N天学习一个linux命令之ps

ps命令

用途

显示系统进程信息

用法

ps [options]

常用选项

选项有三种风格，这里是指Unix风格

(Unix,BSD,GNU LONG OPTIONS)

简单刷选类

-A, -e

显示所有进程

-N, --deselect

显示不符合刷选条件的进程

-a

显示和当前终端关联的进程

-d

显示除了进程是session leader以外的所有进程

列表刷选类

选项可以重复使用多次，多个可以使用空格或者英文逗号连接，不如 "1 2" 3,4

-C cmdlist

根据命令名列表过滤

-G grplist

根据真实组id或者组名过滤

-U userlist

根据真实的用户id或者用户名过滤

-g grplist

Select by session OR by effective group name.

Selection by session is specified by many standards, but selection by effective group is the logical behavior that several other operating systems use.

-p pidlist

根据进程id过滤

-q pidlist

根据进程id快速过滤

-s sesslist

根据会话id过滤

-t ttylist

根据tty过滤

-u userlist

Select by effective user ID (EUID) or name.

This selects the processes whose effective user name or ID is in userlist.

--ppid pidlist

根据父进程id过滤

输出格式控制类

-F

extra full format.

-O format

is like -o, but preloaded with some default columns. Identical to -o pid,format,state,tname,time,command or -o pid,format,tname,time,cmd, see -o below.

-M

Add a column of security data. Identical to Z. (for SE Linux)

-f

does full-format listing. This option can be combined with many other UNIX-style options to add additional columns. It also causes the command arguments to be printed. When used with -L,the NLWP (number of threads) and LWP (thread ID) columns will be added. See the c option, the format keyword args, and the format keyword comm.

-o format, --format format

user-defined format.

--context

Display security context format.

输出修饰类

-H

按层次结构显示进程列表

--cols n, --columns n, --width n

设置屏幕宽度

--lines n, --rows n

设置屏幕高度

--cumulative

include some dead child process data (as a sum with the parent)

--forest

ASCII art process tree

--headers

每页都输出头字段

--no-headers

不输出头字段

进程状态说明

Here are the different values that the s, stat and state output specifiers (header "STAT" or "S") will display to describe the state of a process.
    D    Uninterruptible sleep (usually IO)
    R    Running or runnable (on run queue)
    S    Interruptible sleep (waiting for an event to complete)
    T    Stopped, either by a job control signal or because it is being traced.
    W    paging (not valid since the 2.6.xx kernel)
    X    dead (should never be seen)
    Z    Defunct ("zombie") process, terminated but not reaped by its parent.

