0.0   0:00   0 sendmail

The first line in the display shows the time the command was executed, the amount of time the computer has been on (the "uptime"), the number of users logged on, and the "load averages." The three load averages are the average number of processes ready to run in the last 1, 5, and 15 minutes.

The second line shows the number of processes currently executing, broken down into running, sleeping, zombie, and stopped.

The third line shows the states of the CPU. In the listing above, my CPU spent 28.2% of its time completing user tasks, 2.7% with system tasks, 2.9% nice tasks, 0.0% waiting for input or output, and 66.1% idle.

The forth and fifth lines summarize the memory usage. On my computer, I had about 126M available, used about 122M, had about 3M free, had no shared memory, and I had about 26M of memory used for buffers. Line five breaks memory into active, D, and C registers.

The next line shows the statistics on swapping. I had about 257M of swap space available, was using about 61M, had 195M free, and had cached about 36M.

The largest section of the top display shows the various processes running. The columns for this section indicate:

PID
Process Identification Number
USER
The user's name
PRI
The task priority
NI
The nice value of the task
SIZE
The size of the task's code, plus data, plus stack space (kilobytes)
RSS
The amount of real (or physical) memory being used by the task (kilobytes)
SHARE
The amount of shared memory being used by the task
STAT
The task's status: Running (R), Sleeping (S), Uninterruptible Sleep (D), Zombie (Z), and Stopped (T). A "W" indicates the process is swapped out and an "N" indicates a positive nice value.
%CPU
The task's share of CPU time
%MEM
The task's share of memory
TIME
The amount of time the task has been running
CPU
The CPU number handling the task (only useful if the computer is using multiple CPUs)
COMMAND
The command that started the task

You'll notice that I'm running two "find" commands and together they are using about 19% of my CPU's capacity. Of course, on my computer there is not much else going on, so that is OK. However, if I were the system administrator for a large system and found a couple of processes using that much CPU time I would likely kill them.



Classnotes | UNIX01 | RecentChanges | Preferences
This page is read-only | View other revisions
Last edited August 8, 2003 10:36 pm (diff)
Search:
(C) Copyright 2003 Samuel Hart
Creative Commons License
This work is licensed under a Creative Commons License.