How to List Processes in Linux (ps, top, pgrep, and Process Trees)

For a one-time list of Linux processes, run ps -e. Add -f for fuller command details, or use ps -eo pid,ppid,user,stat,pcpu,pmem,comm for a report with the columns you choose. Use top when you need a continuously refreshed view, pgrep name when you need the PID for a process by name, and ps -ejH or ps axjf to see parent-child relationships.

Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.

The important distinction is time: ps takes a snapshot, while top keeps updating. Selection also matters: the default ps view is intentionally narrow, so it is not the same as “all running processes.”

#	Preview	Product	Price
1		Mastering Linux Administration: Take your sysadmin skills to the next level by configuring and...	$49.99	Buy on Amazon
2		UNIX and Linux System Administration Handbook		Buy on Amazon
3		How Linux Works, 3rd Edition: What Every Superuser Should Know	$46.59	Buy on Amazon
4		Linux Administration: The Linux Operating System and Command Line Guide for Linux Administrators	$2.99	Buy on Amazon
5		The Linux Command Line, 3rd Edition: A Complete Introduction	$27.94	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

Choose the command that matches the job

These commands differ on three axes: whether they take a snapshot or update continuously, how they select processes, and whether they print fixed human-oriented columns or a format you define.

What a Linux process list actually shows

A process is a running instance of a program. The kernel gives each instance a process ID (PID), records its parent process ID (PPID), tracks the account that owns it, and maintains state and resource information. A process list is therefore a view of a changing system, not a permanent inventory. PIDs can disappear between two commands, and CPU or memory percentages can change from one refresh or invocation to the next.

#1 Best Overall

Mastering Linux Administration: Take your sysadmin skills to the next level by configuring and maintaining Linux systems

$49.99

Buy on Amazon

The procps manual describes ps as reporting “a snapshot of the current processes.” That wording explains why a command can show a process that exits immediately afterward, or omit one that starts just after the command has read the process table. When you need to observe change rather than capture one moment, use top.

Using ps for snapshots

See the default selection

ps

This is the shortest useful check. On a typical Linux installation it shows processes selected for your effective user ID that are associated with your controlling terminal. It is useful for checking a shell, a command you just launched, or a foreground game process started from that terminal. It is not a complete system list.

The default columns commonly include a PID, terminal, process state, accumulated CPU time, and command name. Exact headings and formatting can vary with the procps version and selected personality, so scripts should request explicit columns rather than parse an unqualified ps display.

List all processes

ps -eps -ef

-e selects every process visible to the command. -ef combines that selection with a full-format display, normally adding fields such as the parent PID, start information, and the complete invocation text. The full command is particularly useful when several processes have similar names, such as multiple helper processes launched by a game client.

Linux procps also accepts BSD-style forms:

ps axps axu

ps ax selects processes in the BSD convention, including processes without a controlling terminal; ps axu adds a user-oriented format. These forms are common in tutorials, but they are not the only valid syntax. Unix-style options with a leading hyphen, BSD-style options without one, and GNU long options are distinct option conventions. Prefer the form that makes your selection and output obvious to the people who will maintain the command.

Inspect one or several PIDs

ps -p 1234ps -p 1234,5678ps -p 1234 5678

-p restricts the report to specified process IDs. Multiple PIDs may be supplied as a space-separated or comma-separated list. This is the safest way to inspect a process after another tool has already given you its PID, because it does not rely on a possibly ambiguous name.

If the PID has exited, the command can return an empty result. Treat that as a race with the process ending, not automatically as a command failure.

Rank #2

UNIX and Linux System Administration Handbook

Buy on Amazon

Select by executable name or owner

ps -C game-serverps -u alex

-C selects by executable name. The match is against the executable name field, so it may not match an arbitrary argument or a display name shown by a launcher. Use ps -u USER (or the related user-selection options) to inspect processes owned by a particular account. For a system service, replacing USER with its service account can separate it from similarly named programs run by a desktop user.

Name and owner selection can be combined with formatting options. For example:

ps -C game-server -o pid,ppid,user,stat,pcpu,pmem,cmd

The selection answers “which processes?” while -o answers “which fields?” Keeping those questions separate makes commands easier to audit.