标准输出字段说明

懒得翻译了

STANDARD FORMAT SPECIFIERS
       Here are the different keywords that may be used to control the output format (e.g. with option -o)
       or to sort the selected processes with the GNU-style --sort option.
       For example:  ps -eo pid,user,args --sort user
       This version of ps tries to recognize most of the keywords used in other implementations of ps.
       The following user-defined format specifiers may contain spaces: args, cmd, comm, command, fname,
       ucmd, ucomm, lstart, bsdstart, start.
       Some keywords may not be available for sorting.
CODE       HEADER   DESCRIPTION
%cpu       %CPU     cpu utilization of the process in "##.#" format. Currently, it is the CPU time used
                    divided by the time the process has been running (cputime/realtime ratio), expressed as
                    a percentage. It will not add up to 100% unless you are lucky. (alias pcpu).
%mem       %MEM     ratio of the process’s resident set size  to the physical memory on the machine,
                    expressed as a percentage. (alias pmem).
args       COMMAND  command with all its arguments as a string. Modifications to the arguments may be
                    shown. The output in this column may contain spaces. A process marked <defunct> is
                    partly dead, waiting to be fully destroyed by its parent. Sometimes the process args
                    will be unavailable; when this happens, ps will instead print the executable name in
                    brackets. (alias cmd, command). See also the comm format keyword, the -f option, and
                    the c option.
                    When specified last, this column will extend to the edge of the display. If ps can not
                    determine display width, as when output is redirected (piped) into a file or another
                    command, the output width is undefined. (it may be 80, unlimited, determined by the
                    TERM variable, and so on) The COLUMNS environment variable or --cols option may be used
                    to exactly determine the width in this case. The w or -w option may be also be used to
                    adjust width.
blocked    BLOCKED  mask of the blocked signals, see signal(7). According to the width of the field,
                    a 32-bit or 64-bit mask in hexadecimal format is displayed. (alias sig_block, sigmask).
bsdstart   START    time the command started. If the process was started less than 24 hours ago, the output
                    format is " HH:MM", else it is "mmm dd" (where mmm is the three letters of the month).
                    See also lstart, start, start_time, and stime.
bsdtime    TIME     accumulated cpu time, user + system. The display format is usually "MMM:SS", but can be
                    shifted to the right if the process used more than 999 minutes of cpu time.
c          C        processor utilization. Currently, this is the integer value of the percent usage over
                    the lifetime of the process. (see %cpu).
caught     CAUGHT   mask of the caught signals, see signal(7). According to the width of the field, a 32 or
                    64 bits mask in hexadecimal format is displayed. (alias sig_catch, sigcatch).
cgroup     CGROUP   display control groups to which the process belongs.
class      CLS      scheduling class of the process. (alias policy, cls). Field’s possible values are:
                    -   not reported
                    TS  SCHED_OTHER
                    FF  SCHED_FIFO
                    RR  SCHED_RR
                    B   SCHED_BATCH
                    ISO SCHED_ISO
                    IDL SCHED_IDLE
                    ?   unknown value
cls        CLS      scheduling class of the process. (alias policy, class). Field’s possible values are:
                    -   not reported
                    TS  SCHED_OTHER
                    FF  SCHED_FIFO
                    RR  SCHED_RR
                    B   SCHED_BATCH
                    ISO SCHED_ISO
                    IDL SCHED_IDLE
                    ?   unknown value
cmd        CMD      see args. (alias args, command).
comm       COMMAND  command name (only the executable name). Modifications to the command name will not be
                    shown. A process marked <defunct> is partly dead, waiting to be fully destroyed by its
                    parent. The output in this column may contain spaces. (alias ucmd, ucomm). See also the
                    args format keyword, the -f option, and the c option.
                    When specified last, this column will extend to the edge of the display. If ps can not
                    determine display width, as when output is redirected (piped) into a file or another
                    command, the output width is undefined. (it may be 80, unlimited, determined by the
