Monitoring Programs

Peeking at the processes

　　When a program runs on the system, it’s referred to as a process. To examine these processes, you need to become familiar with the ps command, the Swiss Army knife of utilities. It can produce lots of information about all the programs running on your system.

The basic ps command doesn’t really provide all that much information：

$ ps
PID TTY TIME CMD
3081 pts/0 00:00:00 bash
3209 pts/0 00:00:00 ps
$

　　Not too exciting. By default, the ps command shows only the processes that belong to the current user and that are running on the current terminal. In this case, we had only our bash shell running (remember, the shell is just another program running on the system) and, of course, the ps command itself. The basic output shows the process ID (PID) of the programs, the terminal (TTY) that they are running from, and the CPU time the process has used.

The GNU ps command that’s used in Linux systems supports three different types of command
line parameters:
■ Unix-style parameters, which are preceded by a dash
■ BSD-style parameters, which are not preceded by a dash
■ GNU long parameters, which are preceded by a double dash

Unix-style parameters

That’s a lot of parameters, and there are still more! The key to using the ps command is not to memorize all the available parameters — only those you find most useful.

-ef parameter

$ ps -ef
UID PID PPID C STIME TTY TIME CMD
root 1 0 0 11:29 ? 00:00:01 init [5]
root 2 0 0 11:29 ? 00:00:00 [kthreadd]
root 3 2 0 11:29 ? 00:00:00 [migration/0]
root 4 2 0 11:29 ? 00:00:00 [ksoftirqd/0]
root 5 2 0 11:29 ? 00:00:00 [watchdog/0]
root 6 2 0 11:29 ? 00:00:00 [events/0]
root 7 2 0 11:29 ? 00:00:00 [khelper]
root 47 2 0 11:29 ? 00:00:00 [kblockd/0]
root 48 2 0 11:29 ? 00:00:00 [kacpid]
68 2349 1 0 11:30 ? 00:00:00 hald
root 3078 1981 0 12:00 ? 00:00:00 sshd: rich [priv]
rich 3080 3078 0 12:00 ? 00:00:00 sshd: [email protected]/0
rich 3081 3080 0 12:00 pts/0 00:00:00 -bash
rich 4445 3081 3 13:48 pts/0 00:00:00 ps -ef
$

■ UID: 　　The user responsible for launching the process
■ PID: 　　The process ID of the process
■ PPID: 　 The PID of the parent process (if a process is started by another process)
■ C: 　　　 Processor utilization over the lifetime of the process
■ STIME:  The system time when the process started
■ TTY:      The terminal device from which the process was launched
■ TIME:    The cumulative CPU time required to run the process
■ CMD:     The name of the program that was started

-l parameter

$ ps -l
F S UID PID PPID C PRI NI ADDR SZ WCHAN TTY TIME CMD
0 S 500 3081 3080 0 80 0 - 1173 wait pts/0 00:00:00 bash
0 R 500 4463 3081 1 80 0 - 1116 - pts/0 00:00:00 ps
$

■ F: System flags assigned to the process by the kernel
■ S: The state of the process (O = running on processor; S = sleeping; R = runnable, waiting to run; Z = zombie, process terminated but parent not available;T = process stopped)
■ PRI: The priority of the process (higher numbers mean lower priority)
■ NI: The nice value(谦让度), which is used for determining priorities
■ ADDR: The memory address of the process
■ SZ: Approximate amount of swap space required if the process was swapped out
■ WCHAN: Address of the kernel function where the process is sleeping