UNIX System Administration Handbook - Evi Nemeth [43]
Shown here in an abbreviated example, ps lax includes fields such as the parent process ID (PPID), nice value (NI), and resource the process is waiting for (WCHAN).
% ps lax
UID PID PPID CPU PRI NI VSZ RSS WCHAN STAT TT TIME COMMAND
0 0 0 0 -18 0 0 0 a5e6c DLs ?? 0:00.06 (swapper)
0 1 0 0 10 0 208 120 wait Is ?? 0:00.20 init-s
0 2 0 0 -18 0 0 12 a203c DL ?? 0:00.06 pagedaemon
0 46 1 0 2 0 160 112 select Ss ?? 0:01.47 syslogd
0 77 1 0 2 0 160 88 select IWs ?? 0:00.07 portmap
0 84 1 0 2 0 260 204 select IWs ?? 0:00.23 mountd
...
Under Solaris and HP-UX, ps -ef is a good place to start (it also works on Red Hat).
%ps -ef
UID PID PPID C STIME TTY TIME COMD
root 0 0 80 Dec 21 ? 0:02 sched
root 1 0 2 Dec 21 ? 4:32 /etc/init-
root 2 0 8 Dec 21 ? 0:00 pageout
root 171 1 80 Dec 21 ? 0:02 /usr/lib/sendmail-bd
trent 8482 8444 35 14:34:10 pts/7 0:00 ps-ef
trent 8444 8442 203 14:32:50 pts/7 0:01 -csh
...
The columns are explained in Table 4.5.
Table 4.5 Explanation of ps -ef output (Solaris, HP-UX, and Red Hat)
Like ps -lax in the Red Hat and FreeBSD worlds, ps -elf shows additional gory details on SysV-ish systems:
% ps -elf
F S UID PID PPID C P NI ADDR SZ WCHAN TIME COMD
19 T root 0 0 80 0 SY f00c2fd8 0 0:02 sched
8 S root 1 0 65 1 20 ff26a800 88 ff2632c8 4:32 init-
8 S root 142 1 41 1 20 ff2e8000 176 f00cb69 0:00 syslogd
...
The STIME and TTY columns have been omitted to fit this page; they are identical to those produced with ps -ef. Nonobvious fields are described in Table 4.6.
Table 4.6 Explanation of ps -elf output (Solaris, HP-UX, IRIX, and Red Hat)
4.8 TOP: MONITOR PROCESSES EVEN BETTER
Since commands like ps offer only a one-time snapshot of your system, it is often difficult to grasp the “big picture” of what’s really happening. top is a free utility by William LeFebvre that runs on many systems and provides a regularly updated summary of active processes and their use of resources.
top is available from www.groupsys.com.
For example:
last pid: 21314; load averages: 2.97, 2.95, 2.89 15:51:51
75 processes: 71 sleeping, 3 running, 1 zombie
cpu states: 44.5% user, 0% nice, 23.9% system, 31.6% idle
Memory: 113M avail, 108M in use, 4972K free, 6232K locked
PID USER PRI NICE SIZE RES STATE TIME WCPU CPU COMMAND
1313 root 1 -19 292K 148K sleep 0:00 9.3% 0.7% erpcd
2858 root 1 0 1564K 676K sleep 0:20 5.4% 0.7% sendma
1310 root 27 0 812K 488K run 0:00 7.6% 0.3% sendma
981 root 29 0 2152K 2324K run 0:03 0.0% 0.0% top
192 root 1 0 44K 276K sleep 0:48 0.0% 0.0% in.rlo
778 uucp 27 0 244K 508K run 0:04 0.0% 0.0% uucico
5298 randy 15 0 228K 176K sleep 0:00 0.0% 0.0% csh
151 root 15 0 12K 8K sleep 54:40 0.0% 0.0% update
0962 trent 15 0 212K 0K sleep 0:00 0.0% 0.0% csh
5843 beth 15 0 208K 0K sleep 0:00 0.0% 0.0% csh
167 root 15 0 100K 0K sleep 0:00 0.0% 0.0% lpd
1311 randy 5 0 224K 408K sleep 0:00 0.0% 0.0% prev
By default, the display is updated every 10 seconds. The most active processes appear at the top. top also accepts input from the keyboard and allows you to send signals and renice processes, so you can observe how your actions affect the overall condition of the machine.
top must consume a small portion of the CPU to show an update every 10 seconds. It should generally be used only for diagnostic purposes, not as a “Hey, look what neat tools I run in my spare windows” toy.
Root can run top with the -q option to goose it up to the highest possible priority. This can be very useful when you are trying to track down a process that has already brought the system to its knees.
4.9 RUNAWAY PROCESSES
Runaway processes come in two flavors: user processes that use up excessive amounts of a system resource such as CPU time or disk space, and system processes that suddenly go berserk and exhibit wild behavior. The first type of runaway is not necessarily malfunctioning; it might