The ps command for system monitoring.
Not All process can be spotted by top command. If you want to catch a hanged appplication’s PID you need ps. ps is very powerful and has a large no of options like any other linux tools.
suppose you need pid of mplayer which hanged the type
$ps -ef | egrep mplayer
and you will get the PID of mplayer
nandam 3359 1 1 06:55 ? 00:00:00 gmplayer
nandam 3383 3364 0 06:56 pts/9 00:00:00 egrep mplayer
now you can kill the mplayer using kill command
$kill 3359
Here are the most common usages of ps command
To see every process on the system using standard syntax us any one of the following: ps -e
ps -ef
ps -eF
ps -ely
To see every process on the system using BSD syntax:
ps ax
ps axu
-e —–> Select all processes
-f —–> full format listing
-F —–> extra full format
-l ——> long format. The -y option is often useful with this
-y ——> Do not show flags; show rss in place of addr. This option can only be used with -l.
Here is sample output for each of above commands
$ps -e
PID TTY TIME CMD
1 ? 00:00:01 init
2 ? 00:00:00 migration/0
3 ? 00:00:00 ksoftirqd/0
4 ? 00:00:00 migration/1
5 ? 00:00:01 ksoftirqd/1
6 ? 00:00:00 events/0
7 ? 00:00:00 events/1
8 ? 00:00:00 khelper
9 ? 00:00:00 kthread
13 ? 00:00:00 kblockd/0
14 ? 00:00:00 kblockd/1
15 ? 00:00:00 kacpid
92 ? 00:00:00 kseriod
134 ? 00:00:00 pdflush
135 ? 00:00:00 pdflush
136 ? 00:00:00 kswapd0
137 ? 00:00:00 aio/0
138 ? 00:00:00 aio/1
282 ? 00:00:00 kirqd
547 ? 00:00:00 khubd
$ps -ef
UID PID PPID C STIME TTY TIME CMD
root 1 0 0 03:53 ? 00:00:01 init [2]
root 2 1 0 03:53 ? 00:00:00 [migration/0]
root 3 1 0 03:53 ? 00:00:00 [ksoftirqd/0]
root 4 1 0 03:53 ? 00:00:00 [migration/1]
root 5 1 0 03:53 ? 00:00:01 [ksoftirqd/1]
root 6 1 0 03:53 ? 00:00:00 [events/0]
root 7 1 0 03:53 ? 00:00:00 [events/1]
root 8 1 0 03:53 ? 00:00:00 [khelper]
root 9 1 0 03:53 ? 00:00:00 [kthread]
root 13 9 0 03:53 ? 00:00:00 [kblockd/0]
root 14 9 0 03:53 ? 00:00:00 [kblockd/1]
root 15 9 0 03:53 ? 00:00:00 [kacpid]
root 92 9 0 03:53 ? 00:00:00 [kseriod]
root 134 9 0 03:53 ? 00:00:00 [pdflush]
root 135 9 0 03:53 ? 00:00:00 [pdflush]
root 136 9 0 03:53 ? 00:00:00 [kswapd0]
root 137 9 0 03:53 ? 00:00:00 [aio/0]
root 138 9 0 03:53 ? 00:00:00 [aio/1]
root 282 1 0 03:53 ? 00:00:00 [kirqd]
root 547 9 0 03:53 ? 00:00:00 [khubd]
root 754 9 0 03:53 ? 00:00:00 [scsi_eh_2]
$ps -eF
UID PID PPID C SZ RSS PSR STIME TTY TIME CMD
root 1 0 0 510 720 1 03:53 ? 00:00:01 init [2]
root 2 1 0 0 0 0 03:53 ? 00:00:00 [migration/0]
