PS Command Detailed

Sometimes the system administrator may only be concerned about which programs are running on the system and don't want to know which processes are running. Because an application may need to start multiple processes. So in the same situation, the number of processes is much more than the procedure. For this to be read, the administrator needs to know the specific programs that are running on the system. To achieve this requirement, you need to use command PS to help.
To monitor and control the process, you must first understand the current process, that is, you need to see the current process, and the PS command is the most basic and very powerful process view command. Use this command to determine which processes are running and running, whether the process is complete, if the process is zombie, which processes are consuming too many resources, and so on. In short, most of the information can be obtained by executing the command.
############################################################
Name: PS
Usage rights: All users
How to use: PS [options] [--help]
Description: Shows the dynamics of the instantaneous stroke (process)
Parameters: The parameters of PS are very many, only a few common parameters are listed here and the meaning
-A lists all processes
-W display widen to show more information
-au Show more detailed information
-aux Show all itineraries that contain other users
############################################################
Common parameters:
-A show all processes (equivalent to-e) (utility)
-a displays all processes of a terminal, in addition to session leader
-N ignores selection.
-D displays all processes, but omits all session leaders (utility)
-X displays a process that does not control the terminal, and displays the specific path of each command. DX cannot be combined. (utility)
-p PID process uses CPU time
-U uid or username Select a valid user ID or user name
-G gid or groupname displays all processes for the group.
U username Displays all processes under the user, and displays the detailed path of each command. such as: PS U Zhang; (utility)
-F is all listed, and is usually used with other options. such as: Ps-fa or Ps-fx and so on.
-L long format (with fields such as F,wchan,c)
-J Job Format
-o user-defined format.
V display in virtual memory format
s displayed in signal format
-M Show All threads
-H displays the level of the process (shared with other commands, such as: ps-ha) (utility)
The e command then displays the environment (for example: ps-d e; Ps-a e) (utility)
H does not display the first line
############################################################
ps Command common usage (easy to view system process)
1) PS A shows all the programs under the current terminal, including other users ' programs.
2) ps-a Show all processes.
3) PS C lists the program, displays the actual instruction name of each program, and does not include the path, parameter or the indication of the resident service.
4) Ps-e The effect of this parameter is the same as specifying the "A" parameter.
5) When listing the program, PS e displays the environment variables used by each program.
6) PS F Displays the tree structure with ASCII characters, expressing the relationship between the programs.
7) ps-h shows the tree structure, indicating the relationship between the programs.
8) Ps-n shows all the programs except the program under the PS Command Terminal.
9) PS s uses the program signal format to display the program status.
PS S when listing programs, including interrupted sub-program data.
ps-t< Terminal number > Specify the terminal number, and list the status of the program belonging to the terminal.
PS U Displays the status of the program in a user-oriented format.
PS x Displays all programs and does not differentiate by terminal.
The most common approach is to Ps-aux, and then use a pipe symbol to direct to grep to find a specific process and then manipulate the specific process.
############################################################
Run PS aux to the following information:
root:# PS aux
USER PID%cpu%MEM VSZ RSS TTY STAT START time COMMAND
Smmsp 3521 0.0 0.7 6556 1616? Ss 20:40 0:00 sendmail:queue [email protected]:00:00 f
Root 3532 0.0 0.2 2428 452? Ss 20:40 0:00 gpm-m/dev/input/mice-t imps2
HTT 3563 0.0 0.0 2956 196? Ss 20:41 0:00/usr/sbin/htt-retryonerror 0
HTT 3564 0.0 1.7 29460 3704? Sl 20:41 0:00 Htt_server-nodaemon
Root 3574 0.0 0.4 5236 992? Ss 20:41 0:00 Crond
XFS 3617 0.0 1.3 13572 2804? Ss 20:41 0:00 Xfs-droppriv-daemon
Root 3627 0.0 0.2 3448 552? SNs 20:41 0:00 anacron-s
Root 3636 0.0 0.1 2304 420? Ss 20:41 0:00/USR/SBIN/ATD
Dbus 3655 0.0 0.5 13840 1084? SSL 20:41 0:00 dbus-daemon-1--system

