ps(1)
Name
ps − print process status statistics
Syntax
ps [ options ] [ namelist ] [ core ]
Description
The ps command prints information about processes. Without the −a option, only your processes are candidates to be printed by ps. Specifying the −a option causes other users’ processes to be printed, and specifying the −x option includes processes without control terminals.
You must use the −k option and specify both namelist and core files when looking at a crash dump. The optional namelist argument indicates that information is to be gathered using the specified system namelist file. (The namelist file is a kernel image file). If namelist is not specified, ps uses /vmunix. The core argument indicates that information is to be gathered using the specified corefile. If core is not specified, ps uses /dev/mem.
Options
−# Represents any given process number and must be the last option given. When used in combinations, this option overrides −a and is overridden by −tx.
−C Causes the %CPU field of the display to reflect the absolute percentage of cpu used by the process during its resident time for scheduling.
−S Causes the TIME field of the display to reflect the amount of user+system time spent by a process and its children.
−a Displays information for processes executed from all users’ terminals. The default is to show processes executed from your terminal only. When used in combinations, this option is overridden by −#.
−c Displays the command names as stored internally in the system for accounting purposes instead of the command arguments, which are kept in the process address space. This display is more reliable, if less informative, because a process is free to destroy the latter information.
−e Displays the environment as well as the command arguments.
−g Displays all processes within the process group. Without this option, ps prints only “interesting” processes. Processes are considered uninteresting if they are process group leaders; top-level command interpreters and processes waiting for users to login on free terminals are therefore normally not shown.
−k Uses the core file in place of /dev/kmem and /dev/mem. If the −k option is used but no core file is specified, ps uses /dev/mem.
−l Displays information in long format, showing the fields PPID, CP, PRI, NI, ADDR, SIZE, RSS, and WCHAN as described under Output Fields.
−s Adds the size SSIZ of the kernel stack of each process to the basic output format for use by system maintainers.
−tx Displays information for specified terminal only. Restricts output to processes whose controlling terminal is x. The argument x should be specified as printed by ps; for example, t3 for tty3, tco for console, td0 for ttyd0, t? for processes with no terminal, t for processes at the current tty, and so forth, are proper specifications for x. This option must be the last one given. When used in combinations, this option overrides −# and −a.
−u Displays user-oriented output, which includes fields USER, %CPU, and %MEM, SIZE. It also displays SZ and RSS, which are computed differently than for the −l and −v options. The SZ field is computed as SIZE + TSIZ (virtual size plus size of text). The TRS field is computed as RSS + (TRS/xccount) where xccount is the number of processes currently sharing the text.
−v Displays process system time and user time in addition to cumulative time. This display includes fields RE, SL, PAGEIN, SIZE, RSS, LIM, TSIZ, TRS, %CPU and %MEM, described under Output Fields.
−w Produces 132-column rather than 80 column output. If repeated, as ww, produces arbitrarily wide output. This information is used to decide how much to print for long commands.
−x Displays information for all processes, including those not executed from terminals.
The ps command ignores all options not mentioned in the reference page.
Restrictions
Information on processes can change while ps is running. The picture it gives is a snapshot taken at a given time.
Output Fields
All output formats include, for each process:
PIDThe process identification (PID) number
TTControl terminal of the process
TIMEIncludes both user and system time
STATThe state of the process, given by a sequence of four letters, for example, RWNA.
The first letter indicates the run status of the process:
RRunning processes
TStopped processes
PProcesses in page wait
DProcesses in disk (or other short-term) waits
SProcesses sleeping for less than about 20 seconds
IIdle processes (sleeping longer than about 20 seconds)
The second letter indicates whether a process is swapped out:
WProcesses that are swapped out
ZProcesses that are killed but not yet removed
(blank)
Processes that are in core
>Processes that have specified a soft limit on memory requirements and are exceeding that limit. Such a process is not swapped.
The third letter indicates whether a process is running with altered CPU scheduling priority, using nice(.).
