Previous Table of Contents Next


The following table defines each of the column headings displayed by ps. The number of columns displayed are controlled by the -f and -l options.

System V Headers

Column Header Description
ADDR The memory address of the process.
C The processor utilization used for scheduling purposes.
COMMAND The command name used to start the process. If the -f option is used the entire command line is given.
F Flags associated with the process. The number on the ps listing is a sum, in octal, of the following flags.
Flags Description
01 The process is in core memory.
02 The process is a system process.
04 The process is locked in core.
10 The process is being swapped.
20 The process is being traced by another process.
Each system may implement a different set of flags; therefore, you should check you system's User Reference Manual for specific flags for your UNIX System.
PRI The priority of the process. The lower the number the higher the priority.
NI The "nice" value used to calculate the priority. Can be set using the nice command.
PID The process ID of the process. This is the number you use to kill a process with the kill command.
PPID The process ID of the parent process.
S Displays the status of the process. The following table defines the possible status values.
Status Description
I Idle or Intermediate: The process is being created.
O Operating: the process is running on a processor.
R Running: the process is in a run queue.
S Sleeping: the process is waiting for an event to complete, such as I/O, etc.
T Traced: the process is stopped by a signal because the parent is tracing it.
W Waiting: the process is waiting for a resource to become available; it is swapped out.
Z Stopped: the process has terminated and is waiting for its parent to allow termination ("zombie").
STIME The time the command started. Given in hours, minutes, and seconds. A process started over twenty-four hours ago is given in months and days.
SZ The size of the process. It is the amount of memory used by the process in (512 or 1024 byte) blocks.
TTY The terminal from which the process was started. A ? is displayed if there is no controlling terminal.
TIME The cumulative execution time for the process.
USER The name of the user who owns the process.
UID The user ID number of the process's owner. The login name is displayed when you use the -f option.
WCHAN The address of an event for which the process is waiting. If the process is executing, the field is empty. Refer to the /usr/include/sys/proc.h file for descriptions of the addresses.

BSD (Berkeley) Headers
Column Header Description
%CPU Percentage of CPU utilization of the process. The result of dividing the decaying average by the previous (real) time. The total %CPU of all processes often exceeds 100% because very young processes have very small time bases used for division.
%MEM Percentage of real memory used by this process.
ADDR The swap address of the process.
CP Same as SV C.
F Flags associated with the process. The number on the ps listing is a sum of the following flags.
Flags Description
000001 The process is in core.
000002 The process is a swapper or pager.
000004 The process is being swapped out.
000008 Save the area flag.
000010 The process is being traced.
000020 The parent has been told that this process has stopped.
000040 The user has set a lock in core.
000080 The process is in page wait state.
000100 A flag to prevent swap out.
000200 Delay the unlock of pages.
000400 The process is working on exiting.
000800 The process is performing physical I/O.
001000 The process is a result of a vfork.
002000 Another vfork flag.
004000 No vm, the parent process is in a vfork.
008000 The data space is initialized on demand from inode.
010000 The system detected anomalous vm behavior.
020000 The user has been warned of anomalous vm behavior.
040000 The process is timing out during sleep state.
080000 The detached process was inherited by init.
100000 The process is using old signal mechanism.