                    TERM variable, and so on) The COLUMNS environment variable or --cols option may be used
                    to exactly determine the width in this case. The w or -w option may be also be used to
                    adjust width.
command    COMMAND  see args. (alias args, cmd).
cp         CP       per-mill (tenths of a percent) CPU usage. (see %cpu).
cputime    TIME     cumulative CPU time, "[dd-]hh:mm:ss" format. (alias time).
egid       EGID     effective group ID number of the process as a decimal integer. (alias gid).
egroup     EGROUP   effective group ID of the process. This will be the textual group ID, if it can be
                    obtained and the field width permits, or a decimal representation otherwise.
                    (alias group).
eip        EIP      instruction pointer.
esp        ESP      stack pointer.
etime      ELAPSED  elapsed time since the process was started, in the form [[dd-]hh:]mm:ss.
euid       EUID     effective user ID. (alias uid).
euser      EUSER    effective user name. This will be the textual user ID, if it can be obtained and the
                    field width permits, or a decimal representation otherwise. The n option can be used to
                    force the decimal representation. (alias uname, user).
f          F        flags associated with the process, see the PROCESS FLAGS section. (alias flag, flags).
fgid       FGID     filesystem access group ID. (alias fsgid).
fgroup     FGROUP   filesystem access group ID. This will be the textual user ID, if it can be obtained and
                    the field width permits, or a decimal representation otherwise. (alias fsgroup).
flag       F        see f. (alias f, flags).
flags      F        see f. (alias f, flag).
fname      COMMAND  first 8 bytes of the base name of the process’s executable file. The output in this
                    column may contain spaces.
fuid       FUID     filesystem access user ID. (alias fsuid).
fuser      FUSER    filesystem access user ID. This will be the textual user ID, if it can be obtained and
                    the field width permits, or a decimal representation otherwise.
gid        GID      see egid. (alias egid).
group      GROUP    see egroup. (alias egroup).
ignored    IGNORED  mask of the ignored signals, see signal(7). According to the width of the field,
                    a 32-bit or 64-bit mask in hexadecimal format is displayed. (alias sig_ignore,
                    sigignore).
label      LABEL    security label, most commonly used for SE Linux context data. This is for the Mandatory
                    Access Control ("MAC") found on high-security systems.
lstart     STARTED  time the command started. See also bsdstart, start, start_time, and stime.
lwp        LWP      lwp (light weight process, or thread) ID of the lwp being reported. (alias spid, tid).
ni         NI       nice value. This ranges from 19 (nicest) to -20 (not nice to others), see nice(1).
                    (alias nice).
nice       NI       see ni. (alias ni).
nlwp       NLWP     number of lwps (threads) in the process. (alias thcount).
nwchan     WCHAN    address of the kernel function where the process is sleeping (use wchan if you want the
                    kernel function name). Running tasks will display a dash (’-’) in this column.
pcpu       %CPU     see %cpu. (alias %cpu).
pending    PENDING  mask of the pending signals. See signal(7). Signals pending on the process are distinct
                    from signals pending on individual threads. Use the m option or the -m option to see
                    both. According to the width of the field, a 32-bit or 64-bit mask in hexadecimal
                    format is displayed. (alias sig).
pgid       PGID     process group ID or, equivalently, the process ID of the process group leader.
                    (alias pgrp).
pgrp       PGRP     see pgid. (alias pgid).
pid        PID      process ID number of the process.
pmem       %MEM     see %mem. (alias %mem).
policy     POL      scheduling class of the process. (alias class, cls). Possible values are:
                    -   not reported
                    TS  SCHED_OTHER
                    FF  SCHED_FIFO
                    RR  SCHED_RR
                    B   SCHED_BATCH
                    ISO SCHED_ISO
                    IDL SCHED_IDLE
                    ?   unknown value
ppid       PPID     parent process ID.
psr        PSR      processor that process is currently assigned to.
rgid       RGID     real group ID.
rgroup     RGROUP   real group name. This will be the textual group ID, if it can be obtained and the field
                    width permits, or a decimal representation otherwise.
rip        RIP      64-bit instruction pointer.
rsp        RSP      64-bit stack pointer.
