Linux.com

Home Learn Linux Linux Documentation Linux System Hogs and Child Processes

Linux System Hogs and Child Processes

 There are a lot of good old Linux commands to see what's happening inside your system, with all the power and flexibility you need to zero in on just the information you want. Want to see who is sucking up the most resources on your computer? You can use the good old ps command. This example lists the top 7 hogs, excluding your own processes:

$ ps aux  --sort=-%cpu | grep -m 8 -v `whoami`
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root      1558  4.1  1.6 193620 68532 tty8     Rs+  07:05  16:10 /usr/bin/X 
root        55  0.0  0.0      0     0 ?        S    07:05   0:21 [kswapd0]
root      7615  0.0  0.0      0     0 ?        S    12:06   0:02 [kworker/2:0]
root      1772  0.0  0.0      0     0 ?        S    07:05   0:10 [flush-8:16]
mysql     1262  0.0  4.5 549912 185232 ?       Ssl  07:05   0:10 /usr/sbin/mysqld
root      9478  0.0  0.0      0     0 ?        S    12:54   0:00 [kworker/1:1]
root      9832  0.0  0.0      0     0 ?        S    13:25   0:00 [kworker/0:1]
hog

You can modify this particular incantation to sort by any ps category, like this example that displays the seven biggest memory users (that are not you):

$ ps aux  --sort=-%mem | grep -m 8 -v `whoami`
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
mysql     1262  0.0  4.5 549912 185232 ?       Ssl  07:05   0:12 /usr/sbin/mysqld
root      1558  4.0  1.7 197268 72352 tty8     Ss+  07:05  18:10 /usr/bin/X 
root      1310  0.0  1.3 122728 53032 ?        Ss   07:05   0:05 /usr/sbin/spamd 
root      1329  0.0  1.2 122728 52164 ?        S    07:05   0:00 spamd child
root      1328  0.0  1.2 122728 52140 ?        S    07:05   0:00 spamd child
root      3156  0.0  0.2  95320 10204 ?        S    08:53   0:00 /usr/bin/python 
root      1559  0.0  0.2 311480  8156 ?        Ss   07:05   0:00 /usr/sbin/apache2 -k start

Or who has been running the longest:

$ ps aux  --sort=-time | grep -m 8 -v `whoami`
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root      1558  4.0  1.7 197268 72352 tty8     Ss+  07:05  18:12 /usr/bin/X
root        55  0.0  0.0      0     0 ?        S    07:05   0:21 [kswapd0]
mysql     1262  0.0  4.5 549912 185232 ?       Ssl  07:05   0:12 /usr/sbin/mysqld
root      1772  0.0  0.0      0     0 ?        S    07:05   0:11 [flush-8:16]
root         3  0.0  0.0      0     0 ?        S    07:05   0:05 [ksoftirqd/0]
root      1310  0.0  1.3 122728 53032 ?        Ss   07:05   0:05 /usr/sbin/spamd 
root       845  0.0  0.0      0     0 ?        S    07:05   0:03 [jbd2/sdb3-8]

You might have noticed that to get 7 results, you need to use grep -m 8. I shall leave it as your homework to read man grep to learn why.

The ps command has some built-in sorting options. ps aux displays all running processes, and the users they belong to. You can view processes per user with the -U option:

$ ps -U carla

Or multiple users:

$ ps  -U postfix -U mysql

pigChild processes? Piglet processes!

You can see all child processes:

$ ps -eo pid,args --forest
[...]
  397 /sbin/udevd --daemon
 9900  \_ /sbin/udevd --daemon
 9901  \_ /sbin/udevd --daemon
  815 upstart-socket-bridge --daemon
  881 smbd -F
  896  \_ smbd -F
  884 /usr/sbin/sshd -D
[...]

Or all child processes of a particular process:

$ ps -f --ppid 1559
UID        PID  PPID  C STIME TTY          TIME CMD
www-data  1576  1559  0 07:05 ?        00:00:00 /usr/sbin/apache2 -k start
www-data  1577  1559  0 07:05 ?        00:00:00 /usr/sbin/apache2 -k start
www-data  1578  1559  0 07:05 ?        00:00:00 /usr/sbin/apache2 -k start
www-data  1579  1559  0 07:05 ?        00:00:00 /usr/sbin/apache2 -k start
www-data  1580  1559  0 07:05 ?        00:00:00 /usr/sbin/apache2 -k start
www-data  9526  1559  0 13:00 ?        00:00:00 /usr/sbin/apache2 -k start

Please read man ps, man sort, and man grep to learn more.

 

Comments

Subscribe to Comments Feed
  • Alex Stragies Said:

    Hello Carla, your grep-incantation would also filter processes, that have your username somewhere in the cmdline. grep -m 8 -v ^`whoami` would only match lines not starting with your username. (notice the '^') Plus, I would additionally recommend "pstree" (from psmisc-package) to visualize parent-child process hierarchies. Best regards, Alex

  • Alex Stragies Said:

    Oops, my line-breaks took the wrong exit, and went missing ... Sorry for the messy read. Carla, if you want, reformat my previous post and then delete this one.

  • John Hairya Said:

    Nice ! Work great !! like your winning smile.

Upcoming Linux Foundation Courses

  1. LFS426 Linux Performance Tuning
    08 Sep » 11 Sep - New York
    Details
  2. LFS520 OpenStack Cloud Architecture and Deployment
    08 Sep » 11 Sep - Virtual
    Details
  3. LFD320 Linux Kernel Internals and Debugging
    15 Sep » 19 Sep - Virtual
    Details

View All Upcoming Courses

Become an Individual Member
Check out the Friday Funnies

Sign Up For the Linux.com Newsletter


Who we are ?

The Linux Foundation is a non-profit consortium dedicated to the growth of Linux.

More About the foundation...

Frequent Questions

Join / Linux Training / Board