1/12/2018 - 6:16 AM

ps用法

ColumnSpec.md

Rendered
Source

PROCESS FLAGS

显示为F列, 目前其值有 1 forked but didn’t exec 4 used super-user privileges

PROCESS STATE CODES

进程状态值(列头会显示为STAT或S)说明：

D Uninterruptible sleep (usually IO)
R Running or runnable (on run queue)
S Interruptible sleep (waiting for an event to complete)
T Stopped, either by a job control signal or because it is being traced.
W paging (not valid since the 2.6.xx kernel)
X dead (should never be seen)
Z Defunct ("zombie") process, terminated but not reaped by its parent.

For BSD formats and when the stat keyword is used, additional characters may be displayed:

< high-priority (not nice to other users)
N low-priority (nice to other users)
L has pages locked into memory (for real-time and custom IO)
s is a session leader
l is multi-threaded (using CLONE_THREAD, like NPTL pthreads do)
+ is in the foreground process group

OBSOLETE SORT KEYS

以下是BSD风格的O参数所使用的字段简写。--sort不适用这些简写
Note that the values used in sorting are the internal values ps uses and not the "cooked" values used in some of the output format fields (e.g. sorting on tty will sort into device number, not according to the terminal name displayed).

KEY	LONG	DESCRIPTION
c	cmd	simple name of executable
C	pcpu	cpu utilization
f	flags	flags as in long format F field
g	pgrp	process group ID
G	tpgid	controlling tty process group ID
j	cutime	cumulative user time
J	cstime	cumulative system time
k	utime	user time
m	min_flt	number of minor page faults
M	maj_flt	number of major page faults
n	cmin_flt	cumulative minor page faults
N	cmaj_flt	cumulative major page faults
o	session	session ID
p	pid	process ID
P	ppid	parent process ID
r	rss	resident set size
R	resident	resident pages
s	size	memory size in kilobytes
S	share	amount of shared pages
t	tty	the device number of the controlling tty
T	start_time	time process was started
U	uid	user ID number
u	user	user name
v	vsize	total VM size in kB
y	priority	kernel scheduling priority