LIM A soft limit imposed on the memory used. If no limit has been set, xx is displayed.
NI NICE Same as SV NI.
PAGEIN The number of disk I/Os caused by references to pages of the process not loaded in main (core) memory.
PRI Same as SV PRI.
RE Residency time of the process. The amount of time spent in core in seconds.
RSS The size of the resident set of the process (in 1024 byte blocks). The real memory size of the process.
SIZE The virtual size of the process in (1024 byte) blocks.
SL Sleep time the process has been blocked in seconds.
SSIZ Size of the kernel stack for a given process.
STAT Same as SV S. Displays the state of the process. The following table defines the possible status values. The status is given in four letters, for example, 'RWNA'.
Status Description
letter 1   Indicates the run state of the process.
D The process is waiting on disk or is in some other short-term wait.
I The process is idle, sleeping longer than 20 seconds.
P The process is in page wait.
R The process is runable. When CPU time becomes available the process will execute.
S The process is sleeping for less than 20 seconds.
T The process is stopped.
Z Zombie processes. These processes have terminated and are waiting for their parent process to do a wait(2) call so they can exit.
letter 2   Indicates whether or not a process is swapped out.
W The process is swapped out.
> The process has specified a soft limit on memory and has exceeded the limit. The process is not necessarily swapped out.
Blank If the field is empty, the process is loaded in memory.
letter 3   Indicates whether or not a process is executing with altered CPU scheduling priority. The nice command changes scheduling priorities.
N The priority of the process has been reduced.
< The priority of the process has been artificially raised.
Blank If the field is empty, the process is running without special treatment.
letter 4   Indicates special treatment of the process for virtual memory replacement. The letters correspond to the options to the vadvise(2) system call.
A Usually represents a program which is performing garbage collection.
S Usually represents a large image processing program that is using virtual memory to sequentially address large amounts of data.
TRS The size of the resident set of text. The part of the process in real memory.
TSIZ The Size of the text image. The text image is the shared program part of the process.
UID Same as SV UID

If a process shows <defunct>, the process has terminated and has a parent, but the parent has not yet waited on the child. The parent must perform a wait function to release the process.


A process or task is the existence of an executing program in the computer. Your login shell is a process while you are logged into the system. When you log off the system your login shell dies. The process is terminated or killed.

There is more than meets the eye when you refer to a UNIX process. A process includes an environment area, the status of files, additional memory allocations, user information, terminal device information, and the executable code. Processes are controlled by the UNIX kernel or operating system. The kernel assigns each process a unique number, called the process ID (PID). This allows the kernel and you to refer to the process on the same terms.

The kernel has to swap processes in and out of execution since multiple processes are using the same CPU. Thus the processes are always in a changing state. The ps command is used to display these various states during the life of a process.


ps (System V only) may not report the status of a process if you do not specify a termlist, proclist, uidlist, or a grplist. The reason is ps checks the stdin, stdout, and stderr to associate processes with your terminal. If you have redirected stdin, stdout, and stderr, there is no way for ps to associate the process with your terminal. Thus there will be no report for the process.

The ps command can only give an approximate report of process status since the information is continuously changing. You basically get a snapshot of the status of each process at the time ps retrieved the information. Therefore, the information you see is always a history and never actually current. On a lightly loaded system the information is less than a second old.

If ps returns with no information and reports a message about "no namelist," the /etc/ps_data file may be missing. To rectify the problem create a ps_data file using touch. The date of the file must be set to a past time.

On a heavily loaded system it is possible for ps to report an lseek error and exit. This is caused by ps retrieving an address for a user's area and the user's process exiting before ps can lseek to the address. Thus when ps does lseek to the address it is no longer valid.

The ps -ef (System V only) command may report login times based on when the last getty was spawned for a tty instead of when the last user logged in to the system.


Refer to the kill and nice commands described in modules 70 and 94.


The ps command uses many different files to retrieve the needed information. The following list describes each file used.

/dev/sxt* Pseudo tty devices for (shl).
/dev/tty* Terminal devices of all users (processes).
/dev/xt* The terminal names being searched for by ps.
/dev/kmem The system kernel's virtual memory.
/dev/mem The system memory.
/etc/passwd The system password file. Ps uses the UID information.
/etc/ps_data The internal data structure used by ps.
/unix The executable UNIX kernel. The namelist is needed.


You use ps to monitor your background processes. It can also be used to see what other processes are executing on the system. You may have a process in background and decide you need to terminate it. Usually, you need to run ps to display the process ID of the process you wish to terminate. You can then use kill PID to terminate the process, where PID is the process ID from the ps listing.


In this activity you use the ps command to display all processes executing on the system. Begin at the shell prompt.

1.  Type ps -ef | pg and press Return. Notice the owner of each process is listed in the first column.

BSD (Berkeley)
On BSD system the command is ps -aux | more.

Now list only processes related to your user_name.
2.  Type ps -fu mylogin and press Return. The f option provides a full listing. The processes listed are related to your login shell.

BSD (Berkeley)
On BSD type ps -u.

3.  Turn to Module 134 to continue the learning sequence.

Previous Table of Contents Next