rss        RSS      resident set size, the non-swapped physical memory that a task has used (in kiloBytes).
                    (alias rssize, rsz).
rssize     RSS      see rss. (alias rss, rsz).
rsz        RSZ      see rss. (alias rss, rssize).
rtprio     RTPRIO   realtime priority.
ruid       RUID     real user ID.
ruser      RUSER    real user ID. This will be the textual user ID, if it can be obtained and the field
                    width permits, or a decimal representation otherwise.
s          S        minimal state display (one character). See section PROCESS STATE CODES for the
                    different values. See also stat if you want additional information displayed.
                    (alias state).
sched      SCH      scheduling policy of the process. The policies SCHED_OTHER (SCHED_NORMAL), SCHED_FIFO,
                    SCHED_RR, SCHED_BATCH, SCHED_ISO, and SCHED_IDLE are respectively displayed as
                    0, 1, 2, 3, 4, and 5.
sess       SESS     session ID or, equivalently, the process ID of the session leader.
                    (alias session, sid).
sgi_p      P        processor that the process is currently executing on. Displays "*" if the process is
                    not currently running or runnable.
sgid       SGID     saved group ID. (alias svgid).
sgroup     SGROUP   saved group name. This will be the textual group ID, if it can be obtained and the
                    field width permits, or a decimal representation otherwise.
sid        SID      see sess. (alias sess, session).
sig        PENDING  see pending. (alias pending, sig_pend).
sigcatch   CAUGHT   see caught. (alias caught, sig_catch).
sigignore  IGNORED  see ignored. (alias ignored, sig_ignore).
sigmask    BLOCKED  see blocked. (alias blocked, sig_block).
size       SZ       approximate amount of swap space that would be required if the process were to dirty
                    all writable pages and then be swapped out. This number is very rough!
spid       SPID     see lwp. (alias lwp, tid).
stackp     STACKP   address of the bottom (start) of stack for the process.
start      STARTED  time the command started. If the process was started less than 24 hours ago, the output
                    format is "HH:MM:SS", else it is "  mmm dd" (where mmm is a three-letter month name).
                    See also lstart, bsdstart, start_time, and stime.
start_time START    starting time or date of the process. Only the year will be displayed if the process
                    was not started the same year ps was invoked, or "mmmdd" if it was not started the same
                    day, or "HH:MM" otherwise. See also bsdstart, start, lstart, and stime.
stat       STAT     multi-character process state. See section PROCESS STATE CODES for the different values
                    meaning. See also s and state if you just want the first character displayed.
state      S        see s. (alias s).
suid       SUID     saved user ID. (alias svuid).
suser      SUSER    saved user name. This will be the textual user ID, if it can be obtained and the field
                    width permits, or a decimal representation otherwise. (alias svuser).
svgid      SVGID    see sgid. (alias sgid).
svuid      SVUID    see suid. (alias suid).
sz         SZ       size in physical pages of the core image of the process. This includes text, data, and
                    stack space. Device mappings are currently excluded; this is subject to change. See vsz
                    and rss.
thcgr      THCGR    display control groups to which the thread belongs.
thcount    THCNT    see nlwp. (alias nlwp). number of kernel threads owned by the process.
tid        TID      see lwp. (alias lwp).
time       TIME     cumulative CPU time, "[dd-]hh:mm:ss" format. (alias cputime).
tname      TTY      controlling tty (terminal). (alias tt, tty).
tpgid      TPGID    ID of the foreground process group on the tty (terminal) that the process is connected
                    to, or -1 if the process is not connected to a tty.
tt         TT       controlling tty (terminal). (alias tname, tty).
tty        TT       controlling tty (terminal). (alias tname, tt).
ucmd       CMD      see comm. (alias comm, ucomm).
ucomm      COMMAND  see comm. (alias comm, ucmd).
uid        UID      see euid. (alias euid).
uname      USER     see euser. (alias euser, user).
user       USER     see euser. (alias euser, uname).
vsize      VSZ      see vsz. (alias vsz).
vsz        VSZ      virtual memory size of the process in KiB (1024-byte units). Device mappings are
                    currently excluded; this is subject to change. (alias vsize).
wchan      WCHAN    name of the kernel function in which the process is sleeping, a "-" if the process is
                    running, or a "*" if the process is multi-threaded and ps is not displaying threads.

