List Running Processes on Linux: ps aux and pstree
List Running Processes on Linux: ps aux and pstree
Configure automated checks for list and monitor all system processes on your Linux server? Need to understand what's running, identify resource usage, and de...
Why Monitoring System Processes Matters
Monitoring system processes on your Linux server is crucial for security, performance, and troubleshooting. Unauthorized processes can indicate security breaches, malware infections, or compromised accounts. Regular process monitoring helps detect suspicious activity, identify resource-intensive processes, troubleshoot performance issues, and maintain system security compliance.
Method 1: List All Processes with ps Command
The ps command is the most common way to list processes on Linux. It shows running processes with various levels of detail.
Basic Process List
To see all processes:
# List all processes with detailed information
ps aux
# List processes in standard format
ps -ef
# List processes with full command line
ps auxww
Processes in Tree Format
To see process hierarchy:
# Show process tree
pstree
# Show process tree with PIDs
pstree -p
# Show process tree for specific user
pstree -u username
Filter Processes by User
To see processes for specific users:
# Filter processes by user
ps aux | grep username
# Show processes for current user
ps u
# Show processes for root
ps aux | grep root
Method 2: Monitor Process Resource Usage
Understanding which processes consume the most resources helps identify performance bottlenecks.
Sort Processes by Resource Usage
# Sort by memory usage
ps aux --sort=-%mem | head -10
# Sort by CPU usage
ps aux --sort=-%cpu | head -10
# Sort by both memory and CPU
ps aux --sort=-%mem,-%cpu | head -20
Count Total Processes
# Count total processes
ps aux | wc -l
# Count processes by user
ps aux | awk '{print $1}' | sort | uniq -c | sort -rn
Method 3: Automated Process Monitoring with Zuzia.app
Manual checks work while you are looking. To keep running them without you, Zuzia uses its agent and scheduled tasks.
How it works in Zuzia
- Install the Zuzia agent on the server with one command. CPU, RAM, disk, load and network metrics start reporting on their own, with alerts on a threshold, on drift from the server's normal, or on a disk fill-up forecast.
- Save the commands from this guide as a scheduled task and choose how often it runs, from every minute to once a year. The agent runs it on every host you pick.
- If a command fails, you get an alert right away by email, Slack, Discord, push (through your Pushover account) or SMS (through your Vonage account).
- The output of every run is kept, so you can look back at what changed. On paid plans, AI can read the output and alert you only when it spots a problem.
Setting it up
- Add the server in the Zuzia dashboard and install the agent.
- Create a scheduled task with the check commands below, then choose the hosts and how often it runs.
- Choose your notification channels. Turn on maintenance mode during planned work so it doesn't trigger alerts.
Method 4: Advanced Process Monitoring Techniques
Track Process Count Over Time
To identify unusual process activity:
# Save current process count
ps aux | wc -l > /tmp/process-count-$(date +%Y%m%d-%H%M%S).txt
# Compare with previous count
diff /tmp/process-count-old.txt /tmp/process-count-new.txt
Detect Unauthorized Processes
To find processes that shouldn't be running:
# Compare with baseline process list
comm -23 <(ps aux | awk '{print $11}' | sort) <(sort /path/to/baseline-processes.txt)
# Find processes with suspicious names
ps aux | grep -iE "backdoor|trojan|malware|suspicious"
Real-World Use Cases for Process Monitoring
Security Audit
For security audits:
# Generate process report
ps aux > process-audit-$(date +%Y%m%d).txt
# Check for root processes
ps aux | grep "^root" > root-processes-$(date +%Y%m%d).txt
# Check for processes with network connections
ps aux | grep -E "LISTEN|ESTABLISHED"
Performance Troubleshooting
When troubleshooting performance:
# Find CPU-intensive processes
ps aux --sort=-%cpu | head -10
# Find memory-intensive processes
ps aux --sort=-%mem | head -10
# Check process resource usage over time
watch -n 5 'ps aux --sort=-%cpu | head -10'
Best Practices for Process Monitoring
1. Monitor Processes Regularly
Check processes every 30 minutes to 1 hour. More frequent checks may be needed for security-sensitive environments. Use Zuzia.app automated monitoring to check processes continuously without manual intervention.
