# ps -ef Command with Practical Examples

> URL: https://www.atlantic.net/dedicated-server-hosting/ps-ef-command-with-practical-examples/ | Published: 2024-09-28 | Updated: 2024-10-03 | Author: Hitesh Jethva

The **ps** command is a crucial tool in Linux for monitoring running processes. It displays information about the processes running on your system, helping you manage system resources, identify issues, and kill unnecessary processes. One of the most commonly used variations of this command is **ps -ef**.

In this article, we will explore how the **ps -ef** command works and how to use it effectively, using practical examples.

## Understanding the -e and -f Options

The **-e** option tells **ps** to display all processes running on the system, not just those associated with the current terminal. The **-f** option stands for full-format listing, which includes additional details about each process.

To get a comprehensive view of all the processes on your system, you can use the **ps -ef** command:

```bash
ps -ef
```

Output:

```bash
UID        PID  PPID  C STIME TTY          TIME CMD
root         1     0  0 09:22 ?        00:00:02 /sbin/init
root       719     1  0 09:22 ?        00:00:00 /usr/lib/systemd/systemd-journald
root      1369     1  0 09:22 ?        00:00:00 /usr/sbin/sshd -D
user      1421  1369  0 09:22 ?        00:00:00 sshd: user [priv]
user      1422  1421  0 09:22 pts/0    00:00:00 -bash
user      1567  1422  0 09:22 pts/0    00:00:00 ps -ef
```

This command shows all running processes, regardless of the terminal. Each column in the output provides essential information about the processes.

Here’s what each column in the **ps -ef** output means:

- **UID:** The user ID of the process owner.
- **PID:** The Process ID of the running process.
- **PPID:** The Parent Process ID, which refers to the process that spawned this one.
- **C:** CPU utilization of the process.
- **STIME:** Start time of the process.
- **TTY:** The terminal associated with the process.
- **TIME:** Total CPU time used by the process.
- **CMD:** The command that started the process.

## Filtering Processes with ps -ef

You can filter specific processes using the **grep** command with **ps -ef.** For example, if you want to see all processes related to Apache, you can run:

```bash
ps -ef | grep apache
```

Output:

```bash
root      1350     1  0 09:25 ?        00:00:00 /usr/sbin/apache2 -k start
www-data  1352  1350  0 09:25 ?        00:00:00 /usr/sbin/apache2 -k start
www-data  1353  1350  0 09:25 ?        00:00:00 /usr/sbin/apache2 -k start
user      1365  1422  0 09:26 pts/0    00:00:00 grep --color=auto apache
```

This shows all Apache-related processes. The last line with **grep** is the actual command we used to search.

## Using ps -ef to Find Parent and Child Processes

Every process in Linux is either a parent or a child process. The PPID (Parent Process ID) field helps you identify the parent process of a given child process. You can use the **ps -ef** command to check the parent-child relationship of processes.

For better visualization, you can use the **ps -ef –forest** option, which displays a tree of processes:

```bash
ps -ef --forest
```

Output:

```bash
root         1     0  0 09:22 ?        00:00:02 /sbin/init
 ├─/usr/lib/systemd/systemd-journald
 ├─/usr/sbin/sshd -D
 │   └─sshd: user [priv]
 │       └─sshd: user [priv]
 │           └─/bin/bash
 └─ps -ef --forest
```

This tree structure helps you understand how processes are related, which is especially useful when debugging.

## Sorting the ps -ef Output

You can sort the output of **ps -ef** based on different criteria, such as CPU usage, memory usage, or PID. For example, to sort processes by CPU usage in descending order, use:

```bash
ps -ef --sort=-pcpu
```

Output:

```bash
UID        PID  PPID  C STIME TTY          TIME CMD
user      1367  1369  2 09:25 pts/0    00:00:02 firefox
user      1345  1341  1 09:22 pts/0    00:00:01 gnome-shell
user      1567  1422  0 09:22 pts/0    00:00:00 ps -ef --sort=-pcpu
```

This example sorts processes by their CPU usage (represented by the C column).

## Listing Processes for a Specific User

To list all processes running under a specific user, you can combine **ps -ef** with **grep.** For example, to list all processes run by the current user:

```bash
ps -ef | grep $USER
```

Output:

```bash
user      1422  1421  0 09:22 pts/0    00:00:00 -bash
user      1367  1369  2 09:25 pts/0    00:00:02 firefox
user      1567  1422  0 09:22 pts/0    00:00:00
```

This shows only the processes owned by the logged-in user.

## Killing a Process with ps -ef and kill

When you identify a process that needs to be stopped, you can use its PID from the **ps -ef** output and terminate it with the **kill** command. For example, to kill a process with PID 1350:

```bash
kill 1350
```

To ensure the process is terminated, you can recheck by running ps -ef again.

## Using ps -ef to Monitor System Performance

ps -ef can also be used for performance monitoring by identifying high CPU or memory-consuming processes. For example, to list processes consuming the most memory, use:

```bash
ps -ef --sort=-pmem
```

Output:

```bash
UID        PID  PPID  C STIME TTY          TIME CMD
user      1367  1369  1 09:25 pts/0    00:01:05 firefox
root      1001     1  0 09:20 ?        00:00:50 apache2
user      1345  1341  0 09:22 pts/0    00:00:30 gnome-shell
```

This output helps you identify memory-heavy processes so you can take action if needed.

## Conclusion

The ps -ef command is a powerful tool for process management in Linux. It allows you to easily view, filter, and manage running processes. Whether you’re troubleshooting system performance, monitoring resource usage, or managing applications, ps -ef is an essential command to know. You can now use ps -ef command to manage processes on [dedicated server hosting](https://www.atlantic.net/dedicated-server-hosting/) from Atlantic.Net!