Running `ps aux` in the terminal shows you every process currently running on your Linux machine. This is the fastest way to learn how to see all processes in linux, and it works on almost any distribution. But there are many other commands and tools you can use to get a complete picture of what’s happening under the hood.
In this guide, I’ll show you several methods to list, filter, and monitor processes. You’ll learn the commands that system administrators use every day. Let’s start with the basics and build up to more advanced techniques.
How To See All Processes In Linux
The most common way to see all processes is with the `ps` command. But `ps` has many options. The `aux` combination is the most popular because it shows every process for all users, with detailed information.
Open your terminal and type:
ps aux
You’ll see a long list. Each line represents one process. The columns show the user, process ID (PID), CPU usage, memory usage, and the command that started it.
Here’s what each column means:
- USER – The owner of the process
- PID – Unique process identifier
- %CPU – CPU usage percentage
- %MEM – Memory usage percentage
- VSZ – Virtual memory size
- RSS – Resident set size (physical memory)
- TTY – Terminal associated with the process
- STAT – Process state (like running, sleeping)
- START – Time the process started
- TIME – Total CPU time used
- COMMAND – The command that started it
If you want to see processes in a tree format, showing parent-child relationships, use `ps auxf`. The `f` flag adds a forest view.
Another useful variant is `ps -ef`. This shows all processes with a different format. Some people prefer it because it’s easier to read.
Using Top And Htop For Real-Time Monitoring
The `ps` command gives you a snapshot. But if you want to see processes update in real time, use `top`. Just type:
top
Top shows a dynamic list sorted by CPU usage by default. You can press keys to change the sort order. Press `M` to sort by memory usage. Press `P` to sort by CPU again.
Top also shows system summary information at the top, like uptime, load average, and memory stats.
For a more user-friendly version, install `htop`. It’s not installed by default on most systems. Install it with your package manager:
sudo apt install htop (Debian/Ubuntu)
sudo yum install htop (RHEL/CentOS)
Then run:
htop
Htop shows processes in color. You can scroll horizontally and vertically. You can kill processes by selecting them and pressing F9. It’s much easier to use than top.
Listing Processes For A Specific User
Sometimes you only want to see processes owned by a specific user. Use the `-u` option with ps:
ps -u username
For example, to see all processes for the user “john”:
ps -u john
You can also combine this with other options. To see all processes for multiple users:
ps -u john,alice,bob
If you want to see processes for the current user only, use:
ps -x
Filtering Processes By Name Or PID
To find a specific process by name, use `pgrep` or `ps` with `grep`. The `pgrep` command is simpler:
pgrep firefox
This returns the PID of any process named “firefox”. To see more details, combine with `ps`:
ps -p $(pgrep firefox)
Or use the classic grep approach:
ps aux | grep firefox
This pipes the output of `ps aux` into `grep`, which searches for lines containing “firefox”.
To filter by PID directly, use:
ps -p 1234
Replace 1234 with the actual PID. You can list multiple PIDs separated by commas:
ps -p 1234,5678,9012
Understanding Process States
When you look at the STAT column in `ps aux`, you’ll see letters like R, S, D, Z, and T. These indicate the process state:
- R – Running or runnable (on run queue)
- S – Sleeping (waiting for an event)
- D – Uninterruptible sleep (usually waiting for I/O)
- Z – Zombie (terminated but not reaped by parent)
- T – Stopped (by a job control signal)
Zombie processes are normal but should be cleaned up quickly. If you see many zombies, something is wrong with the parent process.
Using The /Proc Filesystem
Linux exposes process information through the `/proc` filesystem. Each running process has a directory named after its PID under `/proc`. For example:
ls /proc/1234
Inside that directory, you’ll find files like:
- status – Human-readable process info
- cmdline – The command that started the process
- environ – Environment variables
- fd – Open file descriptors
To see all running processes, you can list the numeric directories in `/proc`:
ls /proc | grep -E '^[0-9]+$'
This shows all PIDs. But using `ps` is easier and more informative.
Monitoring Processes With Systemd
If your system uses systemd (most modern Linux distributions do), you can use `systemctl` to see services. But for all processes, use:
systemd-cgls
This shows the control group hierarchy, which includes all processes. It’s a tree view similar to `ps auxf`.
You can also use `systemd-cgtop` to see resource usage by control group:
systemd-cgtop
Using The Pstree Command
The `pstree` command shows processes in a tree format. It’s great for understanding parent-child relationships:
pstree
This shows a text-based tree. To include PIDs:
pstree -p
To show only processes owned by a specific user:
pstree username
Killing Processes You Find
Once you’ve identified a process you want to stop, use the `kill` command. First, get the PID:
ps aux | grep unwanted-process
Then kill it:
kill 1234
If the process doesn’t respond, use a stronger signal:
kill -9 1234
The `-9` signal (SIGKILL) forces the process to terminate immediately. Use it as a last resort because it doesn’t allow the process to clean up.
You can also use `pkill` to kill by name:
pkill firefox
This kills all processes named “firefox”. Be careful with this command.