Head Header:
User username
UID Subscriber ID (user ID)
PID Progress ID (Process ID)
PPID Process ID (parent process ID)
SID Conversation ID (session ID)
CPU utilization of the%CPU process
Memory utilization of the%MEM process
The size of the virtual memory used by the VSZ process (virtual size)
The size of the resident set used by the RSS process, or the size of the actual memory, Kbytes bytes.
TTY associated with a process terminal (TTY)
Status of the stat process: process State is represented by a character (stat's status code)
R runs Runnable (on Run queue) is running or waiting in the run queue.
S sleep sleeping dormant, obstructed, waiting for a condition to form or receive signals.
I Free Idle
The Z Zombie Zombie (a defunct process) session has been terminated, but the process descriptor exists until the parent process calls the WAIT4 () system call and releases.
D non-interruptible uninterruptible sleep (ususally IO) receives a signal that does not wake up and is not operational, and the process must wait until an interrupt occurs.
T terminates the Terminate process to receive sigstop, SIGSTP, Sigtin, and Sigtou signals after it stops running.
P Wait for Exchange page
W no-resident page has no resident pages there is not enough memory paging to allocate.
X dead Process
< high-priority process
N low-priority process with lower priority sequence
L Memory Lock page lock has memory paging allocated and shrunk in memory body
Leader of the S-process (under it there are sub-processes);
L multi-process (using Clone_thread, similar to NPTL pthreads)
+ process groups in the background
Start process startup time and date
The total CPU time used by the duration process
command-line command being executed
NI Priority (Nice)
PRI Process Precedence Number (priority)
The name of the kernel function in which the Wchan process is sleeping; the name of the function is obtained from the/root/system.map file.
FLAGS and process-related digital IDs
############################################################
Example:
View the uid,pid,stat,pri of the current system process, sorted by UID number.
Ps-eo Pid,stat,pri,uid–sort UID
View the User,pid,stat,rss,args of the current system process, sorted by RSS.
Ps-eo User,pid,stat,rss,args–sort RSS
############################################################
PS gives us a one-time view of the process, it provides a view of the results is not dynamic continuous, if you want to monitor the process, you should use the top tool.

1, PS parameter description:
PS offers a number of options parameters, commonly used in the following several:
l long format output;
U displays the process in the order of the user name and start time;
J Use the task format to display the process;
F to display the process in a tree-shaped format;
A shows all processes of all users (including other users);
X shows the process without control terminal;
R shows the running process;
WW avoids detailed parameters being truncated;
Our common options are the combination of aux or lax, and the application of parameter F.

2. Explanation of PS aux or lax output:
Owner of the USER process;
The ID of the PID process;
PPID parent process;
Percentage of CPU consumed by the%CPU process;
%MEM% of memory occupied;
The nice value of the NI process, which is large, means that it consumes less CPU time;
VSZ process virtual size;
The number of pages that RSS resides in;
TTY Terminal ID
STAT process status (with the following types)
D a dormant state (usually IO process) that cannot be interrupted;
R is running can be in the queue can be too line;
S is in a dormant state;
T stop or be traced;
W enters memory swap (invalid starting from kernel 2.6);
X dead process (never seen);
Z Zombie process;
< high-priority processes
N Low-priority processes
L Some pages are locked into memory;
Leader of the S-process (under it there are sub-processes);
L multi-process (using Clone_thread, similar to NPTL pthreads);
+ Process Group located in the background;
Wchan the process resources being awaited;
Start START process time;
The time the process consumes the CPU;
The name and parameters of the command commands;

3, Application Examples:
[Email protected] ~]# Ps-aux |more
Can be used | The pipe and more are linked up for pagination viewing.
[Email protected] ~]# Ps-aux > Ps001.txt
Output the results to the Ps001.txt text and save them.
[Email protected] ~]# more Ps001.txt
Here is the display of all the processes, and output to the Ps001.txt file, and then through more to Page view.