STANDARD FORMAT SPECIFIERS

以下为可用于控制可显示的列头或用于--sort来排序的字段信息

CODE	HEADER	DESCRIPTION
%cpu	%CPU	cpu utilization of the process in "##.#" format. Currently, it is the CPU time used divided by the time the process has been running(cputime/realtime ratio), expressed as a percentage. It will not add up to 100% unless you are lucky. (alias pcpu).
%mem	%MEM	ratio of the process’s resident set size to the physical memory on the machine, expressed as a percentage. (alias pmem).
args	COMMAND	command with all its arguments as a string. Modifications to the arguments may be shown. The output in this column may contain spaces. A process marked is partly dead, waiting to be fully destroyed by its parent. Sometimes the process args will be unavailable; when this happens, ps will instead print the executable name in brackets. (alias cmd, command). See also the comm format keyword, the -f option, and the c option. When specified last, this column will extend to the edge of the display. If ps can not determine display width, as when output is redirected (piped) into a file or another command, the output width is undefined. (it may be 80, unlimited, determined by the TERM variable, and so on) The COLUMNS environment variable or --cols option may be used to exactly determine the width in this case. The w or -w option may be also be used to adjust width.
blocked	BLOCKED	mask of the blocked signals, see signal(7). According to the width of the field, a 32-bit or 64-bit mask in hexadecimal format is displayed. (alias sig_block, sigmask).
bsdstart	START	time the command started. If the process was started less than 24 hours ago, the output format is " HH:MM", else it is "mmm dd" (where mmm is the three letters of the month). See also lstart, start, start_time, and stime.
bsdtime	TIME	accumulated cpu time, user + system. The display format is usually "MMM:SS", but can be shifted to the right if the process used more than 999 minutes of cpu time.
c	C	processor utilization. Currently, this is the integer value of the percent usage over the lifetime of the process. (see %cpu).
caught	CAUGHT	mask of the caught signals, see signal(7). According to the width of the field, a 32 or 64 bits mask in hexadecimal format is displayed. (alias sig_catch, sigcatch).
cgroup	CGROUP	display control groups to which the process belonges.
class	CLS	scheduling class of the process. (alias policy, cls). Field’s possible values are: - not reported TS SCHED_OTHER FF SCHED_FIFO RR SCHED_RR B SCHED_BATCH ISO SCHED_ISO IDL SCHED_IDLE ? unknown value
cls	CLS	scheduling class of the process. (alias policy, class). Field’s possible values are: - not reported TS SCHED_OTHER FF SCHED_FIFO RR SCHED_RR B SCHED_BATCH ISO SCHED_ISO IDL SCHED_IDLE ? unknown value
cmd	CMD	see args. (alias args, command).
comm	COMMAND	command name (only the executable name). Modifications to the command name will not be shown. A process marked is partly dead, waiting to be fully destroyed by its parent. The output in this column may contain spaces. (alias ucmd, ucomm). See also the args format keyword, the -f option, and the c option. When specified last, this column will extend to the edge of the display. If ps can not determine display width, as when output is redirected (piped) into a file or another command, the output width is undefined. (it may be 80, unlimited, determined by the TERM variable, and so on) The COLUMNS environment variable or --cols option may be used to exactly determine the width in this case. The w or -w option may be also be used to adjust width.
command	COMMAND	see args. (alias args, cmd).
cp	CP	per-mill (tenths of a percent) CPU usage. (see %cpu).
cputime	TIME	cumulative CPU time, "[dd-]hh:mm:ss" format. (alias time).
egid	EGID	effective group ID number of the process as a decimal integer. (alias gid).
egroup	EGROUP	effective group ID of the process. This will be the textual group ID, if it can be obtained and the field width permits, or a decimal representation otherwise. (alias group).
eip	EIP	instruction pointer.
esp	ESP	stack pointer.
etime	ELAPSED	elapsed time since the process was started, in the form [[dd-]hh:]mm:ss.
euid	EUID	effective user ID. (alias uid).
euser	EUSER	effective user name. This will be the textual user ID, if it can be obtained and the field width permits, or a decimal representation otherwise. The n option can be used to force the decimal representation. (alias uname, user).
f	F	flags associated with the process, see the PROCESS FLAGS section. (alias flag, flags).
fgid	FGID	filesystem access group ID. (alias fsgid).
fgroup	FGROUP	filesystem access group ID. This will be the textual user ID, if it can be obtained and the field width permits, or a decimal representation otherwise. (alias fsgroup).
flag	F	see f. (alias f, flags).
flags	F	see f. (alias f, flag).
fname	COMMAND	first 8 bytes of the base name of the process’s executable file. The output in this column may contain spaces.
fuid	FUID	filesystem access user ID. (alias fsuid).
fuser	FUSER	filesystem access user ID. This will be the textual user ID, if it can be obtained and the field width permits, or a decimal representation otherwise.
gid	GID	see egid. (alias egid).
group	GROUP	see egroup. (alias egroup).
ignored	IGNORED	mask of the ignored signals, see signal(7). According to the width of the field, a 32-bit or 64-bit mask in hexadecimal format is displayed. (alias sig_ignore, sigignore).
label	LABEL	security label, most commonly used for SE Linux context data. This is for the Mandatory Access Control ("MAC") found on high-security systems.
lstart	STARTED	time the command started. See also bsdstart, start, start_time, and stime.
lwp	LWP	lwp (light weight process, or thread) ID of the lwp being reported. (alias spid, tid).
ni	NI	nice value. This ranges from 19 (nicest) to -20 (not nice to others), see nice(1). (alias nice).
nice	NI	see ni. (alias ni).
nlwp	NLWP	number of lwps (threads) in the process. (alias thcount).
nwchan	WCHAN	address of the kernel function where the process is sleeping (use wchan if you want the kernel function name). Running tasks will display a dash (’-’) in this column.
pcpu	%CPU	see %cpu. (alias %cpu).
pending	PENDING	mask of the pending signals. See signal(7). Signals pending on the process are distinct from signals pending on individual threads. Use the m option or the -m option to see both. According to the width of the field, a 32-bit or 64-bit mask in hexadecimal format is displayed. (alias sig).
pgid	PGID	process group ID or, equivalently, the process ID of the process group leader. (alias pgrp).
pgrp	PGRP	see pgid. (alias pgid).
pid	PID	process ID number of the process.
pmem	%MEM	see %mem. (alias %mem).
policy	POL	scheduling class of the process. (alias class, cls). Possible values are: - not reported TS SCHED_OTHER FF SCHED_FIFO RR SCHED_RR B SCHED_BATCH ISO SCHED_ISO IDL SCHED_IDLE ? unknown value
ppid	PPID	parent process ID.
psr	PSR	processor that process is currently assigned to.
rgid	RGID	real group ID.
rgroup	RGROUP	real group name. This will be the textual group ID, if it can be obtained and the field width permits, or a decimal representation otherwise.
rip	RIP	64-bit instruction pointer.
rsp	RSP	64-bit stack pointer.
rss	RSS	resident set size, the non-swapped physical memory that a task has used (in kiloBytes). (alias rssize, rsz).
rssize	RSS	see rss. (alias rss, rsz).
rsz	RSZ	see rss. (alias rss, rssize).
rtprio	RTPRIO	realtime priority.
ruid	RUID	real user ID.
ruser	RUSER	real user ID. This will be the textual user ID, if it can be obtained and the field width permits, or a decimal representation otherwise.
s	S	minimal state display (one character). See section PROCESS STATE CODES for the different values. See also stat if you want additional information displayed. (alias state).
sched	SCH	scheduling policy of the process. The policies SCHED_OTHER (SCHED_NORMAL), SCHED_FIFO, SCHED_RR, SCHED_BATCH, SCHED_ISO, and SCHED_IDLE are respectively displayed as 0, 1, 2, 3, 4, and 5.
sess	SESS	session ID or, equivalently, the process ID of the session leader. (alias session, sid).
sgi_p	P	processor that the process is currently executing on. Displays "*" if the process is not currently running or runnable.
sgid	SGID	saved group ID. (alias svgid).
sgroup	SGROUP	saved group name. This will be the textual group ID, if it can be obtained and the field width permits, or a decimal representation otherwise.
sid	SID	see sess. (alias sess, session).
sig	PENDING	see pending. (alias pending, sig_pend).
sigcatch	CAUGHT	see caught. (alias caught, sig_catch).
sigignore	IGNORED	see ignored. (alias ignored, sig_ignore).
sigmask	BLOCKED	see blocked. (alias blocked, sig_block).
size	SZ	approximate amount of swap space that would be required if the process were to dirty all writable pages and then be swapped out. This number is very rough!
spid	SPID	see lwp. (alias lwp, tid).
stackp	STACKP	address of the bottom (start) of stack for the process.
start	STARTED	time the command started. If the process was started less than 24 hours ago, the output format is "HH:MM:SS", else it is " mmm dd" (where mmm is a three-letter month name). See also lstart, bsdstart, start_time, and stime.
start_time	START	starting time or date of the process. Only the year will be displayed if the process was not started the same year ps was invoked, or "mmmdd" if it was not started the same day, or "HH:MM" otherwise. See also bsdstart, start, lstart, and stime.
stat	STAT	multi-character process state. See section PROCESS STATE CODES for the different values meaning. See also s and state if you just want the first character displayed.
state	S	see s. (alias s).
suid	SUID	saved user ID. (alias svuid).
suser	SUSER	saved user name. This will be the textual user ID, if it can be obtained and the field width permits, or a decimal representation otherwise. (alias svuser).
svgid	SVGID	see sgid. (alias sgid).
svuid	SVUID	see suid. (alias suid).
sz	SZ	size in physical pages of the core image of the process. This includes text, data, and stack space. Device mappings are currently excluded; this is subject to change. See vsz and rss.
thcount	THCNT	see nlwp. (alias nlwp). number of kernel threads owned by the process.
tid	TID	see lwp. (alias lwp).
time	TIME	cumulative CPU time, "[dd-]hh:mm:ss" format. (alias cputime).
tname	TTY	controlling tty (terminal). (alias tt, tty).
tpgid	TPGID	ID of the foreground process group on the tty (terminal) that the process is connected to, or -1 if the process is not connected to a tty.
tt	TT	controlling tty (terminal). (alias tname, tty).
tty	TT	controlling tty (terminal). (alias tname, tt).
ucmd	CMD	see comm. (alias comm, ucomm).
ucomm	COMMAND	see comm. (alias comm, ucmd).
uid	UID	see euid. (alias euid).
uname	USER	see euser. (alias euser, user).
user	USER	see euser. (alias euser, uname).
vsize	VSZ	see vsz. (alias vsz).
vsz	VSZ	virtual memory size of the process in KiB (1024-byte units). Device mappings are currently excluded; this is subject to change. (alias vsize).
wchan	WCHAN	name of the kernel function in which the process is sleeping, a "-" if the process is running, or a "*" if the process is multi-threaded and ps is not displaying threads.

ps.md

Rendered
Source

ps用法

用于输出进程信息。

支持三种风格的选项参数：

UNIX 可通过前置一个-
BSD 不能添加-
GNU 全名参数，添加两个--

允许三种风格的参数混合使用，但有可能出现冲突

在不加选项时，仅输出当前登陆用户且在同一个tty终端下的进程，它显示进程ID（pid = PID）、与进程关联的终端（tname = TTY），和[dd-] hh：mm：ss格式的累计CPU时间，以及可执行文件名（ucmd = CMD）

$ ps
  PID TTY          TIME CMD
15309 pts/1    00:00:00 bash
22755 pts/1    00:00:00 ps

若使用BSD风格时，会多显示进程的STAT,且COMMAND一行不只显示命令而会显示命令的所有参数。另外还会显示当前登陆用户的所有tty终端下的所有进程

$ ps u
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
cqc      16214  0.0  0.0 108448  1892 pts/1    Ss   10:44   0:00 -bash
cqc      16378  0.0  0.0 101136   984 pts/1    S+   10:45   0:00 man ps
cqc      16381  0.0  0.0 106104  1156 pts/1    S+   10:45   0:00 sh -c ...
cqc      16382  0.0  0.0 106104   584 pts/1    S+   10:45   0:00 sh -c ...
cqc      16387  0.0  0.0 105460   848 pts/1    S+   10:45   0:00 /usr/bin/less -is
cqc      16862  0.0  0.0 108448  1904 pts/3    Ss   10:45   0:00 -bash
cqc      24135  0.0  0.0 110248  1144 pts/3    R+   10:50   0:00 ps u

对于不同风格类型的参数最好不要组成一组使用，可能会偏离你的预期

$ ps -ajf
UID        PID  PPID  PGID   SID  C STIME TTY          TIME CMD
root      7003 14188  7003 13240  0 11:17 pts/2    00:00:00 su hadoop
hadoop    7004  7003  7004 13240  0 11:17 pts/2    00:00:00 bash
hadoop   11383  7004 11383 13240  0 11:27 pts/2    00:00:00 ps -ajf
root     14185 13240 14185 13240  0 10:54 pts/2    00:00:00 sudo su
root     14187 14185 14185 13240  0 10:54 pts/2    00:00:00 su
root     14188 14187 14188 13240  0 10:54 pts/2    00:00:00 bash

ps -aj f
  PID  PGID   SID TTY      STAT   TIME COMMAND
14185 14185 13240 pts/2    S      0:00 sudo su
14187 14185 13240 pts/2    S      0:00  \_ su
14188 14188 13240 pts/2    S      0:00      \_ bash
 7003  7003 13240 pts/2    S      0:00          \_ su hadoop
 7004  7004 13240 pts/2    S      0:00              \_ bash
17846 17846 13240 pts/2    R+     0:00                  \_ ps -aj f

其他的一些注意事项

CPU的使用率是整个进程生命周期运行的时间百分比
当用户名的长度大于列的显示长度时，其将显示为userid
The SIZE and RSS fields don’t count some parts of a process including the page tables, kernel stack, struct thread_info, and struct task_struct. This is usually at least 20 KiB of memory that is always resident. SIZE is the virtual size of the process (code+data+stack)

选项

SIMPLE PROCESS SELECTION

-A

选择所有进程。等同于-e

-N

选择除满足指定条件的所有进程。与--deselect相同。

T

选择所有和当前终端关联的所有进程。和不带参数的t选项相同

-a

选择除了SID(session id = process id)之外的所有和终端关联的进程

$ ps
  PID TTY          TIME CMD
16862 pts/3    00:00:00 bash
30588 pts/3    00:00:00 ps

# 对比上下的pts/3会发现，下面比上面少了bash,这个就是登陆终端的根进程
ps -a
  PID TTY          TIME CMD
16378 pts/1    00:00:00 man
16381 pts/1    00:00:00 sh
16382 pts/1    00:00:00 sh
16387 pts/1    00:00:00 less
22958 pts/4    00:00:00 sudo
22959 pts/4    00:00:00 su
22960 pts/4    00:00:00 bash
22999 pts/3    00:00:00 ps

a

选择所有和终端关联的进程。当和x一同使用时表示显示所有进程

$ ps a
  PID TTY      STAT   TIME COMMAND
 2015 tty2     Ss+    0:00 /sbin/mingetty /dev/tty2
 2017 tty3     Ss+    0:00 /sbin/mingetty /dev/tty3
 2021 tty4     Ss+    0:00 /sbin/mingetty /dev/tty4
 2023 tty5     Ss+    0:00 /sbin/mingetty /dev/tty5
 2025 tty6     Ss+    0:00 /sbin/mingetty /dev/tty6
 2145 pts/3    R+     0:00 ps a
16214 pts/1    Ss     0:00 -bash
16378 pts/1    S+     0:00 man ps
16381 pts/1    S+     0:00 sh -c ...
16382 pts/1    S+     0:00 sh -c ...
16387 pts/1    S+     0:00 /usr/bin/less -is
16862 pts/3    Ss     0:00 -bash
18669 tty1     Ss+    0:00 /sbin/mingetty /dev/tty1
22915 pts/4    Ss+    0:00 -bash

$ ps a | wc
     32     255    2373
$ ps x | wc
     14     141    1011
$ ps ax|wc
    379    2557   47837
$ ps -e | wc
    379    1517   12485

-d

选择除了SID(session id = process id)之外的所有进程

-e

选择所有进程。等同于-A

r

Restrict the selection to only running processes. 我看像是选择STAT=R+的进程

x

选择属于当前用户的所有进程。当和a一起使用时表示选择所有

--deselect

选择除满足指定条件的所有进程。与-N相同。

PROCESS SELECTION BY LIST
这节参数都可接收一个列表参数，多个参数值之间以空格或逗号隔开。如ps -p "1 2" ps -p 1,2

-C cmdlist

根据命令名称选择

U userlist

根据effective user ID (EUID) or name来选择。等同于-u和--user

-u userlist

effective user ID (RGID) or name来选择。等同于U --user

--user userlist

根据effective user ID (EUID) or name来选择。等同于-u和U

-U userlist

根据real user ID (RGID) or name来选择

--User userlist

根据real user ID (RGID) or name来选择. 等同于 -U.

-G grplist

根据real group ID (RGID) or name来选择

--Group grplist

根据real group ID (RGID) or name来选择. Identical to -G.

-g grplist

Select by session OR by effective group name.
Selection by session is specified by many standards, but selection by effective group is the logical behavior that several other operating systems use. This ps will select by session when the list is completely numeric (as sessions are).
Group ID numbers will work only when some group names are also specified. See the -s and --group options.

--group grplist

根据effective group ID (EGID) or name来选择

p pidlist

按进程ID来选择。等同于-p --pid

-p pidlist

按进程ID来选择。等同于p --pid

--pid pidlist

按进程ID来选择。等同于p -p

123

等同于--pid 123

--ppid pidlist

按父进程ID来选择.

-s sesslist

按session ID来选择.

--sid sesslist

按session ID来选择. 等同于-s

-123

等同于--sid 123

t ttylist

根据tty来选择。和-t --tty很相似，只是当ttylist为空时，使用当前关联的tty作为条件。

-t ttylist

根据tty来选择。tty名称支持以下形式：/dev/ttyS1,ttyS1,S1. 使用-来表示未关联终端的进程

--tty ttylist

根据tty来选择。等同于-t

OUTPUT FORMAT CONTROL
本节选项主要是用于输出格式的控制

-F

输出比较全格式。 CMD包含命令参数

$ ps -F
UID        PID  PPID  C    SZ   RSS PSR STIME TTY          TIME CMD
cqc       7765  7764  0 27112  1964   1 17:29 pts/10   00:00:00 -bash
cqc       8804  7765  1 27563  1148   1 20:21 pts/10   00:00:00 ps -F

-f

输出比较全格式。CMD包含命令参数

$ ps -f
UID        PID  PPID  C STIME TTY          TIME CMD
cqc       7765  7764  0 17:29 pts/10   00:00:00 -bash
cqc      12117  7765  0 20:24 pts/10   00:00:00 ps -f

可与其他UNIX-style的参数结合来增加附加的列,如与-L配合输出线程ID

o format

用户自定义格式。等同于-o --format

-o format

用户自定义格式。
format值可以单个或多个，多个之间有空格或逗号隔开。可识别的值由后面章节再讲

$ ps -o pid,uid
  PID   UID
 7765   515
 9631   515

允许自定义列名

$ ps -o pid=process_id
process_id
      7765
     13977
#当有多个需要自定义列名时最后使用多个-o,否则有可能导致语义有分歧
$ ps -o pid=process_id,uid
process_id,uid
          7765
         15879
$ ps -o pid=process_id -ouid
process_id   UID -
      7765   515
     16120   515

当所有的header为空时(要有=号)，将不输出列头

$ ps -o pid= -o uid=
 7765   515
18624   515

支持自定列宽(好像就不支持设置header了)

ps -o pid:30,uid
                           PID   UID
                          7765   515
                         20987   515

--format

用户自定义格式。等同于-o o

-O format

和-o类似，不同的是它会预置一些默认的列，相当于是ps -o pid,format,state,tname,time,command

$ ps -O uid,uname
  PID   UID USER     S TTY          TIME COMMAND
 7765   515 cqc      S pts/10   00:00:00 -bash
29750   515 cqc      R pts/10   00:00:00 ps -O uid,uname

O format

在定义需要展示展示的列上，和-O的功能是一致的。不过这个选项还支持排序的功能，具体用法参考--sort

-M

(针对SE Linux的选项)Add a column of security data. Identical to Z

X

$ ps X
 PID   STACKP      ESP      EIP TMOUT ALARM STAT TTY        TIME COMMAND
 7765 a48264c0 a4826080 d40ac7be     -     - Ss   pts/10     0:00 -bash
16214 e290a090 e2909c50 d40ac7be     -     - Ss   pts/1      0:00 -bash
16378 f3ebae40 f3eb69d0 d40ac7be     -     - S+   pts/1      0:00 man ps
16381 c46aee50 c46ae9e0 d40ac7be     -     - S+   pts/1      0:00 sh -c ...
16387 90ab4670 90ab43f8 d40db670     -     - S+   pts/1      0:00 /usr/bin/less -is
16862 2e3d7690 2e3d6408 d40db670     -     - Ss+  pts/3      0:00 -bash
32255 6ba30d40 6ba304e8 d40db670     -     - R+   pts/10     0:00 ps X

Z

(针对SE Linux的选项)Add a column of security data. Identical to -M.

-c

Show different scheduler information for the -l option.

$ ps -c
  PID CLS PRI TTY          TIME CMD
 2487 TS   19 pts/10   00:00:00 ps
 7765 TS   19 pts/10   00:00:00 bash

j

BSD job control format.

$ ps j
 PPID   PID  PGID   SID TTY      TPGID STAT   UID   TIME COMMAND
 7765  3429  3429  7765 pts/10    3429 R+     515   0:00 ps j
 7764  7765  7765  7765 pts/10    3429 Ss     515   0:00 -bash
16213 16214 16214 16214 pts/1    16378 Ss     515   0:00 -bash
16214 16378 16378 16214 pts/1    16378 S+     515   0:00 man ps
16378 16381 16378 16214 pts/1    16378 S+     515   0:00 sh -c ...
16382 16387 16378 16214 pts/1    16378 S+     515   0:00 /usr/bin/less -is
16861 16862 16862 16862 pts/3    16862 Ss+    515   0:00 -bash

-j

jobs format

$ ps -j
  PID  PGID   SID TTY          TIME CMD
 5751  5751  7765 pts/10   00:00:00 ps
 7765  7765  7765 pts/10   00:00:00 bash

l

display BSD long format.

$ ps l
F   UID   PID  PPID PRI  NI    VSZ   RSS WCHAN  STAT TTY        TIME COMMAND
0   515  7035  7765  20   0 108112   928 -      R+   pts/10     0:00 ps l
0   515  7765  7764  20   0 108448  1980 wait   Ss   pts/10     0:00 -bash
0   515 16214 16213  20   0 108448  1892 wait   Ss   pts/1      0:00 -bash
0   515 16378 16214  20   0 101136   984 wait   S+   pts/1      0:00 man ps
0   515 16381 16378  20   0 106104  1156 wait   S+   pts/1      0:00 sh -c ...
1   515 16382 16381  20   0 106104   584 wait   S+   pts/1      0:00 sh -c ...
0   515 16387 16382  20   0 105460   884 n_tty_ S+   pts/1      0:00 /usr/bin/less -is
0   515 16862 16861  20   0 108712  2208 n_tty_ Ss+  pts/3      0:00 -bash

-l

long format. The -y option is often useful with this.

$ ps -l
F S   UID   PID  PPID  C PRI  NI ADDR SZ WCHAN  TTY          TIME CMD
0 S   515  7765  7764  0  80   0 - 27112 wait   pts/10   00:00:00 bash
0 R   515  8657  7765  0  80   0 - 27036 -      pts/10   00:00:00 ps

$ ps -l -y
S   UID   PID  PPID  C PRI  NI   RSS    SZ WCHAN  TTY          TIME CMD
S   515  7765  7764  0  80   0  1980 27112 wait   pts/10   00:00:00 bash
R   515  8998  7765  0  80   0  1000 27037 -      pts/10   00:00:00 ps

$ ps -l -c
F S   UID   PID  PPID CLS PRI ADDR SZ WCHAN  TTY          TIME CMD
0 S   515  7765  7764 TS   19 - 27112 wait   pts/10   00:00:00 bash
0 R   515 12143  7765 TS   19 - 27036 -      pts/10   00:00:00 ps

s

display signal format

$ ps s
  UID   PID          PENDING          BLOCKED          IGNORED           CAUGHT STAT TTY        TIME COMMAND
  515  7765 0000000000000000 0000000000010000 0000000000384004 000000004b813efb Ss   pts/10     0:00 -bash
  515 13609 0000000000000000 0000000000000000 0000000000000000 0000000073d3fad9 R+   pts/10     0:00 ps s
  515 16214 0000000000000000 0000000000010000 0000000000384004 000000004b813efb Ss   pts/1      0:00 -bash
  515 16378 0000000000000000 0000000000010000 0000000000000006 0000000000000000 S+   pts/1      0:00 man ps
  515 16381 0000000000000000 0000000000010000 0000000000000004 0000000000010002 S+   pts/1      0:00 sh -c ...
  515 16382 0000000000010000 0000000000010000 0000000000000000 0000000000010002 S+   pts/1      0:00 sh -c ...
  515 16387 0000000000000000 0000000000000000 0000000000000004 0000000008080002 S+   pts/1      0:00 /usr/bin/less -is
  515 16862 0000000000000000 0000000000000000 0000000000384004 000000004b813efb Ss+  pts/3      0:00 -bash

u

display user-oriented format

ps u
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
cqc       7765  0.0  0.0 108448  1980 pts/10   Ss   Feb05   0:00 -bash
cqc      15040  0.0  0.0 110252  1152 pts/10   R+   11:29   0:00 ps u
cqc      16214  0.0  0.0 108448  1892 pts/1    Ss   Feb05   0:00 -bash
cqc      16378  0.0  0.0 101136   984 pts/1    S+   Feb05   0:00 man ps
cqc      16381  0.0  0.0 106104  1156 pts/1    S+   Feb05   0:00 sh -c ...
cqc      16387  0.0  0.0 105460   884 pts/1    S+   Feb05   0:00 /usr/bin/less -is
cqc      16862  0.0  0.0 108712  2208 pts/3    Ss+  Feb05   0:00 -bash

v

display virtual memory format

$ ps v
  PID TTY      STAT   TIME  MAJFL   TRS   DRS   RSS %MEM COMMAND
 7765 pts/10   Ss     0:00      0   846 107601 1980  0.0 -bash
16214 pts/1    Ss     0:00      0   846 107601 1892  0.0 -bash
16378 pts/1    S+     0:00      0    46 101089  984  0.0 man ps
16381 pts/1    S+     0:00      0   846 105257 1156  0.0 sh -c ...
16387 pts/1    S+     0:00      0   127 105332  884  0.0 /usr/bin/less -is
16862 pts/3    Ss+    0:00      0   846 107865 2208  0.0 -bash
17138 pts/10   R+     0:00      0    76 108071  996  0.0 ps v

-y

该选项只能和-l配合使用。在-l显示的基础上，去掉flags列并将addr列替换为rss列

$ ps -l
F S   UID   PID  PPID  C PRI  NI ADDR SZ WCHAN  TTY          TIME CMD
0 S   515  7765  7764  0  80   0 - 27112 wait   pts/10   00:00:00 bash
0 R   515 19382  7765  1  80   0 - 27037 -      pts/10   00:00:00 ps

$ ps -ly
S   UID   PID  PPID  C PRI  NI   RSS    SZ WCHAN  TTY          TIME CMD
S   515  7765  7764  0  80   0  1980 27112 wait   pts/10   00:00:00 bash
R   515 19513  7765  1  80   0  1000 27037 -      pts/10   00:00:00 ps

-Z

display security context format (SELinux, etc.)

--context

Display security context format. (for SE Linux)

OUTPUT MODIFIERS

-H

显示进程的层次结构。

$ ps -ajH
  PID  PGID   SID TTY          TIME CMD
14185 14185 13240 pts/2    00:00:00 sudo
14187 14185 13240 pts/2    00:00:00   su
14188 14188 13240 pts/2    00:00:00     bash
 7003  7003 13240 pts/2    00:00:00       su
 7004  7004 13240 pts/2    00:00:00         bash
 3984  3984 13240 pts/2    00:00:00           ps

f

显示进程的层次结构。

$ ps ajf
 PPID   PID  PGID   SID TTY      TPGID STAT   UID   TIME COMMAND
13237 13240 13240 13240 pts/2    11373 Ss     508   0:00 -bash
13240 14185 14185 13240 pts/2    11373 S        0   0:00  \_ sudo su
14185 14187 14185 13240 pts/2    11373 S        0   0:00      \_ su
14187 14188 14188 13240 pts/2    11373 S        0   0:00          \_ bash
14188  7003  7003 13240 pts/2    11373 S        0   0:00              \_ su hadoop
 7003  7004  7004 13240 pts/2    11373 S      501   0:00                  \_ bash
 7004 11373 11373 13240 pts/2    11373 R+     501   0:00                      \_ ps ajf

--forest

等同于f

-n namelist

set namelist file. Identical to N. The namelist file is needed for a proper WCHAN display, and must match the current Linux kernel exactly for correct output. Without this option, the default search path for the namelist is: $PS_SYSMAP $PS_SYSTEM_MAP /proc/*/wchan /boot/System.map-uname -r /boot/System.map /lib/modules/uname -r/System.map /usr/src/linux/System.map /System.map

N namelist

Specify namelist file. Identical to -n, see -n above.

