Explain ps aux code

What this ps aux sample shows

USER, PID and COMMAND

Each row is one process: the account that owns it, its ID and the full command line, so python3 -c while True: pass tells 3 Python processes apart. PID 1 is systemd, which starts everything else. Names in square brackets like [kthreadd] are usually kernel threads, with 0 for VSZ and RSS; the zombie, [python3] <defunct>, gets brackets too. START is a clock time for recent processes and a date, Nov05, for older ones. TTY is ? for a process with no terminal.

%CPU and TIME

99.2 means the loop kept one CPU core busy. In procps, %CPU is CPU time divided by how long the process has existed, not what it is doing right now: a process that was busy for its first 3 seconds and then slept showed 49.8 at 6 seconds and 24.9 at 12. TIME, 0:06 for the loop, is its total CPU time so far.

VSZ and RSS

Both are in KiB. RSS is memory actually in RAM: the list of 60 million items had 478368, about 467 MiB, and %MEM showed 2.9, its share of this machine's 16 GB. VSZ is address space the process has reserved, often far bigger: the Node server's VSZ was 1276360, about 1.2 GiB, with an RSS of only 53804. When something uses too much memory, look at RSS.

STAT letters

The first letter is the state: R running, S asleep until something happens, T stopped (that sleep got kill -STOP), Z a zombie, a process that has exited but whose parent hasn't collected it yet. Letters after it add detail: s leads a session, l has more than one thread, N runs at low priority and < at raised priority.

Good to know

• Run with ps from procps-ng 4.0.7 on Linux, on a machine with 12 logical CPUs and 16 GB of RAM. The account name in the sample is a placeholder, devuser, the same length as the real one, so the columns line up as ps printed them.
• ps aux | grep lists the grep as well, because its own command line contains the pattern: with 2 test processes running, grep 'psgreptest' returned 3 rows, one of them the grep. grep '[p]sgreptest' can't match itself, and returned only the 2.
• In Apple's ps manual (github.com/apple-oss-distributions/adv_cmds, adv_cmds-237), -u shows user, pid, %cpu, %mem, vsz, rss, tt, state, start, time and command, the same columns. There I marks a process asleep for more than about 20 seconds, while procps uses I for an idle kernel thread.

Watch out: A zombie can't be killed: it has already exited. kill -9 on the zombie's PID left it in state Z, and it went away only when its parent, the Python process that forked it, was killed. If zombies pile up, the fix is in the parent, which has to wait for its children.