2. Maintain Baseline Process Lists
Keep baseline process lists for comparison. Update baselines after authorized installations to reduce false positives.
3. Monitor Process Counts
Track total process counts over time. Sudden increases might indicate issues or attacks.
4. Focus on Resource-Intensive Processes
Regularly review top CPU and memory-consuming processes to identify applications that might need optimization.
5. Set Up Alerts for Suspicious Processes
Configure alerts for processes with suspicious names, unexpected users, or unusual resource usage patterns.
Troubleshooting Common Process Issues
Too Many Processes
If there are too many processes:
# Identify processes consuming resources
ps aux --sort=-%mem | head -20
# Check for zombie processes
ps aux | grep -E "Z|defunct"
# Find processes that should be stopped
ps aux | grep -E "stopped|killed"
Process Not Showing
If a process isn't showing:
# Check if process is running
pgrep process-name
# Check process status
ps aux | grep process-name
# Check system logs
dmesg | grep process-name
FAQ: Common Questions About Checking Processes
How often should I check processes?
We recommend checking processes every 30 minutes to 1 hour. More frequent checks may be needed for security-sensitive environments. Use Zuzia.app automated monitoring to check processes continuously without manual intervention.
What if unexpected processes are detected?
You'll receive notifications when unexpected processes are detected through Zuzia.app. You can then verify whether processes are authorized or indicate a security concern. Check process details, verify with system administrators, and take appropriate security actions if unauthorized processes are confirmed.
Can I filter processes by resource usage?
Yes, you can combine ps aux with sorting and filtering. For example: ps aux --sort=-%mem | head -10 shows top memory-consuming processes, or ps aux --sort=-%cpu | head -10 shows top CPU-consuming processes.
How do I detect unauthorized processes?
Set up automated monitoring in Zuzia.app that compares current process lists with baseline lists. Any processes in the current list that aren't in the baseline indicate new processes that should be investigated. Also monitor for processes with suspicious names or unusual resource usage.
Can I track process changes over time?
Yes, use Zuzia.app to store process lists in its database. This allows you to track process changes over time, identify trends, and detect anomalies. Compare current processes with historical patterns to identify unusual activity.
How can I monitor processes across multiple servers?
Zuzia.app allows you to add multiple servers and monitor processes across all of them simultaneously. Each server executes commands independently, and all results are stored in Zuzia.app's database for centralized monitoring and analysis.
Does Zuzia.app use AI to analyze process patterns?
On paid plans, AI can read the output of your scheduled tasks and commands, explain it in plain language and alert you only when it spots a problem. Metric alerts work without AI: Zuzia alerts when CPU, RAM or load drifts from the server's normal and forecasts when a disk will fill up.
Related guides, recipes, and problems
Related guides
- Server resource and performance monitoring:
guides--server-resource-monitoring-complete-guide.md,guides--server-performance-optimization-guide.md
- Server resource and performance monitoring:
Related recipes
- Check user memory usage and process counts:
recipes--check-user-memory-usage-linux.md,recipes--check-user-most-processes-linux.md - Monitor top CPU and memory processes:
recipes--check-top-cpu-consuming-processes-linux.md,recipes--monitor-top-cpu-processes-linux.md,recipes--monitor-top-memory-processes-linux.md - Monitor file descriptor usage per process:
recipes--check-open-file-descriptors-process.md,recipes--monitor-file-descriptor-usage-linux.md
- Check user memory usage and process counts:
Related problems
- High CPU or memory usage on server:
problems--high-cpu-usage-server.md,problems--high-memory-usage-server.md - Server slow performance due to too many or misbehaving processes:
problems--server-slow-performance-issues.md
- High CPU or memory usage on server: