ps

ps -c cmd 查看指定命令名的进程

ps -L 显示线程

ps L 查看栏名称

ps e 显示进程的环境变量

 

EXAMPLES

To see every process on the system using standard syntax:
  ps -e
  ps -ef
  ps -eF
  ps -ely

To see every process on the system using BSD syntax:
  ps ax
  ps axu

To print a process tree:
  ps -ejH
  ps axjf

To get info about threads:
  ps -eLf
  ps axms

To get security info:
  ps -eo euser,ruser,suser,fuser,f,comm,label
  ps axZ
  ps -eM

To see every process running as root (real & effective ID) in user format:
  ps -U root -u root u

To see every process with a user-defined format:
  ps -eo pid,tid,class,rtprio,ni,pri,psr,pcpu,stat,wchan:14,comm
  ps axo stat,euid,ruid,tty,tpgid,sess,pgrp,ppid,pid,pcpu,comm
  ps -eopid,tt,user,fname,tmout,f,wchan

Print only the process IDs of syslogd:
  ps -C syslogd -o pid=

Print only the name of PID 42:
  ps -p 42 -o comm=

 

PROCESS STATE CODES
Here are the different values that the s, stat and state output specifiers (header "STAT" or "S") will display to describe the state of a process.
D    Uninterruptible sleep (usually IO)
R    Running or runnable (on run queue)
S    Interruptible sleep (waiting for an event to complete)
T    Stopped, either by a job control signal or because it is being traced.
W    paging (not valid since the 2.6.xx kernel)
X    dead (should never be seen)
Z    Defunct ("zombie") process, terminated but not reaped by its parent.

For BSD formats and when the stat keyword is used, additional characters may be displayed:
<    high-priority (not nice to other users)
N    low-priority (nice to other users)
L    has pages locked into memory (for real-time and custom IO)
s    is a session leader
l    is multi-threaded (using CLONE_THREAD, like NPTL pthreads do)
+    is in the foreground process group

常用的Format名字：

-o Format
comm
表示正在执行的命令的短名称。不包含命令行参数。该字段的缺省头为 COMMAND。
args
说明正在执行的完整命令名。包含所有命令行参数，尽管可能发生截断。该字段的缺省头为 COMMAND。
cmd
同args。


tpgsz
表示进程文本页的大小。
dpgsz
表示进程数据页的大小
spgsz
表示进程堆栈页的大小。


pcpu
表示使用的 CPU 时间占可用 CPU 时间的比例，以百分比表示。该字段的缺省头为 %CPU。
pmem       
内存占用百分比


time
表示进程启动后的累计 CPU 时间。时间以下列格式显示：
[ dd-]hh:mm:ss
其中 dd 指定天数，hh 指定小时数，mm 指定分钟数及 ss 指定秒数。该字段的缺省头为 TIME。


pid
表示进程标识的十进制值。该字段的缺省头为 PID。
ppid
表示父进程标识的十进制值。该字段的缺省头为 PPID。


tcpu
总 CPU 时间。指示单个进程的总累积 CPU 时间。该字段的缺省头为 TCPU。
tdiskio
总磁盘 I/O。指示单个进程的 I/O 的总累积块数。该字段的缺省头为 TDISKIO。




thcount
表示该进程拥有的内核线程数。该字段的缺省头为 THCNT。
tid
表示内核线程的线程标识。该字段的缺省头为 TID。


user
表示该进程的有效用户标识。显示文本用户标识。如果不能得到文本用户标识，使用十进制表示。该字段的缺省头为 USER。


sz         SZ      size in physical pages of the core image of the process. This includes text, data, and stack space. Device mappings are currently excluded; this is subject to change. See vsz and rss.


rss        RSS     resident set size, the non-swapped physical memory that a task has used (in kiloBytes). (alias rssize, rsz).


vsz        VSZ     virtual memory size of the process in KiB (1024-byte units). Device mappings are currently excluded; this is subject to change. (alias vsize).


wchan      WCHAN   name of the kernel function in which the process is sleeping, a "-" if the process is running, or a "*" if the process is multi-threaded and ps is not displaying threads.

