The ps command is key to understanding what’s running on your Linux system and the resources that each process is using. It’s useful to know how to display the information that ps provides in whatever way helps you focus on the problem you’re trying to resolve. One aspect of this is being able to sort the output of the ps aux command by any column to highlight particular information, such as how much memory processes are using or how long they’ve been running.
The trick involves using the ps command’s –sort option and knowing how to specify the column that you want to use for the sort. By default, ps sorts by process IDs (PIDs), showing the smallest first. PID 1 will appear at the top of the list, right under the column headings. The rest will follow in numeric order.
Here’s an example of the standard ps aux output. It probably looks familiar.
$ ps aux | head -5 USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.2 169820 14028 ? Ss Nov01 0:52 /lib/systemd/systemd --system --deserialize 22 root 2 0.0 0.0 0 0 ? S Nov01 0:00 [kthreadd] root 3 0.0 0.0 0 0 ? I< Nov01 0:00 [rcu_gp] root 4 0.0 0.0 0 0 ? I< Nov01 0:00 [rcu_par_gp]
Using the –sort option, you will get the same output if you sort by PID. Notice that you need to enter “pid” in lower case. However, you can change “pid” to any other column and sort by that one instead.
$ ps aux --sort pid | head -5 USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.2 169820 14028 ? Ss Nov01 0:52 /lib/systemd/systemd --system --deserialize 22 root 2 0.0 0.0 0 0 ? S Nov01 0:00 [kthreadd] root 3 0.0 0.0 0 0 ? I< Nov01 0:00 [rcu_gp] root 4 0.0 0.0 0 0 ? I< Nov01 0:00 [rcu_par_gp]
To see the largest values for the selected column listed first, you would have to change the sort option (e.g., -pid in place of pid). Notice how the display in this case will then start with the highest process ID. Think of – as meaning descending values (largest first) and just the name (e.g., pid) or the name with a plus sign prepended (e.g., +pid) as meaning ascending. The command shown below sorts by process ID showing the largest first.
$ ps aux --sort -pid | head -5 USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND shs 316468 0.0 0.0 8092 588 pts/0 S+ 14:15 0:00 head -5 shs 316467 0.0 0.0 12052 4080 pts/0 R+ 14:15 0:00 ps aux --sort -pid root 316463 0.0 0.0 0 0 ? I 14:14 0:00 [kworker/u8:1-events_power_efficient] root 316453 0.0 0.0 0 0 ? I 14:09 0:00 [kworker/0:0-events]
To sort by some other column, you need to use its column name. In this example “pmem” means the percentage of memory usage and using “-pmem” means we’ll see the processes using the most memory first. You could also use “%mem” and “-%mem”.
$ ps aux --sort -pmem | head -5 USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND gdm 1842 0.0 2.5 3765092 156612 tty1 Sl+ Nov01 3:44 /usr/bin/gnoe-shell root 171907 0.0 0.9 130096 60232 ? S<s Nov06 0:06 /lib/systemdsystemd-journald root 1431 0.1 0.8 146272 53900 ? Sl Nov01 17:58 nessusd -q gdm 2310 0.0 0.8 798716 50032 tty1 Sl+ Nov01 0:00 /usr/bin/Xwaland :1024 -rootless -noreset -accessx -core -auth /run/user/121/.mutter-Xwayladauth.BPIVS0 -listen 4 -listen 5 -displayfd 6 -listen 7
If you only want to see select columns of the ps output, you can specify them as in this example where only commands and their CPU usages are shown and the output is sorted by the largest CPU usage.
$ ps -eo comm,pcpu --sort -pcpu | head -5 COMMAND %CPU snmp 0.5 nessusd 0.1 systemd 0.0 kthreadd 0.0
Here’s a list of the column names and strings that you can use to sort by them:
Column Ascending Descending Heading Sort Sort Alternatives =============================================== USER user -user PID pid -pid %CPU pcpu -pcpu %cpu and -%cpu %MEM pmem -pmem %pmem and -%pmem VSZ vsz -vsz RSS rss -rss TTY tty -tty STAT stat -stat START start -start TIME time -time COMMAND comm -comm
Using the sort command
You can also pipe the output of the ps aux command to the sort command and select the column to use for sorting by using the column number (1 through 11). There are a couple of downsides to this approach: 1) that your column headings will be sorted along with the rest of the ps output, likely ending up somewhere you didn’t expect to see them; and 2) that you need to add an “n” to your sort command when the sort needs to be numerical. The ps command understand this distinction; sort does not and needs to be nudged.
A command like this one would sort on memory usage. The sort command uses “-nk 4” to (-n) sort numerically on the (-k 4) 4th data column in the sort output.
$ ps aux | head -1; ps aux | sort -r -nk 4 | head -6 USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND gdm 1842 0.0 2.5 3765092 156612 tty1 Sl+ Nov01 3:46 /usr/bin/gnome-shell root 171907 0.0 0.9 130096 60380 ? S<s Nov06 0:06 /lib/systemd/systemd-journald root 1431 0.1 0.8 146272 53900 ? Sl Nov01 18:04 nessusd -q gdm 2310 0.0 0.8 798716 50032 tty1 Sl+ Nov01 0:00 /usr/bin/Xwayland :1024 -rootless -noreset -accessx -core -auth /run/user/121/.mutter-Xwaylandauth.BPIVS0 -listen 4 -listen 5 -displayfd 6 -listen 7 gdm 2947 0.0 0.7 662908 43288 tty1 Sl Nov01 0:00 /usr/libexec/ibus-x11 --kill-daemon root 1007 0.0 0.6 943636 40296 ? Ssl Nov01 0:45 /usr/lib/snapd/snapd
Using aliases
Even if the ps command’s flexibility meets your needs, you can always create aliases so that you don’t have count columns and/or think about whether column values are numeric. Here are some examples:
alias ByCPU='ps aux --sort -%cpu' alias ByMem='ps aux --sort -%mem' alias TopCPU='ps aux --sort -%cpu | head -11' alias TopMem='ps aux --sort -%mem | head -11'
Copyright © 2020 IDG Communications, Inc.