4, kill kills the process, there are more than 10 ways to control the process, the following are some common methods:
[[Email protected] ~] #kill-stop [PID]
Send Sigstop (17,19,23) to stop a process without destroying it.
[[Email protected] ~] #kill-cont [PID]
Send Sigcont (19,18,25) to restart a stopped process.
[[Email protected] ~] #kill-kill [PID]
Send Sigkill (9) forces the process to stop immediately and does not implement a cleanup operation.
[[Email protected] ~] #kill-9-1
Stop all the processes you have.
SIGKILL and SIGSTOP signals cannot be captured, blocked, or ignored, but other signals can. So this is your ultimate weapon.
############################################################
Use the PS command to report the executing program to the administrator:
Sometimes the system administrator may only be concerned about which programs are running on the system and don't want to know which processes are running. Because an application may need to start multiple processes. In the same situation, the number of processes is much larger than the procedure. For this to be read, the administrator needs to know the specific programs that are running on the system. To achieve this requirement, you need to use command PS to help.
The PS command displays the meaning of the result.
When you need to see the programs that are executing on your system, the PS command is not the only command, but is definitely the most frequently used command. As shown, the results are displayed after the PS command is executed.
By entering command PS on the command line, you can display all the applications currently running on the system. As shown, if you enter the PS command, its display results are mainly four sections. The first is the PID, which is the program ID number. The system is to use this ID number to uniquely identify the application, rather than using commands to identify it. This PID number is required when the application needs to be forced to close. Next is the TTY, which represents the terminal code used by the user. PTS indicates that the user is using Telnet. The third parameter, time, indicates how long the program consumes the CPU, and note that this is not the time the program started running. The last parameter, CMD, represents the name of the program.
Second, let the system report detailed information.
When using the PS command, if you do not take any optional options, the information displayed is very limited and often shows only the programs that the current user is running. When a system administrator needs to know more detailed information about the operation of the application, such as to know the application memory and CPU occupancy, then you need to add some options. If the system administrator needs to see the applications executed by other users together, it is necessary to use the optional-al after this command. In this case, all programs running on the system are listed. If you want to know the CPU and memory usage of a program, rather than simply the actual CPU usage time, then you need to add the parameter-l to this command, that is, using the PS–L command allows the system to display detailed operational information of the application. If you are interested, you can check the relevant help for the meaning of the above fields. In general, the system administrator is concerned about the program's PID number, memory and CPU usage, the name of the command, the user's terminal and so on. Other information is not of great value to system administrators.
Third, look at the program running in the background.
By default, the PS command displays only the programs that are running in the foreground, and does not show programs running in the background. However, not all programs are run in the foreground. Under normal circumstances, the number of programs that are hidden in the background is much larger than the program running in the foreground. Many system-brought programs that start as the operating system starts are run in the background. And sometimes, the system problems are often caused by background programs. such as the common Trojans and other programs are running in the background. For this reason, the system administrator is more interested in knowing which programs are running in the background.
If you want to see the programs running in the background, it's a little more complicated. Because in different versions of the Linux operating system, it is possible to display background processes with different options. As in Red Hat Linux operating system, in fact, the form of parameters rather than optional. The PS aux command is used to display all applications (both foreground and background). The difference between the parameter and the optional option is mainly in front and without this-symbol. If this symbol is represented, this is an optional option. And if it doesn't, it means it's a parameter. This symbol cannot be saved under normal circumstances. In the place where the write is not written, or do not need to add, the system will prompt the error message, saying that the command could not be found. In other versions of the Linux system, this aux parameter may not be recognized. As in some Linux operating system versions, you need to use the-a option to accomplish this task. Due to the differences between the system versions, the system administrator has brought a lot of trouble. Fortunately, there are online help in each operating system version. If your system administrator uses a new version of the operating system and does not know which option to use for all processes, you can use commands such as PS--heip to view system help. However, the drawback is that the system online Help is English, the system administrator's English level is a very small test. However, if you want to be a Linux system administrator, this English language is still needed. Because the newest Linux technology basically comes out in English document first. In fact, to master the most advanced operating system books, most of the computer books are in English.
Iv. sort the list of programs.
When running applications for a long time, the system administrator needs to sort the application. The sorting function of the PS command is relatively strong. Mainly because this command has a--sort parameter (note that in front of this parameter is the two small crossbar symbols, readers should not think that the author is wrong). After this parameter, you can sort by adding the sort fields that the system administrator wants. If this command ps–a--sort cmd, it shows all the applications of the system and sorts them according to the program commands. In the Linux operating system parameters, there is a more troublesome thing, is that the parameter case is different often represents a different meaning. As the above command, the uppercase A is replaced by lowercase character A, the result is completely different. Uppercase character A represents all applications, and lowercase character a means "all w/tty except session leaders". There is an essential difference between the two. This difference can be used to filter the applications that are running on different terminal login accounts.
In the PS command, this is the case with many parameters. Run PS--help to see all the parameters of this command, you can see that a similar case is different for different meanings. such as uppercase characters O and lowercase characters o, uppercase characters U and lowercase characters u, and so on. These differences invisibly increase the difficulty of the system administrator in maintaining the operating system. It is often impossible for a system administrator to master so many parameters and the difference between the case of the parameter. In addition to using commonly used parameters to increase the impression of the value of the system administrator, this system command online help is indeed indispensable. This system help provides an online guide for administrators to use system commands.
V. Reporting on the operation of specific programs.
When the system runs a long time, by sorting the program name can help the administrator to find their own program of interest. But this is still not the easiest way. As the system administrator in other operating systems now found a trojan called ThreadX in the background of the system to run. For this reason the administrator needs to see if there is a trojan running on the other computer. What should be done at this point? Sort the name of the program using the Sort function (note that the PID is not sorted by the program, because the PID number is different, even if the program is the same, the start time is different or the number of programs that are started in the operating system is different.) This means that the PID number is automatically generated). This can help administrators speed up the program lookups to some extent. However, I think that if the system administrator can use the pipe character and grep and other query commands may be faster to find the application information they need.
If the system administrator now use this command PS aux |grep "THREADX", what will happen? The system will first list all the applications running in the current system (including the foreground running and running in the background). The result of the output is then passed to the command grep through the pipe symbol | The command grep then checks the results of the PS command output to see if there is any information THREADX the program running. If it does, it displays information about the program in the window and filters out the running information for other applications. It can be seen that the use of pipe characters combined with other query commands helps system administrators find information about the application they want to know in the shortest period of time.
Combined with some special symbols, you can also implement some more responsible functions. If used in conjunction with the Cat command, you can count the number of eligible programs. If you add the > symbol after the command, you can locate the output result in a file. If used in conjunction with wildcard characters, you can query a class of programs that meet certain criteria. If you can also query out a program parent program or its subroutine running information, and so on.

PS Command Detailed