实践

1 显示所有进程列表，输出user,pid,start_time,state等信息

[root@vm ~]# ps -e --headers -o user,pid,ppid,state,%cpu,%mem,args,bsdstart,bsdtime,comm
USER       PID  PPID S %CPU %MEM COMMAND                      START   TIME COMMAND
root         1     0 S  0.0  0.0 /sbin/init                  Mar 29   0:03 init
root         2     0 S  0.0  0.0 [kthreadd]                  Mar 29   0:00 kthreadd
root         3     2 S  0.0  0.0 [migration/0]               Mar 29   0:05 migration/0
root         4     2 S  0.0  0.0 [ksoftirqd/0]               Mar 29   0:05 ksoftirqd/0
root         5     2 S  0.0  0.0 [stopper/0]                 Mar 29   0:00 stopper/0
root         6     2 S  0.0  0.0 [watchdog/0]                Mar 29   0:00 watchdog/0
root         7     2 S  0.0  0.0 [migration/1]               Mar 29   0:04 migration/1
root         8     2 S  0.0  0.0 [stopper/1]                 Mar 29   0:00 stopper/1
root         9     2 S  0.0  0.0 [ksoftirqd/1]               Mar 29   0:05 ksoftirqd/1
root        10     2 S  0.0  0.0 [watchdog/1]                Mar 29   0:00 watchdog/1
root        11     2 S  0.0  0.0 [events/0]                  Mar 29   1:41 events/0
root        12     2 S  0.0  0.0 [events/1]                  Mar 29   0:20 events/1
root        13     2 S  0.0  0.0 [events/0]                  Mar 29   0:00 events/0
root        14     2 S  0.0  0.0 [events/1]                  Mar 29   0:00 events/1
root        15     2 S  0.0  0.0 [events_long/0]             Mar 29   0:00 events_long/0
root        16     2 S  0.0  0.0 [events_long/1]             Mar 29   0:00 events_long/1
root        17     2 S  0.0  0.0 [events_power_ef]           Mar 29   0:00 events_power_ef
root        18     2 S  0.0  0.0 [events_power_ef]           Mar 29   0:00 events_power_ef
root        19     2 S  0.0  0.0 [cgroup]                    Mar 29   0:00 cgroup
root        20     2 S  0.0  0.0 [khelper]                   Mar 29   0:00 khelper
root        21     2 S  0.0  0.0 [netns]                     Mar 29   0:00 netns
root        22     2 S  0.0  0.0 [async/mgr]                 Mar 29   0:00 async/mgr
root        23     2 S  0.0  0.0 [pm]                        Mar 29   0:00 pm
root        24     2 S  0.0  0.0 [sync_supers]               Mar 29   0:01 sync_supers
root        25     2 S  0.0  0.0 [bdi-default]               Mar 29   0:00 bdi-default
root        26     2 S  0.0  0.0 [kintegrityd/0]             Mar 29   0:00 kintegrityd/0
root        27     2 S  0.0  0.0 [kintegrityd/1]             Mar 29   0:00 kintegrityd/1
root        28     2 S  0.0  0.0 [kblockd/0]                 Mar 29   0:21 kblockd/0
root        29     2 S  0.0  0.0 [kblockd/1]                 Mar 29   0:07 kblockd/1
root        30     2 S  0.0  0.0 [kacpid]                    Mar 29   0:00 kacpid
root        31     2 S  0.0  0.0 [kacpi_notify]              Mar 29   0:00 kacpi_notify
root        32     2 S  0.0  0.0 [kacpi_hotplug]             Mar 29   0:00 kacpi_hotplug
root        33     2 S  0.0  0.0 [ata_aux]                   Mar 29   0:00 ata_aux
root        34     2 S  0.0  0.0 [ata_sff/0]                 Mar 29   0:00 ata_sff/0
root        35     2 S  0.0  0.0 [ata_sff/1]                 Mar 29   0:00 ata_sff/1
root        36     2 S  0.0  0.0 [ksuspend_usbd]             Mar 29   0:00 ksuspend_usbd
root        37     2 S  0.0  0.0 [khubd]                     Mar 29   0:00 khubd

2 输出指定命令的进程信息，比如nginx

[root@vm ~]# ps -C nginx --headers -o user,pid,ppid,state,%cpu,%mem,args,bsdstart,bsdtime,comm
USER       PID  PPID S %CPU %MEM COMMAND                      START   TIME COMMAND
root       863   782 S  0.0  0.0 nginx: master process /opt/ Mar 29   0:00 nginx
496        892   863 S  0.0  0.0 nginx: worker process       Mar 29   0:02 nginx
496        893   863 S  0.0  0.0 nginx: worker process       Mar 29   0:03 nginx
496        894   863 S  0.0  0.0 nginx: cache manager proces Mar 29   0:01 nginx

参考资料

【1】man ps

【2】What are “session leaders” in ps?

https://unix.stackexchange.com/questions/18166/what-are-session-leaders-in-ps