ps Command in Linux: ps aux and Common Options

When a Linux system feels slow, a service stops responding, or you need to know what a user is running, the first step is often to inspect the process list. A process is a running instance of a program, and Linux tracks each one with a process ID, owner, state, CPU time, memory usage, and command line.

The ps command prints a snapshot of those running processes. Unlike top or htop , it does not update in real time. That makes ps useful for quick checks, scripts, one-time troubleshooting, and pipelines with tools such as grep , less , and watch .

This guide explains how to use ps aux, ps -ef, and other ps command options to list, filter, sort, and understand running processes in Linux.

ps Command Syntax #

The basic syntax is:

ps [OPTIONS]

The Linux ps command accepts three option styles:

• UNIX options, such as -e and -f, use a leading dash.
• BSD options, such as aux, do not use a dash.
• GNU long options, such as --sort, use two dashes.

You will often see these styles mixed in real commands, but it is easier to read and troubleshoot ps output when you understand which style a command is using.

Running ps without options shows processes owned by your current user and attached to the current terminal:

ps

  PID TTY          TIME CMD
 1809 pts/0    00:00:00 bash
 2043 pts/0    00:00:00 ps

The default output is small because it only shows the current shell and commands running from it. For system troubleshooting, you usually want ps aux or ps -ef.

ps aux Command #

The most common ps command for listing all processes is:

ps aux

This is BSD-style syntax. In this combination, the letters mean:

• a - Show processes attached to a terminal, including processes owned by other users.
• u - Use a user-oriented format with CPU and memory columns.
• x - Include processes without a controlling terminal, such as daemons and services.

Together, aux gives you a detailed process snapshot across the system:

USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root           1  0.0  0.4 168708 12708 ?        Ss   08:15   0:02 /sbin/init
root         741  0.0  0.2  33472  7228 ?        Ss   08:15   0:00 /usr/sbin/cron -f
www-data    1518  0.3  1.7 241844 52240 ?        S    08:16   0:04 nginx: worker process
dejan       2852  0.0  0.1  10132  4380 pts/0    Ss   09:02   0:00 -zsh
dejan       3019  0.0  0.0  11020  3592 pts/0    R+   09:04   0:00 ps aux

Each row is one process. The columns show who owns it, which PID identifies it, how much CPU and memory it uses, and which command started it.

The COMMAND column is often the most useful part of ps aux because it shows the program and its arguments. If the command line is cut off, use ps auxww, covered later in this guide.

ps aux vs ps -ef #

Another common way to list all processes is:

ps -ef

This is UNIX-style syntax:

• -e - Select all processes.
• -f - Use full-format output.

Example output:

UID          PID    PPID  C STIME TTY          TIME CMD
root           1       0  0 08:15 ?        00:00:02 /sbin/init
root         741       1  0 08:15 ?        00:00:00 /usr/sbin/cron -f
www-data    1518     920  0 08:16 ?        00:00:04 nginx: worker process
dejan       2852    2847  0 09:02 pts/0    00:00:00 -zsh
dejan       3026    2852  0 09:05 pts/0    00:00:00 ps -ef

Both commands list all processes, but the default columns differ:

Use ps aux when you want CPU and memory information. Use ps -ef when you care about parent process IDs or prefer UNIX-style options.

Finding Processes by Name #

To search for a process by name, many users pipe ps aux to grep:

ps aux | grep nginx

The output may include the grep command itself because its command line also contains the search term:

root         920  0.0  0.5  55280 16888 ?        Ss   08:16   0:00 nginx: master process /usr/sbin/nginx
www-data    1518  0.3  1.7 241844 52240 ?        S    08:16   0:04 nginx: worker process
dejan       3091  0.0  0.0   6480  2164 pts/0    S+   09:08   0:00 grep nginx

A cleaner ps-only option is -C, which selects by command name:

ps -f -C nginx

If you only need the matching PIDs, use pgrep :

pgrep nginx

Use ps aux | grep pattern for quick interactive checks. Use ps -C name or pgrep when you want cleaner output for scripts.

Finding Processes by PID, PPID, or User #

If you know the PID, use -p:

ps -fp 1234

You can pass multiple PIDs separated by commas:

ps -fp 1234,5678,9012

To list child processes of a parent PID, use --ppid:

ps -f --ppid 1234

To show processes running with a specific effective user ID, use -u:

ps -u www-data

For full-format output for a user, combine it with -f:

ps -fu www-data

To match both real and effective user IDs, use -U and -u together:

ps -f -U www-data -u www-data

This can matter for services that change user IDs after startup.

Sorting Processes by CPU or Memory #

The --sort option sorts ps output by a field name. A leading minus sign sorts in descending order.

To show processes using the most memory:

ps aux --sort=-%mem | head

To show processes using the most CPU:

ps aux --sort=-%cpu | head

You can sort by more than one field:

ps aux --sort=-%cpu,-%mem | head

Keep in mind that %CPU in ps is calculated over the process lifetime. A long-running process with brief current activity may not appear at the top. For live CPU changes, use top or htop.

