Process monitoring
You, as the system administrator, can manage processes.
The ps command is the primary tool for observing the processes in the system. Most of the flags of the ps command fall into one of two categories:
- Flags that specify which types of processes to include in the output
- Flags that specify which attributes of those processes are to be displayed
The most widely useful variants of ps for system-management purposes are:
| Item | Description |
|---|---|
| ps -ef | Lists all nonkernel processes, with the userid, process ID, recent CPU usage, total CPU usage, and the command that started the process (including its parameters). |
| ps -fu UserID | Lists all of the processes owned by UserID, with the process ID, recent CPU usage, total CPU usage, and the command that started the process (including its parameters). |
To identify the current heaviest users of CPU time, you could enter:
ps -ef | egrep -v "STIME|$LOGNAME" | sort +3 -r | head -n 15This command lists, in descending order, the 15 most CPU-intensive processes other than those owned by you.
For more specialized uses, the following two tables are intended to simplify the task of choosing ps flags by summarizing the effects of the flags.
Process-Specifying Flags
| -A | -a | -d | -e | -G -g | -k | -p | -t | -U -u | a | g | t | x | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| All processes | Y | - | - | - | - | - | - | - | - | - | Y | - | - |
| Not processes group leaders and not associated with a terminal | - | Y | - | - | - | - | - | - | - | - | - | - | - |
| Not process group leaders | - | - | Y | - | - | - | - | - | - | - | - | - | - |
| Not kernel processes | - | - | - | Y | - | - | - | - | - | - | - | - | - |
| Members of specified-process groups | - | - | - | - | Y | - | - | - | - | - | - | - | - |
| Kernel processes | - | - | - | - | - | Y | - | - | - | - | - | - | - |
| Those specified in process number list | - | - | - | - | - | - | Y | - | - | - | - | - | - |
| Those associated with tty(s) in the list | - | - | - | - | - | - | - | Y (n ttys) | - | - | - | Y (1 tty) | - |
| Specified user processes | - | - | - | - | - | - | - | - | Y | - | - | - | - |
| Processes with terminals | - | - | - | - | - | - | - | - | - | Y | - | - | - |
| Not associated with a tty | - | - | - | - | - | - | - | - | - | - | - | - | Y |
Column-Selecting Flags
| Default1 | -f | -l | -U -u | Default2 | e | l | s | u | v | |
|---|---|---|---|---|---|---|---|---|---|---|
| PID | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y |
| TTY | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y |
| TIME | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y |
| CMD | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y |
| USER | - | Y | - | - | - | - | - | - | Y | - |
| UID | - | - | Y | Y | - | - | Y | - | - | - |
| PPID | - | Y | Y | - | - | - | Y | - | - | - |
| C | - | Y | Y | - | - | - | Y | - | - | - |
| STIME | - | Y | - | - | - | - | - | - | Y | - |
| F | - | - | Y | - | - | - | - | - | - | - |
| S/STAT | - | - | Y | - | Y | Y | Y | Y | Y | Y |
| PIR | - | - | Y | - | - | - | Y | - | - | - |
| NI/NICE | - | - | Y | - | - | - | Y | - | - | - |
| ADDR | - | - | Y | - | - | - | Y | - | - | - |
| SIZE | - | - | - | - | - | - | - | - | Y | - |
| SZ | - | Y | - | - | - | Y | - | Y | - | - |
| WCHAN | - | - | Y | - | - | - | Y | - | - | - |
| RSS | - | - | - | - | - | - | Y | - | Y | Y |
| SSIZ | - | - | - | - | - | - | - | Y | - | - |
| %CPU | - | - | - | - | - | - | - | - | Y | Y |
| %MEM | - | - | - | - | - | - | - | - | Y | Y |
| PGIN | - | - | - | - | - | - | - | - | - | Y |
| LIM | - | - | - | - | - | - | - | - | - | Y |
| TSIZ | - | - | - | - | - | - | - | - | - | Y |
| TRS | - | - | - | - | - | - | - | - | - | Y |
| Environment (following the command) | - | - | - | - | - | Y | - | - | - | - |
If ps is given with no flags or with a process-specifying flag that begins with a minus sign, the columns displayed are those shown for Default1. If the command is given with a process-specifying flag that does not begin with minus, Default2 columns are displayed. The -u or -U flag is both a process-specifying and column-selecting flag.
The following are brief descriptions of the contents of the columns:
| Item | Description |
|---|---|
| PID | Process ID |
| TTY | Terminal or pseudo-terminal associated with the process |
| TIME | Cumulative CPU time consumed, in minutes and seconds |
| CMD | Command the process is running |
| USER | Login name of the user to whom the process belongs |
| UID | Numeric user ID of the user to whom the process belongs |
| PPID | ID of the parent process of this process |
| C | Recently used CPU time |
| STIME | Time the process started, if less than 24 hours. Otherwise the date the process is started |
| F | Eight-character hexadecimal value describing the flags associated with the process (see the detailed description of the ps command) |
| S/STAT | Status of the process (see the detailed description of the ps command) |
| PRI | Current priority value of the process |
| NI/NICE | Nice value for the process |
| ADDR | Segment number of the process stack |
| SIZE | (-v flag) The virtual size of the data section of the process (in kilobytes) |
| SZ | (-l and l flags) The size in kilobytes of the core image of the process. |
| WCHAN | Event on which the process is waiting |
| RSS | Sum of the numbers of working-segment and code-segment pages in memory times 4 |
| SSIZ | Size of the kernel stack |
| %CPU | Percentage of time since the process started that it was using the CPU |
| %MEM | Nominally, the percentage of real memory being used by the process, this measure does not correlate with any other memory statistics |
| PGIN | Number of page ins caused by page faults. Since all I/O is classified as page faults, this is basically a measure of I/O volume |
| LIM | Always xx |
| TSIZ | Size of the text section of the executable file |
| TRS | Number of code-segment pages times 4 |
| Environment | Value of all the environment variables for the process |