NThe process priority is reduced
<The process priority has been artificially raised
(blank)
Processes running without special treatment
The fourth letter indicates any special treatment of the process for virtual memory. The possibilities are:
AStands for VA_ANOM. Typically represents a lisp() process making disk usage more efficient by removing gaps caused by deletes and collecting the remaining data.
SStands for VA_SEQL. Typical of large image processing programs that are using virtual memory to sequentially address voluminous data.
(blank)
Stands for VA_NORM.
Fields that are not common to all output formats:
USERName of the owner of the process
%CPUCPU utilization of the process. This is a decaying average over a minute or less of previous (real) time. Because the time base over which this is computed varies since processes may be very young, it is possible for the sum of all %CPU fields to exceed 200%.
NICE(or NI) Process scheduling increment. For further information, see setpriority(.).
SIZE(or SZ) Virtual size of the process (in 1024-byte units)
RSSReal memory (resident set) size of the process (in 1024-byte units)
LIMSoft limit on memory used, specified via a call to getrlimit(.). If no limit has been specified, then shown as xx
TSIZSize of text (shared program) image
TRSSize of resident (real memory) set of text
%MEMPercentage of real memory used by this process.
REResidency time of the process (seconds in core)
SLSleep time of the process (seconds blocked)
PAGEINNumber of disk I/O operations resulting from references by the process to pages not loaded in core
UIDNumerical user identification number of process owner
PPIDNumerical identification number of parent of process
CPShort-term CPU utilization factor used in scheduling
PRIProcess priority (nonpositive when in noninterruptible wait)
ADDRSwap address of the process or page frame of the beginning of the user page table entries
WCHANEvent for which process is waiting (an address in the system), with the initial part of the address trimmed off. For example, 80004000 prints as 4000.
FFlags associated with process as in < sys/proc.h >:
SLOAD00000001Process is resident in memory
SSYS00000002System process: swapper, pager,
idle (RISC only), trusted path daemon
SLOCK00000004Process is being swapped out
SSWAP00000008Process requested swapout for page table
growth
STRC00000010Traced
SWTED00000020Used in tracing
SULOCK00000040Locked in by plock(2)
SPAGE00000080Waiting for page-in to complete
SKEEP00000100Protected from swapout while tranferring
resources to another process
SOMASK00000200Used by sigpause(2)
SWEXIT00000400Exiting
SPHYSIO00000800Protected from swapout while doing physical
I/O
SVFORK00001000Process resulted from a vfork(2) that is not
yet complete
SVFDONE00002000Parent has received resources returned by
vfork(2) child
SNOVM00004000Process has no virtual memory, as it is a
parent in the context of vfork(2)
SPAGI00008000Process is demand paging data pages from its
text gnode.
SSEQL00010000Process has advised of sequential memory access
SUANOM00020000Process has advised of random memory access
SXCTDAT00080000Process has indicated intent to execute data
or stack (RISC only)
SNOCLDSTP00100000POSIX environment: no SIGCLD generated when
children stop (formerly named SOUSIG)
SOWEUPC00200000Process is owed a profiling tick
SSEL00400000Used by select(2)
SLOGIN00800000A login process
SPTECHG01000000The pte’s for the process have changed
SLKDONE04000000System V file lock applied
SFIXADE08000000Fix-up of unaligned accesses is attempted
(RISC only)
SEXECDN10000000Process has done an execve(2)
SIDLEP20000000The idle process (RISC only)
A process that has a parent and has exited, but for which the parent has not yet waited, is marked <defunct>. A process that is blocked trying to exit is marked <exiting>; the ps command makes an educated guess as to the file name and arguments given when the process was created by examining memory or the swap area. The method is inherently somewhat unreliable and in any event a process is entitled to destroy this information, so the names cannot be counted on too much.
Files
/vmunix System namelist
/dev/kmem Kernel memory
/dev/mem User process info
/dev/drum Swap device
/vmcore Core file
/dev Searched to find swap device and tty names