Build a custom report

ps -eo pid,ppid,user,stat,pcpu,pmem,comm

This command asks for:

• pid: the process ID.
• ppid: the parent process ID.
• user: the owning account.
• stat: the process state field.
• pcpu: CPU utilization as reported by ps.
• pmem: memory utilization as reported by ps.
• comm: the executable name.

Custom columns are useful when a wide full-format display wraps across the screen or when you need output that is consistent enough for a diagnostic note. Add a command-line field such as args or cmd when you need arguments; use comm when the executable name alone is sufficient. Column names and their exact formatting are provided by the procps implementation on the Linux system you are using, so check the local ps manual for additional fields.

Finding a process with pgrep

pgrep is designed for lookup rather than presentation. Its manual says that it looks through currently running processes and writes the process IDs matching the selection criteria to standard output.

Match a process name

pgrep sshd

This prints the PID or PIDs whose executable name matches the pattern. Multiple lines mean multiple matching instances. Save the result before inspecting or signalling anything, because a later command may see a different set.

Restrict the owner

pgrep -u root sshd

The -u filter limits matches to processes owned by the specified user. This prevents a name match from accidentally selecting a similarly named process belonging to another account.

Rank #3

Sale

How Linux Works, 3rd Edition: What Every Superuser Should Know

$46.59

Buy on Amazon

Show the full command line

pgrep -a pattern

Use -a when the executable name is not enough and you need the invocation text, such as a server launched with a particular configuration file or world name. Command-line output can contain paths and arguments that identify which instance you found.

pgrep is often a good first step in a shell script because it emits PIDs directly. Still, process state is transient: a PID returned by pgrep may no longer exist when a subsequent ps or management command runs. Scripts should handle an empty result and a disappearing PID without treating either as an impossible condition.

Seeing parent-child relationships

A flat list tells you what is running; a tree explains how it was started. Parent and child relationships are especially useful when a launcher starts a game, a compatibility layer starts a helper, or a service supervisor creates worker processes.

Tree formats

ps -ejHps axjf

Both commands ask ps to present a forest-like hierarchy. Indentation and connector characters show which process is the parent of another. Follow the chain upward to find the launcher or service that owns a process, and downward to find workers, helpers, or child servers.

List children of a known parent

ps --ppid 1234

--ppid selects processes whose parent PID is the number supplied. Replace 1234 with the parent you have identified. This is narrower than printing the entire tree and is convenient when you need to check only the immediate children of a launcher or supervisor.

A process tree is another snapshot. A child can exit while you are reading it, and a new child can appear immediately afterward. For a live view of changing CPU or memory use, combine a known PID or command name with an interactive monitor rather than assuming the tree remains fixed.

Monitoring live activity with top

The top manual describes the program as providing “a dynamic real-time view of a running system.” Start it with:

Rank #4

Linux Administration: The Linux Operating System and Command Line Guide for Linux Administrators

$2.99

Buy on Amazon

top

Unlike ps, top repeatedly refreshes its summary and task list while it runs. The display is useful for spotting a process that is consuming CPU, accumulating memory, or appearing and disappearing as a game or server loads.

Read the display in the right order

1. Check the summary area. It gives an overview of load, CPU activity, memory, and swap as reported by the running system.
2. Inspect the task list. Look for the PID, owner, state, CPU percentage, memory percentage, and command columns.
3. Sort or narrow the view. Use the interactive controls shown by top‘s help screen to change sorting or focus on a subset of tasks.
4. Record the PID. If you need a one-time, reproducible report, leave top and inspect that PID with ps -p PID -o pid,ppid,user,stat,pcpu,pmem,cmd.

Values in top are observations over refresh intervals, not immutable properties of a process. A short burst can be missed between refreshes, while a busy process can move in the ordering as its workload changes. Exit with the quit control documented in the running program’s help.

Understanding selection, visibility, and permissions

Two users can run similar commands and see different results. POSIX describes the normal ps selection as processes with the caller’s effective user ID and a controlling terminal. That default is why plain ps usually omits background services, other users’ sessions, and many system processes.

Use ps -e, a user filter, a PID filter, or a parent filter when you need a wider or more precise selection. Even then, visibility can be limited by privileges and the system’s process-information settings. A command run as an ordinary user may not expose every detail about another account’s process, and a protected system may hide command-line information. Do not infer that an absent row proves the process does not exist; first check your selection and permissions.

