Linux Processes and Signals Cheatsheet

Syntax Styles

ps supports three styles of options that can be mixed but behave differently:

Mixing styles works but can change the output: ps -fp 310,311 prints the UNIX full format, while ps -fp 310 311 treats the second PID as a BSD-style argument and the columns change (a STAT column appears, TIME gets shorter). Stick to one style per command when possible.

Reading the Output

Process I/O and Return Codes

A process takes standard input (STDIN) and returns:

• STDOUT (standard output): printed on your console
• STDERR (standard error): you see that too, unless you redirect it with command 2> /dev/null
• Return code: 0 on success, a different number otherwise (echo $? shows the last one)

Some processes don’t read STDIN (they read files or data from the kernel), and some write nothing to STDOUT or STDERR. But every process returns a return code.

Signals

Each signal has a default action:

Programs can install handlers to ignore, replace or extend a signal’s default action, except for SIGKILL and SIGSTOP, which can’t be caught or ignored.

Common Signals

Numbers are for x86 and ARM Linux; kill -l lists them on your system.

Sending Signals

The foreground process gets a signal from a keyboard shortcut:

Background processes, or processes in another session, need a command:

Process States

The stat column adds flags after the state, such as s (session leader), l (multi-threaded), + (foreground process group), < (high priority) and N (low priority).

Load Average: R and D Processes

The load average counts tasks in R and D state, so these show what is behind a high load:

# Linux, per thread
ps -eLo state,pid,cmd | grep -E '^[DR]'
top -H -b -n1 | awk '$8=="R" || $8=="D"'

# Solaris: "O" (on a processor) and "R" (runnable) in the S column of ps -elf
ps -elf | awk '$2 ~ /O/ || $2 ~ /R/'

Solaris uses O for a process currently on a processor and R for runnable; Linux has no separate O state, a running or runnable process is just R.

Watching for D Processes

# Every second for one minute
for i in $(seq 1 60); do ps -eo state,pid,cmd | grep "^D"; echo "--- $i ---"; sleep 1; done

# Or with watch
watch -n 1 "ps aux | awk '\$8 ~ /D/'"

Selecting Processes

Finding PIDs

pgrep and pkill never match themselves, unlike ps | grep or ps | awk.

Killing Processes

# Preview what matches, then kill it
pgrep -af '<pattern>'
pkill -f '<pattern>'           # SIGTERM
pkill -9 -f '<pattern>'        # SIGKILL, if SIGTERM didn't work

# A loop over PIDs: take them from pgrep
for pid in $(pgrep -f '<pattern>'); do kill "$pid"; done

Don’t build the PID list with ps -ef | awk '/pattern/ {print $2}': the awk (and the shell running the loop) have the pattern in their own command line, so they match too and the loop kills itself.

Sorting and Top Lists

head -n 11 keeps the header plus ten processes.

Filtering by Value

# More than 5% CPU (NR > 1 skips the header)
ps -eo %cpu,pid,cmd | awk 'NR > 1 && $1 > 5.0'

# Multi-threaded processes
ps -eo nlwp,pid,cmd | awk 'NR > 1 && $1 > 1' | sort -rn | head

# Count processes by user
ps -eo user= | sort | uniq -c | sort -rn

ps -ef | awk '{print $1}' would also count the UID header, and ps -ef shows a numeric UID for user names longer than 8 characters; user= avoids both.

Open File Descriptors per Process

sudo ls -d /proc/[1-9]*/fd/* 2>/dev/null | sed 's/\/fd.*$//' | uniq -c | sort -rn | head

Without sudo you only see your own processes.

Process Tree

Threads

Other Columns

Wide Output

-w widens the output; a second -w removes the width limit, so long command lines aren’t truncated:

ps -ww -p 1234 alone isn’t enough: its default columns show only the process name, not the arguments.

Scripting

Check Whether a PID Is Running

if ps -p "$PID" > /dev/null; then
    echo "Process $PID is running"
else
    echo "Process $PID is not running"
fi

Export the Process List to CSV

ps -eo pid=,user=,%cpu=,%mem=,comm= | awk -v OFS=, '{$1=$1; print}' > processes.csv

comm (the process name) has no spaces in practice; a full command line (cmd) would, and every space would become a new CSV field.

Continuous Monitoring with watch

# Top memory consumers, refreshed every 2 seconds
watch -n 2 'ps aux --sort=-%mem | head -20'

# One program
watch -n 1 'ps -p "$(pgrep -d, nginx)" -o pid,ppid,%cpu,%mem,cmd'

# R and D processes
watch -n 1 'ps -eo state,pid,cmd | grep "^[DR]"'

Useful One-Liners

Memory

# Total RSS of all processes of one program
ps -C nginx -o rss= | awk '{s+=$1} END {print s/1024 " MiB"}'

# RSS summed by program name: who uses the RAM
ps -eo rss=,comm= | awk '{m[$2]+=$1} END {for (c in m) printf "%8.1f MiB %s\n", m[c]/1024, c}' | sort -rn | head

# Swap used per process, in KiB (ps has no swap column)
awk '/^Name/ {n=$2} /^VmSwap/ {print $2, n}' /proc/[0-9]*/status | sort -rn | head

RSS counts shared memory (libraries, shared buffers) in every process that maps it, so a sum over many processes is higher than the memory really used.

Zombies and Parents

A zombie can’t be killed: it has already exited. Its parent has to read its exit status, so fix or restart the parent; if the parent dies, init (PID 1) adopts the zombie and reaps it.

Inspecting One Process

Reading another user’s /proc/<pid> files needs sudo. environ shows the environment at start-up, not later changes, and programs that rewrite their process title (nginx, PostgreSQL) overwrite it.

Waiting and Bulk Signals

# Wait until a process ends (kill -0 sends nothing, it only checks that the PID exists)
while kill -0 <pid> 2>/dev/null; do sleep 1; done

# Everything of one user: preview, then stop it
pgrep -au username
pkill -u username

kill -0 also fails for a process of another user (no permission); in that case use ps -p <pid> > /dev/null as the test.

Priority

Only root can raise the priority again (a lower nice value).

Format Specifier Reference

Quick lookup for -o / --format fields. Add = after a field (pid=) to drop its header.

Process Identity

User/Ownership

CPU/Memory

Priority/Scheduling

State/Time

Command

Columns are cut at the terminal width; use -ww for the full command line.

Example Combining Specifiers

ps -eo pid,ppid,user,ni,%cpu,%mem,rss,etime,cmd --sort=-%mem | head -20