root 3 1 0 0 0 0 03:53 ? 00:00:00 [ksoftirqd/0]
root 4 1 0 0 0 1 03:53 ? 00:00:00 [migration/1]
root 5 1 0 0 0 1 03:53 ? 00:00:01 [ksoftirqd/1]
root 6 1 0 0 0 0 03:53 ? 00:00:00 [events/0]
root 7 1 0 0 0 1 03:53 ? 00:00:00 [events/1]
root 8 1 0 0 0 1 03:53 ? 00:00:00 [khelper]
root 9 1 0 0 0 1 03:53 ? 00:00:00 [kthread]
root 13 9 0 0 0 0 03:53 ? 00:00:00 [kblockd/0]
root 14 9 0 0 0 1 03:53 ? 00:00:00 [kblockd/1]
root 15 9 0 0 0 1 03:53 ? 00:00:00 [kacpid]
root 92 9 0 0 0 0 03:53 ? 00:00:00 [kseriod]
root 134 9 0 0 0 1 03:53 ? 00:00:00 [pdflush]
root 135 9 0 0 0 0 03:53 ? 00:00:00 [pdflush]
root 136 9 0 0 0 1 03:53 ? 00:00:00 [kswapd0]
root 137 9 0 0 0 0 03:53 ? 00:00:00 [aio/0]
root 138 9 0 0 0 1 03:53 ? 00:00:00 [aio/1]
root 282 1 0 0 0 1 03:53 ? 00:00:00 [kirqd]
root 547 9 0 0 0 1 03:53 ? 00:00:00 [khubd]
root 754 9 0 0 0 1 03:53 ? 00:00:00 [scsi_eh_2]
root 755 9 0 0 0 1 03:53 ? 00:00:02 [usb-storage]
root 768 9 0 0 0 1 03:53 ? 00:00:00 [scsi_eh_3]
$ps -ely
S UID PID PPID C PRI NI RSS SZ WCHAN TTY TIME CMD
S 0 1 0 0 75 0 720 510 - ? 00:00:01 init
S 0 2 1 0 -40 - 0 0 migrat ? 00:00:00 migration/0
S 0 3 1 0 94 19 0 0 ksofti ? 00:00:00 ksoftirqd/0
S 0 4 1 0 -40 - 0 0 migrat ? 00:00:00 migration/1
S 0 5 1 0 97 19 0 0 ksofti ? 00:00:01 ksoftirqd/1
S 0 6 1 0 70 -5 0 0 worker ? 00:00:00 events/0
S 0 7 1 0 70 -5 0 0 worker ? 00:00:00 events/1
S 0 8 1 0 70 -5 0 0 worker ? 00:00:00 khelper
S 0 9 1 0 70 -5 0 0 worker ? 00:00:00 kthread
S 0 13 9 0 72 -5 0 0 worker ? 00:00:00 kblockd/0
S 0 14 9 0 70 -5 0 0 worker ? 00:00:00 kblockd/1
S 0 15 9 0 75 -5 0 0 worker ? 00:00:00 kacpid
S 0 92 9 0 71 -5 0 0 serio_ ? 00:00:00 kseriod
S 0 134 9 0 75 0 0 0 pdflus ? 00:00:00 pdflush
S 0 135 9 0 75 0 0 0 pdflus ? 00:00:00 pdflush
S 0 136 9 0 70 -5 0 0 kswapd ? 00:00:00 kswapd0
S 0 137 9 0 76 -5 0 0 worker ? 00:00:00 aio/0
S 0 138 9 0 77 -5 0 0 worker ? 00:00:00 aio/1
S 0 282 1 0 75 0 0 0 - ? 00:00:00 kirqd
S 0 547 9 0 70 -5 0 0 hub_th ? 00:00:00 khubd
S 0 754 9 0 71 -5 0 0 scsi_e ? 00:00:00 scsi_eh_2
S 0 755 9 0 70 -5 0 0 - ? 00:00:02 usb-storage
As you can see the output varies with each options.
You can also try
$ watch -n 10 ps -eF
which runs ps -eF for every 10 secs.
in the way you can monitor the system and you can use sort command to sort the report in desc or ascending order of various columns.
Apart from ps there are othe utilities that are helpful in system monitoring.
pstree
top
disk monitoring utilities
References
ps manual
watch manual