When a process seems to be missing

• Run ps -e instead of plain ps to remove the controlling-terminal restriction.
• Use ps -u USER if you know the owning account.
• Try pgrep -a name when the executable name is known but the command line is not.
• Check the spelling and case of the executable name; name matching is not the same as searching every argument.
• Consider that the process may have exited between commands.
• If details remain unavailable, ask whether your account has the required privileges rather than assuming the listing tool is broken.

Practical recipes for game and server troubleshooting

Confirm that a launched game is still running

1. Run pgrep -a game-name to obtain matching PIDs and see their invocation text.
2. Choose the PID for the actual game executable, not a launcher or updater with a similar name.
3. Run ps -p PID -o pid,ppid,user,stat,pcpu,pmem,cmd for a stable, readable snapshot.
4. If the process disappears, repeat the lookup and check whether the launcher immediately recreated it or reported an error.

Find a dedicated server and its workers

pgrep -a server-nameps -C server-name -o pid,ppid,user,stat,pcpu,pmem,cmd

The first command finds candidate instances and their arguments. The second gives comparable columns for each matching executable. If the server delegates work, identify its PID and run ps --ppid PID or a tree view to inspect direct children.

Identify a high-CPU process

1. Start top and use its documented interactive sorting control to bring CPU-heavy tasks into view.
2. Note the PID and owner.
3. Inspect that PID with a custom ps report, including ppid and cmd.
4. Use the PPID to move up the tree and determine whether a launcher, script, or service supervisor started it.

This workflow separates observation from action. Listing a process does not stop it, and a high percentage in one refresh does not by itself establish that the process is malfunctioning.

Writing reliable commands and scripts

For interactive use, a compact command is convenient. For documentation and automation, make the selection and output explicit. Prefer ps -eo pid,ppid,user,stat,pcpu,pmem,comm (or another deliberately chosen field list) over parsing the visual layout of plain ps. Full command lines can contain spaces, so scripts should use a parser that respects the chosen delimiter or consume one PID at a time.

Best Value

Sale

The Linux Command Line, 3rd Edition: A Complete Introduction

$27.94

Buy on Amazon

Check exit status and empty output from pgrep. A zero-match result is a normal state when a game is closed or a service has not started. Between a lookup and a follow-up command, the PID can be reused after the original process exits; scripts that perform consequential actions should revalidate identity and ownership rather than trusting an old PID alone.

Do not attach a universal speed claim to these commands. The manuals document behavior and options, not a benchmark that applies to every kernel, procps version, terminal, or process-table size.

Common mistakes and their fixes

Assuming ps means “all processes”

Plain ps uses the default, terminal-oriented selection. Use ps -e or an appropriate filter for a wider view.

Using top for a report that must be reproducible

top is continuously refreshed and interactive. Capture a deliberate ps command when you need one point in time with known columns.

Searching only by a display name

A launcher, wrapper, or helper may have a different executable name. Use pgrep -a, then verify the PPID and command line with ps.

Reading a process tree as a permanent hierarchy

Children can exit and new children can start immediately. Treat tree output as a snapshot and rerun it when diagnosing a changing workload.

Interpreting a missing process as proof of permission failure

First check selection, spelling, and timing. If the process is owned by another account or protected by system policy, your privileges may limit what is visible.

A compact decision guide

• Need one quick answer? Start with ps -e.
• Need command arguments or ownership? Use ps -ef or a custom -o list.
• Already know the PID? Use ps -p PID.
• Know the executable name? Use pgrep name, adding -a for the command line or -u USER for ownership.
• Need to understand who launched what? Use ps -ejH, ps axjf, or ps --ppid PPID.
• Need to watch a changing system? Run top.

With these choices, listing processes becomes a matter of selecting the right time model, process set, and fields rather than memorizing one supposedly universal command.

Quick Recap

Bestseller No. 1

Mastering Linux Administration: Take your sysadmin skills to the next level by configuring and maintaining Linux systems

$49.99

Bestseller No. 2

UNIX and Linux System Administration Handbook

SaleBestseller No. 3

How Linux Works, 3rd Edition: What Every Superuser Should Know

$46.59

Bestseller No. 4

Linux Administration: The Linux Operating System and Command Line Guide for Linux Administrators

$2.99

SaleBestseller No. 5

The Linux Command Line, 3rd Edition: A Complete Introduction

$27.94

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.