O order

排序。该选项既可像-O一样展示预置的列也可像--sort用于排序当用于排序时其语法为 O[+|-]k1[,[+|-]k2[,...]]。 kn是列名的首字母(全名还不行，且如果有相同的首字母则取第一个) 感觉有点难用，可用 sort命令去替代

--sort spec

排序。语法为--sort [+|-]key[,[+|-]key[,...]],如ps jax --sort=uid,-ppid,+pid +号是默认的，-号是反向输出。
等同于k

$ ps ax -o pcpu,pmem --sort -pcpu | head
%CPU %MEM
 3.5  5.8
 3.5  0.4
 3.3  1.0
 2.1  2.6
 1.8  2.1
 1.7  2.9
 1.6  0.9
 1.5  2.1
 1.4  6.8

#按mem排序时就没效果了
$ ps ax -o pcpu,pmem --sort -pmem | head
%CPU %MEM
 0.0  0.0
 0.0  0.0
 0.0  0.0
 0.0  0.0
 0.0  0.0
 0.0  0.0
 0.0  0.0
 0.0  0.0
 0.0  0.0

#用sort命令替代
$ ps ax -o pcpu,pmem | sort  -rnk 2  | head
 1.4  6.8
 3.5  5.8
 1.7  2.9
 0.0  2.9
 2.1  2.6
 1.8  2.1
 1.5  2.1
 0.9  1.5
 0.1  1.2
 0.0  1.1

k spec

等同于--sort,参考其用法。示例： ps jaxkuid,-ppid,+pid ps axk comm o comm,args ps kstart_time -ef

S

将已经死掉的子进程的统计数据纳入到父进程中统计 Sum up some information, such as CPU usage, from dead child processes into their parent. This is useful for examining a system where a parent process repeatedly forks off short-lived children to do work.

ps -o pid,ppid,pcpu,pmem,time -s 1 S
  PID  PPID %CPU %MEM     TIME
    1     0  117  0.0 00:13:56

ps -o pid,ppid,pcpu,pmem,time -s 1
  PID  PPID %CPU %MEM     TIME
    1     0  0.0  0.0 00:13:56

--cumulative

等同于S

c

显示真实的执行命令名称，它来源于执行文件名。该选项可用于屏蔽命令的参数

ps auxc | grep java
root      1202  1.7  1.5 11075120 1003408 ?    Sl    2017 6131:22 java
root      1492  0.1  0.3 4781132 237452 ?      Sl    2016 1189:36 java

ps aux | grep java
root      1202  1.7  1.5 11075120 1003408 ?    Sl    2017 6131:22 /usr/lib/jvm/java/bin/java -server ...

e

在命令后面显示环境变量信息

$ ps ae
  PID TTY      STAT   TIME COMMAND
 7004 pts/2    S      0:00 bash  HOSTNAME=xxx HADOOP_LOG_DIR=xxx ...

h

不显示列头。不过该参数在不同的版本或BSD风格时会有其他的效果
最后使用--headers --no-headers来表达想要的结果

--headers

每页显示一次列头

--no-headers

不显示列头

n

将USER GROUP等以ID形式显示

-w

Wide output. Use this option twice for unlimited width.

w

Wide output. Use this option twice for unlimited width.

--cols n

set screen width

--columns n

set screen width

--width n

set screen width

--lines n

set screen height

--rows n

set screen height

THREAD DISPLAY

H

显示线程进程

$ ps jp 18801
 PPID   PID  PGID   SID TTY      TPGID STAT   UID   TIME COMMAND
    1 18801 18758 18758 ?           -1 Sl     501 311:32 /usr/lib/jvm/java/bin/java -Dproc_historyserver ...

$ ps Hjp 18801
PPID   PID  PGID   SID TTY      TPGID STAT   UID   TIME COMMAND
    1 18801 18758 18758 ?           -1 Sl     501   0:00 /usr/lib/jvm/java/bin/java -Dproc_historyserver ...
    1 18801 18758 18758 ?           -1 Sl     501   0:00 /usr/lib/jvm/java/bin/java -Dproc_historyserver ...
    1 18801 18758 18758 ?           -1 Sl     501   0:00 /usr/lib/jvm/java/bin/java -Dproc_historyserver ...

    ...

$ ps Hjp 18801 | wc
     69    2730   87921

-L

显示线程进程. 和一些参数(如 -f)配合使用时会显示LWP和NLWP(表示LWP的数量)列

ps c -Lfp 18801
UID        PID  PPID   LWP  C NLWP STIME TTY      STAT   TIME CMD
hadoop   18801     1 18801  0   69  2017 ?        Sl     0:00 java
hadoop   18801     1 18823  0   69  2017 ?        Sl     0:05 java
hadoop   18801     1 18824  0   69  2017 ?        Sl     0:41 java
hadoop   18801     1 18825  0   69  2017 ?        Sl     0:41 java
hadoop   18801     1 18826  0   69  2017 ?        Sl     0:41 java

ps -o nlwp p 18801
NLWP
  68

ps c -Lfp 18801 --no-headers | wc
     68     748    4556

-T

显示线程进程. 可能会显示SPID列(SPID是线程ID,从试验结果看，SPID和LWP应该是相同的)

ps c -T 18801
  PID  SPID TTY      STAT   TIME COMMAND
18801 18801 ?        Sl     0:00 java
18801 18823 ?        Sl     0:05 java
18801 18824 ?        Sl     0:41 java
18801 18825 ?        Sl     0:41 java
18801 18826 ?        Sl     0:41 java
18801 18827 ?        Sl     0:41 java
18801 18828 ?        Sl     0:41 java
18801 18829 ?        Sl     0:41 java
...

ps c -TO lwp,spid -p 18801 | head
  PID   LWP  SPID S TTY          TIME COMMAND
18801 18801 18801 S ?        00:00:00 java
18801 18823 18823 S ?        00:00:05 java
18801 18824 18824 S ?        00:00:41 java
18801 18825 18825 S ?        00:00:41 java
18801 18826 18826 S ?        00:00:41 java
18801 18827 18827 S ?        00:00:41 java
18801 18828 18828 S ?        00:00:41 java
18801 18829 18829 S ?        00:00:41 java
18801 18830 18830 S ?        00:00:41 java

m

在主进程后面显示线程

ps cmp 18801,18885
  PID TTY      STAT   TIME COMMAND
18801 ?        -    311:34 java
    - -        Sl     0:00 -
    - -        Sl     0:05 -
...
18885 ?        -    694:26 java
    - -        Sl     0:00 -
    - -        Sl     0:03 -
    - -        Sl     2:38 -
...

-m

等同于m

OTHER INFORMATION

L

列出所有支持的列

$ ps L
%cpu         %CPU    
%mem         %MEM    
_left        LLLLLLLL
_left2       L2L2L2L2
_right       RRRRRRRR
_right2      R2R2R2R2
_unlimited   U       
_unlimited2  U2      
alarm        ALARM   
args         COMMAND 
atime        TIME    
blocked      BLOCKED 
bsdstart     START   
bsdtime      TIME    
c            C       
caught       CAUGHT  
cgroup       CGROUP  
class        CLS     
cls          CLS     
cmd          CMD     
comm         COMMAND 
command      COMMAND 
context      CONTEXT 
cp           CP      
cpuid        CPUID   
cputime      TIME    
drs          DRS     
dsiz         DSIZ    
egid         EGID    
egroup       EGROUP  
eip          EIP     
esp          ESP     
etime        ELAPSED 
euid         EUID    
euser        EUSER   
f            F       
fgid         FGID    
fgroup       FGROUP  
flag         F       
flags        F       
fname        COMMAND 
fsgid        FSGID   
fsgroup      FSGROUP 
fsuid        FSUID   
fsuser       FSUSER  
fuid         FUID    
fuser        FUSER   
gid          GID     
group        GROUP   
ignored      IGNORED 
intpri       PRI     
label        LABEL   
lastcpu      C       
lim          LIM     
longtname    TTY     
lstart       STARTED 
lwp          LWP     
m_drs        DRS     
m_size       SIZE    
m_trs        TRS     
maj_flt      MAJFL   
majflt       MAJFLT  
min_flt      MINFL   
minflt       MINFLT  
ni           NI      
nice         NI      
nlwp         NLWP    
nwchan       WCHAN   
opri         PRI     
pagein       PAGEIN  
pcpu         %CPU    
pending      PENDING 
pgid         PGID    
pgrp         PGRP    
pid          PID     
pmem         %MEM    
policy       POL     
ppid         PPID    
pri          PRI     
pri_api      API     
pri_bar      BAR     
pri_baz      BAZ     
pri_foo      FOO     
priority     PRI     
psr          PSR     
rgid         RGID    
rgroup       RGROUP  
rip          RIP     
rsp          RSP     
rss          RSS     
rssize       RSS     
rsz          RSZ     
rtprio       RTPRIO  
ruid         RUID    
ruser        RUSER   
s            S       
sched        SCH     
sess         SESS    
session      SESS    
sgi_p        P       
sgi_rss      RSS     
sgid         SGID    
sgroup       SGROUP  
sid          SID     
sig          PENDING 
sig_block    BLOCKED 
sig_catch    CATCHED 
sig_ignore   IGNORED 
sig_pend     SIGNAL  
sigcatch     CAUGHT  
sigignore    IGNORED 
sigmask      BLOCKED 
size         SZ      
spid         SPID    
stackp       STACKP  
start        STARTED 
start_stack  STACKP  
start_time   START   
stat         STAT    
state        S       
stime        STIME   
suid         SUID    
suser        SUSER   
svgid        SVGID   
svgroup      SVGROUP 
svuid        SVUID   
svuser       SVUSER  
sz           SZ      
thcount      THCNT   
tid          TID     
time         TIME    
tname        TTY     
tpgid        TPGID   
trs          TRS     
trss         TRSS    
tsig         PENDING 
tsiz         TSIZ    
tt           TT      
tty          TT      
tty4         TTY     
tty8         TTY     
ucmd         CMD     
ucomm        COMMAND 
uid          UID     
uid_hack     UID     
uname        USER    
user         USER    
util         C       
vsize        VSZ     
vsz          VSZ     
wchan        WCHAN   
wname        WCHAN   
zone         ZONE

-V

显示版本号

V

显示版本号

--help

Print a help message.

--info

Print debugging info.

--version

Print the procps version.

Cacher is the code snippet organizer for pro developers

We empower you and your team to get more done, faster

ps用法

PROCESS FLAGS

PROCESS STATE CODES

OBSOLETE SORT KEYS

STANDARD FORMAT SPECIFIERS

ps用法

选项

-A

-N

T

-a

a

-d

-e

r

x

--deselect

-C cmdlist

U userlist

-u userlist

--user userlist

-U userlist

--User userlist

-G grplist

--Group grplist

-g grplist

--group grplist

p pidlist

-p pidlist

--pid pidlist

123

--ppid pidlist

-s sesslist

--sid sesslist

-123

t ttylist

-t ttylist

--tty ttylist

-F

-f

o format

-o format

--format

-O format

O format

-M

X

Z

-c

j

-j

l

-l

s

u

v

-y

-Z

--context

-H

f

--forest

-n namelist

N namelist

O order

--sort spec

k spec

S

--cumulative

c

e

h

--headers

--no-headers

n

-w

w

--cols n