// man ps中列出的Format名字

STANDARD FORMAT SPECIFIERS
       Here are the different keywords that may be used to control the output format (e.g. with option -o) or to sort the selected processes with the GNU-style --sort option.


       For example:  ps -eo pid,user,args --sort user


       This version of ps tries to recognize most of the keywords used in other implementations of ps.


       The following user-defined format specifiers may contain spaces: args, cmd, comm, command, fname, ucmd, ucomm, lstart, bsdstart, start.


       Some keywords may not be available for sorting.


       CODE       HEADER  DESCRIPTION
       %cpu       %CPU    cpu utilization of the process in "##.#" format. Currently, it is the CPU time used divided by the time the process has been running (cputime/realtime ratio), expressed as a percentage. It
                          will not add up to 100% unless you are lucky. (alias pcpu).


       %mem       %MEM    ratio of the process's resident set size  to the physical memory on the machine, expressed as a percentage. (alias pmem).


       args       COMMAND command with all its arguments as a string. Modifications to the arguments may be shown. The output in this column may contain spaces. A process marked <defunct> is partly dead, waiting to be
                          fully destroyed by its parent. Sometimes the process args will be unavailable; when this happens, ps will instead print the executable name in brackets. (alias cmd, command). See also the comm
                          format keyword, the -f option, and the c option.
                          When specified last, this column will extend to the edge of the display. If ps can not determine display width, as when output is redirected (piped) into a file or another command, the output
                          width is undefined (it may be 80, unlimited, determined by the TERM variable, and so on). The COLUMNS environment variable or --cols option may be used to exactly determine the width in this
                          case. The w or -w option may be also be used to adjust width.


       blocked    BLOCKED mask of the blocked signals, see signal(7). According to the width of the field, a 32 or 64-bit mask in hexadecimal format is displayed. (alias sig_block, sigmask).


       bsdstart   START   time the command started. If the process was started less than 24 hours ago, the output format is " HH:MM", else it is "Mmm dd" (where Mmm is the three letters of the month). See also lstart,
                          start, start_time, and stime.


       bsdtime    TIME    accumulated cpu time, user + system. The display format is usually "MMM:SS", but can be shifted to the right if the process used more than 999 minutes of cpu time.


       c          C       processor utilization. Currently, this is the integer value of the percent usage over the lifetime of the process. (see %cpu).


       caught     CAUGHT  mask of the caught signals, see signal(7). According to the width of the field, a 32 or 64 bits mask in hexadecimal format is displayed. (alias sig_catch, sigcatch).


       cgroup     CGROUP  display control groups to which the process belongs.


       class      CLS     scheduling class of the process. (alias policy, cls). Field's possible values are:
                          -   not reported
                          TS  SCHED_OTHER
                          FF  SCHED_FIFO
                          RR  SCHED_RR
                          B   SCHED_BATCH
                          ISO SCHED_ISO
                          IDL SCHED_IDLE
                          ?   unknown value


       cls        CLS     scheduling class of the process. (alias policy, class). Field's possible values are:
                          -   not reported
                          TS  SCHED_OTHER
                          FF  SCHED_FIFO
                          RR  SCHED_RR
                          B   SCHED_BATCH
                          ISO SCHED_ISO
                          IDL SCHED_IDLE
                          ?   unknown value


       cmd        CMD     see args. (alias args, command).


       comm       COMMAND command name (only the executable name). Modifications to the command name will not be shown. A process marked <defunct> is partly dead, waiting to be fully destroyed by its parent. The output
                          in this column may contain spaces. (alias ucmd, ucomm). See also the args format keyword, the -f option, and the c option.
                          When specified last, this column will extend to the edge of the display. If ps can not determine display width, as when output is redirected (piped) into a file or another command, the output
                          width is undefined (it may be 80, unlimited, determined by the TERM variable, and so on). The COLUMNS environment variable or --cols option may be used to exactly determine the width in this
                          case. The w or -w option may be also be used to adjust width.


       command    COMMAND see args. (alias args, cmd).


       cp         CP      per-mill (tenths of a percent) CPU usage. (see %cpu).


       cputime    TIME    cumulative CPU time, "[DD-]hh:mm:ss" format. (alias time).


       egid       EGID    effective group ID number of the process as a decimal integer. (alias gid).


       egroup     EGROUP  effective group ID of the process. This will be the textual group ID, if it can be obtained and the field width permits, or a decimal representation otherwise. (alias group).


       eip        EIP     instruction pointer.


       esp        ESP     stack pointer.


       etime      ELAPSED elapsed time since the process was started, in the form [[DD-]hh:]mm:ss.


       euid       EUID    effective user ID (alias uid).


       euser      EUSER   effective user name. This will be the textual user ID, if it can be obtained and the field width permits, or a decimal representation otherwise. The n option can be used to force the decimal
                          representation. (alias uname, user).


       f          F       flags associated with the process, see the PROCESS FLAGS section. (alias flag, flags).


       fgid       FGID    filesystem access group ID. (alias fsgid).


       fgroup     FGROUP  filesystem access group ID. This will be the textual group ID, if it can be obtained and the field width permits, or a decimal representation otherwise. (alias fsgroup).


       flag       F       see f. (alias f, flags).


       flags      F       see f. (alias f, flag).


       fname      COMMAND first 8 bytes of the base name of the process's executable file. The output in this column may contain spaces.


       fuid       FUID    filesystem access user ID. (alias fsuid).


       fuser      FUSER   filesystem access user ID. This will be the textual user ID, if it can be obtained and the field width permits, or a decimal representation otherwise.


       gid        GID     see egid. (alias egid).


       group      GROUP   see egroup. (alias egroup).


       ignored    IGNORED mask of the ignored signals, see signal(7). According to the width of the field, a 32 or 64 bits mask in hexadecimal format is displayed. (alias sig_ignore, sigignore).


       label      LABEL   security label, most commonly used for SE Linux context data. This is for the Mandatory Access Control ("MAC") found on high-security systems.


       lstart     STARTED time the command started. See also bsdstart, start, start_time, and stime.


       lwp        LWP     lwp (light weight process, or thread) ID of the lwp being reported. (alias spid, tid).


       maj_flt    MAJFLT  The number of major page faults that have occured with this process.


       min_flt    MINFLT  The number of minor page faults that have occured with this process.


       ni         NI      nice value. This ranges from 19 (nicest) to -20 (not nice to others), see nice(1). (alias nice).


       nice       NI      see ni. (alias ni).


       nlwp       NLWP    number of lwps (threads) in the process. (alias thcount).


       nwchan     WCHAN   address of the kernel function where the process is sleeping (use wchan if you want the kernel function name). Running tasks will display a dash ('-') in this column.


       pcpu       %CPU    see %cpu. (alias %cpu).


       pending    PENDING mask of the pending signals. See signal(7). Signals pending on the process are distinct from signals pending on individual threads. Use the m option or the -m option to see both. According to
                          the width of the field, a 32 or 64 bits mask in hexadecimal format is displayed. (alias sig).


       pgid       PGID    process group ID or, equivalently, the process ID of the process group leader. (alias pgrp).


       pgrp       PGRP    see pgid. (alias pgid).


       pid        PID     process ID number of the process.


       pmem       %MEM    see %mem. (alias %mem).


       policy     POL     scheduling class of the process. (alias class, cls). Possible values are:
                          -   not reported
                          TS  SCHED_OTHER
                          FF  SCHED_FIFO
                          RR  SCHED_RR
                          B   SCHED_BATCH
                          ISO SCHED_ISO
                          IDL SCHED_IDLE
                          ?   unknown value


       ppid       PPID    parent process ID.


       pri        PRI     priority of the process. Higher number means lower priority.


       psr        PSR     processor that process is currently assigned to.


       rgid       RGID    real group ID.


       rgroup     RGROUP  real group name. This will be the textual group ID, if it can be obtained and the field width permits, or a decimal representation otherwise.


       rss        RSS     resident set size, the non-swapped physical memory that a task has used (in kiloBytes). (alias rssize, rsz).


       rssize     RSS     see rss. (alias rss, rsz).


       rsz        RSZ     see rss. (alias rss, rssize).


       rtprio     RTPRIO  realtime priority.


       ruid       RUID    real user ID.


       ruser      RUSER   real user ID. This will be the textual user ID, if it can be obtained and the field width permits, or a decimal representation otherwise.


       s          S       minimal state display (one character). See section PROCESS STATE CODES for the different values. See also stat if you want additional information displayed. (alias state).


       sched      SCH     scheduling policy of the process. The policies SCHED_OTHER (SCHED_NORMAL), SCHED_FIFO, SCHED_RR, SCHED_BATCH, SCHED_ISO, and SCHED_IDLE are respectively displayed as 0, 1, 2, 3, 4, and 5.


       sess       SESS    session ID or, equivalently, the process ID of the session leader. (alias session, sid).


       sgi_p      P       processor that the process is currently executing on. Displays "*" if the process is not currently running or runnable.


       sgid       SGID    saved group ID. (alias svgid).


       sgroup     SGROUP  saved group name. This will be the textual group ID, if it can be obtained and the field width permits, or a decimal representation otherwise.


       sid        SID     see sess. (alias sess, session).


       sig        PENDING see pending. (alias pending, sig_pend).


       sigcatch   CAUGHT  see caught. (alias caught, sig_catch).


       sigignore  IGNORED see ignored. (alias ignored, sig_ignore).


       sigmask    BLOCKED see blocked. (alias blocked, sig_block).


       size       SIZE    approximate amount of swap space that would be required if the process were to dirty all writable pages and then be swapped out. This number is very rough!


       spid       SPID    see lwp. (alias lwp, tid).


       stackp     STACKP  address of the bottom (start) of stack for the process.


       start      STARTED time the command started. If the process was started less than 24 hours ago, the output format is "HH:MM:SS", else it is "  <mm dd" (where Mmm is a three-letter month name). See also lstart,
                          bsdstart, start_time, and stime.


       start_time START   starting time or date of the process. Only the year will be displayed if the process was not started the same year ps was invoked, or "MmmDD" if it was not started the same day, or "HH:MM"
                          otherwise. See also bsdstart, start, lstart, and stime.


       stat       STAT    multi-character process state. See section PROCESS STATE CODES for the different values meaning. See also s and state if you just want the first character displayed.


       state      S       see s. (alias s).


       suid       SUID    saved user ID. (alias svuid).


       supgid     SUPGID  gid of supplementary groups, see getgroups(2).


       supgrp     SUPGRP  names of supplementary groups, see getgroups(2).


       suser      SUSER   saved user name. This will be the textual user ID, if it can be obtained and the field width permits, or a decimal representation otherwise. (alias svuser).


       svgid      SVGID   see sgid. (alias sgid).


       svuid      SVUID   see suid. (alias suid).


       sz         SZ      size in physical pages of the core image of the process. This includes text, data, and stack space. Device mappings are currently excluded; this is subject to change. See vsz and rss.


       thcount    THCNT   see nlwp. (alias nlwp). number of kernel threads owned by the process.


       tid        TID     see lwp. (alias lwp).


       time       TIME    cumulative CPU time, "[DD-]HH:MM:SS" format. (alias cputime).


       tname      TTY     controlling tty (terminal). (alias tt, tty).


       tpgid      TPGID   ID of the foreground process group on the tty (terminal) that the process is connected to, or -1 if the process is not connected to a tty.


       tt         TT      controlling tty (terminal). (alias tname, tty).


       tty        TT      controlling tty (terminal). (alias tname, tt).


       ucmd       CMD     see comm. (alias comm, ucomm).


       ucomm      COMMAND see comm. (alias comm, ucmd).


       uid        UID     see euid. (alias euid).


       uname      USER    see euser. (alias euser, user).


       user       USER    see euser. (alias euser, uname).


       vsize      VSZ     see vsz. (alias vsz).


       vsz        VSZ     virtual memory size of the process in KiB (1024-byte units). Device mappings are currently excluded; this is subject to change. (alias vsize).


       wchan      WCHAN   name of the kernel function in which the process is sleeping, a "-" if the process is running, or a "*" if the process is multi-threaded and ps is not displaying threads.