Showing the Full Command Line #

Terminal width can truncate long command lines in the COMMAND or CMD column. Add ww for wide output:

ps auxww

This is useful when a process starts with long arguments, configuration paths, Java options, container commands, or script parameters.

For one process, combine -p with a custom output format:

ps -p 1234 -o pid,user,lstart,args

The args field shows the full command line with arguments.

Custom Output Columns #

The -o option lets you choose exactly which fields to print. This is often better than parsing the default output.

For a compact process list:

ps -eo pid,user,%cpu,%mem,comm

To include the full command line:

ps -eo pid,user,%cpu,%mem,args

To inspect parent-child relationships:

ps -eo pid,ppid,user,stat,cmd

To print only PIDs without a header, add an equals sign after the field name:

ps -C nginx -o pid=

Useful format specifiers include:

Viewing a Process Tree #

To see parent-child relationships in a tree, use f with ps aux:

ps auxf

The UNIX-style equivalent is:

ps -ejH

Both commands indent child processes under their parents. This helps when you need to see which service, shell, supervisor, or container runtime started a process. For a dedicated tree view, see the pstree command .

Displaying Threads #

Some programs run many threads inside one process. To show threads, use -L:

ps -fL -C nginx

This adds thread-related columns such as:

• LWP - Light-weight process ID, also used as the thread ID.
• NLWP - Number of threads in the process.

Thread output is useful when you are debugging multi-threaded applications or checking whether a service is creating more worker threads than expected.

Process State Codes #

The STAT column in ps aux shows the process state. The first character is the main state:

Additional characters may appear after the main state:

For example, Ss means the process is sleeping and is a session leader. R+ means the process is running in the foreground process group.

To find zombie processes:

ps aux | awk '$8 ~ /Z/ { print }'

A zombie process has exited, but its parent has not collected its exit status. A few short-lived zombies are usually harmless. Many persistent zombies usually point to a parent process that is not handling child processes correctly.

Using ps in Pipelines #

Because ps prints a one-time snapshot, it works well in pipelines.

To page through a long process list:

ps -ef | less

To count all processes:

ps -e --no-headers | wc -l

To refresh a sorted ps view every 2 seconds:

watch -n 2 'ps aux --sort=-%cpu | head -15'

To stop a process after you identify its PID, use kill :

kill 1234

If you want to kill processes by name or pattern, use pkill , but preview matches with pgrep first.

Quick Reference #

For a printable quick reference, see the ps cheatsheet .

Troubleshooting #

ps aux works, but ps -aux behaves differently
Use ps aux without a dash. The dash changes how ps parses the options, and Linux only treats ps -aux like ps aux as a compatibility fallback in some cases.

grep appears in the process search results
When you run ps aux | grep nginx, the grep nginx command can match itself. Use ps -f -C nginx, pgrep nginx, or the pattern trick grep [n]ginx.

The command line is cut off
Use ps auxww or select the args field with -o, for example ps -p 1234 -o pid,args.

A process is missing from ps output
Run ps aux or ps -ef instead of plain ps. The default ps output only shows processes attached to your current terminal and user context.

CPU numbers do not match top or htop
ps shows a snapshot and reports CPU usage over the process lifetime. top and htop update continuously, so they are better for current CPU spikes.

A process starts and exits before you can see it
Use watch to repeat the command, or inspect service logs. Very short-lived processes can appear and disappear between ps snapshots.

FAQ #

What does ps aux do in Linux?
ps aux lists processes for all users, includes processes without a terminal, and shows a user-oriented output with CPU, memory, state, start time, and command line columns.

What is the difference between ps aux and ps -ef?
Both list all running processes. ps aux uses BSD syntax and includes %CPU, %MEM, VSZ, RSS, and STAT. ps -ef uses UNIX syntax and includes PPID, which is useful for checking parent processes.

Does ps show real-time process information?
No. ps shows a snapshot from the moment you run it. Use top, htop, or watch if you need repeated updates.

How do I see the full command in ps output?
Use ps auxww or a custom format such as ps -eo pid,user,args. The ww option expands the output width so long command lines are not truncated.

How do I find the process using the most memory?
Run ps aux --sort=-%mem | head. To sort by CPU instead, use ps aux --sort=-%cpu | head.

Conclusion #

The ps command gives you a reliable snapshot of what is running on a Linux system. Start with ps aux for CPU and memory checks, use ps -ef when parent process IDs matter, and switch to custom -o columns when you need clean output for scripts or troubleshooting.

About the authors

Dejan Panovski

Dejan Panovski is the founder of Linuxize, an RHCSA-certified Linux system administrator and DevOps engineer based in Skopje, Macedonia. Author of 800+ Linux tutorials with 20+ years of experience turning complex Linux tasks into clear, reliable guides.

View author page