Convenient ways to use ps commands for operation

Hello.
My name is Okazaki from the System Solutions Department.
This time, I will write about the ps commands that are often used during operations.

What is PS command?

The syntax of the command to display currently running processes is as follows.

ps [optional]

This command allows you to specify which processes to display by specifying various options.

Usage example

Show the processes that are currently running

$ ps PID TTY TIME CMD 12558 pts/0 00:00:00 sudo 12559 pts/0 00:00:00 su 12560 pts/0 00:00:00 bash 12611 pts/0 00:00:00 ps

Show all processes running on your system

$ ps aux USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 1.4 0.2 19632 2492 ? Ss 11:53 0:00 /sbin/init root 2 0.0 0.0 0 0 ? S 11:53 0:00 [kthreadd ] root 3 0.0 0.0 0 0 ? S 11:53 0:00 [ksoftirqd/0] root 4 0.0 0.0 0 0 ? 11:53 0:00 [kworker/0:0H] root 6 0.0 0.0 0 0 ? S 11:53 0:00 [kworker/u30:0] root 7 0.0 0.0 0 0 ? S 11:53 0:00 [rcu_sched ] root 8 0.0 0.0 0 0 ? S 11:53 0:00 [rcu_bh] root 9 0.0 0.0 0 0 ? S 11:53 0:00 [migration/0] root 10 0.0 0.0 0 0 ? S< 11:53 0 :00 [lru-add-drain] root 11 0.0 0.0 0 0 ? S 11:53 0:00 [cpuhp/0] root 12 0.0 0.0 0 0 ? S 11:53 0:00 [kdevtmpfs] root 13 0.0 0.0 0 0 ? S< 11:53 0:00 [netns] root 14 0.0 0.0 0 0 ? S 11:53 0:00 [kworker/u30:1] root 16 0.0 0.0 0 0 ? S 11:53 0:00 [xenwatch ] root 17 0.0 0.0 0 0 ? S 11:53 0:00 [kworker/u30:2] root 21 0.0 0.0 0 0 ? S 11:53 0:00 [xenbus]

or

$ ps -ef UID PID PPID C STIME TTY TIME CMD root 1 0 0 11:53 ? 00:00:00 /sbin/init root 2 0 0 11:53 ? 00:00:00 [kthreadd] root 3 2 0 11 :53 ? 00:00:00 [ksoftirqd/0] root 4 2 0 11:53 ? 00:00:00 [kworker/0:0] root 5 2 0 11:53 ? 00:00:00 [kworker/0 :0H] root 6 2 0 11:53 ? 00:00:00 [kworker/u30:0] root 7 2 0 11:53 ? 00:00:00 [rcu_sched] root 8 2 0 11:53 ? 00:00 :00 [rcu_bh] root 9 2 0 11:53 ? 00:00:00 [migration/0] root 10 2 0 11:53 ? 00:00:00 [lru-add-drain] root 11 2 0 11:53 ? 00:00:00 [cpuhp/0] root 12 2 0 11:53 ? 00:00:00 [kdevtmpfs]

Although there are differences in the display, you can output a list of processes currently running on the server.
You can find out how many processes with the same name are currently running with the following.

$ ps -ef | grep [process you want to check] | wc -l or ps aux | grep [process you want to check] | wc -l 31

Display only the items specified with the ps command

$ ps -eo pid,user,rss,pcpu,pmem,args PID USER RSS %CPU %MEM COMMAND 1 root 2456 0.3 0.2 /sbin/init 2 root 0 0.0 0.0 [kthreadd] 3 root 0 0.0 0.0 [ksoftirqd/0] 4 root 0 0.0 0.0 [kworker/0:0] 5 root 0 0.0 0.0 [kworker/0:0H]

In the example, process ID, user, physical memory usage, CPU usage rate, memory usage rate, and process name are displayed.
In this way, you can display only the specified items and output only the necessary information.
There are quite a lot of items that can be specified, so I will introduce some of them.

pcpu (%cpu) - Process cpu usage
pmem (%mem) - Memory usage
args (cmd,command) - Command with string arguments
pid - Process ID
ppid - Parent process ID
uid (euid) - Execution user ID
gid (egid) - Execution group ID
user (euser,uname) - Execution user
group (egroup) - Execution group
rss (rssize,rsz) - Physical memory usage
lstart - Process startup time

Sort the output results by item

$ ps -eo pid,user,rss,args --sort rss PID USER RSS COMMAND 2667 ec2-user 2424 ps -eo pid,user,rss,args --sort rss 2232 root 2428 auditd 1 root 2464 /sbin/init 2544 root 2528 crond 1533 root 2572 /sbin/udevd -d 2253 root 2592 /sbin/rsyslogd -i /var/run/syslogd.pid -c 5 2480 root 2596 /usr/sbin/sshd 2314 rpcuser 3160 rpc.statd 2639 ec2- user 3416 -bash 2519 smmsp 3848 sendmail: Queue runner@01:00:00 for /var/spool/clientmqueue 2638 ec2-user 3988 sshd: ec2-user@pts/0 2510 root 4084 sendmail: accepting connections 2490 ntp 4332 ntpd - u ntp:ntp -p /var/run/ntpd.pid -g

In the example, RSS results are sorted.
Also, please be careful when using this as it cannot be sorted by item.
The following is the result of trying to sort by httpd process startup time.

$ ps -eo pid,lstart,args --sort lstart | grep httpd PID STARTED COMMAND 21544 Thu Aug 3 14:57:43 2017 /usr/sbin/httpd 21733 Thu Aug 3 14:58:42 2017 grep httpd 21734 Thu Aug 3 11:17:55 2017 /usr/sbin/httpd 38742 Thu Aug 3 12:10:51 2017 /usr/sbin/httpd 42259 Sun Jul 30 04:29:09 2017 /usr/sbin/httpd 64817 Thu Aug 3 13 :32:34 2017 /usr/sbin/httpd

You can see that it is not sorted correctly by startup time but by pid.

summary

There are many opportunities to use the ps command
to check which processes are running during operation There are still many items that can be specified, so
I think it would be interesting to make full use of them and use them in a different way than usual.