Using The Watch Command For Continuous Monitoring
To run `ps aux` repeatedly and see changes, use `watch`:
watch -n 2 'ps aux'
This updates the output every 2 seconds. You can change the interval with the `-n` option.
Combine it with grep to monitor a specific process:
watch -n 1 'ps aux | grep apache'
Checking Process Resource Usage
To see detailed resource usage for a specific process, use `pidstat` from the sysstat package:
pidstat -p 1234 1
This shows CPU usage every second. To see memory usage:
pidstat -r -p 1234 1
For I/O statistics:
pidstat -d -p 1234 1
Using The Lsof Command
The `lsof` command lists open files. Since everything in Linux is a file, this includes network connections and devices. To see all open files for a process:
lsof -p 1234
To see all processes that have a specific file open:
lsof /path/to/file
To list all network connections:
lsof -i
Understanding Background And Foreground Processes
When you run a command in the terminal, it runs in the foreground. You can send it to the background by pressing Ctrl+Z, then typing `bg`. To see background jobs:
jobs
To bring a background job to the foreground:
fg %1
Replace 1 with the job number from the `jobs` output.
To start a process in the background directly, add an ampersand at the end:
long-running-command &
Using The No-Hup Command
If you want a process to keep running even after you log out, use `nohup`:
nohup long-running-command &
This ignores the hangup signal. The output goes to a file called `nohup.out` unless you redirect it.
Viewing Process Trees With The Proc Filesystem
You can see the process tree by reading `/proc/[pid]/status` and following the PPID (parent PID). But it’s easier to use `pstree`.
However, if you want to do it manually, check the PPID field:
cat /proc/1234/status | grep PPid
Common Pitfalls And Troubleshooting
Sometimes `ps aux` shows many processes you don’t recognize. That’s normal. Linux runs many background services. If you see a process using too much CPU or memory, investigate it with `top` or `htop`.
If you can’t see all processes, you might not have permission. Use `sudo`:
sudo ps aux
This shows processes owned by all users, including system processes.
If `ps` is not installed, install it with your package manager. It’s part of the procps package on most distributions.
Automating Process Monitoring With Scripts
You can write a simple bash script to monitor processes and log the output:
#!/bin/bash
while true; do
date >> /var/log/processes.log
ps aux >> /var/log/processes.log
sleep 60
done
This logs all processes every minute. You can modify it to filter specific processes or send alerts.
Using The Atop Command
Another advanced tool is `atop`. It shows system-level and process-level activity. Install it with your package manager, then run:
atop
It shows a dashboard with CPU, memory, disk, and network usage. Press `p` to see process details. Press `c` to see command lines.
Understanding Threads Within Processes
Some processes have multiple threads. To see threads, use the `-L` option with ps:
ps -eLf
This shows each thread as a separate line. The NLWP column shows the number of threads, and the LWP column shows the thread ID.
You can also see threads with `top` by pressing `H` (toggle threads mode).
Using The Glances Tool
Glances is a cross-platform monitoring tool. Install it with pip or your package manager:
sudo apt install glances
Then run:
glances
It shows a comprehensive dashboard with CPU, memory, disk, network, and processes. You can sort processes by different columns.
Filtering By Terminal
To see processes associated with a specific terminal, use the `t` option:
ps t tty1
Replace tty1 with your terminal name. To see processes not attached to any terminal (daemons):
ps aux | grep '?'
The question mark in the TTY column indicates no terminal.
Using The W Command
The `w` command shows who is logged in and what they are running:
w
It shows user, terminal, login time, idle time, and the current command. It’s a quick way to see active processes for logged-in users.
Checking Process Environment Variables
To see the environment variables of a running process, read the `/proc/[pid]/environ` file:
cat /proc/1234/environ | tr '\0' '\n'
The `tr` command replaces null characters with newlines for readability.
Using The Strace Command For Debugging
If you need to see what a process is doing at the system call level, use `strace`:
strace -p 1234
This shows every system call the process makes. It’s very verbose but useful for debugging.
Summary Of Commands
Here’s a quick reference table:
- ps aux – All processes
- ps -ef – All processes (different format)
- top – Real-time monitoring
- htop – User-friendly real-time monitoring
- pstree – Tree view
- pgrep – Find PIDs by name
- kill – Terminate a process
- lsof – List open files
- watch – Run command repeatedly
Each tool has its strengths. Use `ps aux` for a quick snapshot. Use `top` or `htop` for ongoing monitoring. Use `pstree` to understand process relationships.
Frequently Asked Questions
How Can I See All Processes In Linux Including Hidden Ones?
Use `ps aux` with `sudo` to see all processes. Hidden processes don’t really exist in Linux; all processes are visible with the right permissions. Use `sudo ps aux` to ensure you see everything.
What Is The Difference Between Ps Aux And Ps -Ef?
Both show all processes. `ps aux` uses BSD syntax and shows more columns by default. `ps -ef` uses standard syntax and shows a slightly different format. Both are equally valid.
How Do I See Processes Of All Users In Linux?
Use `ps aux` without any user filter. The `a` option shows processes for all users. If you don’t have permission, prepend `sudo`.
Can I See Processes That Started Before I Logged In?
Yes. `ps aux` shows all processes regardless