What is the difference between ps and ps aux?

Plain `ps` shows only what you are running in this terminal. `ps aux` shows everything, including other users and background processes.

Why does aux have no dash?

ps accepts two styles of option. `aux` is the BSD form and `-ef` is the UNIX form. Both mean everything in detail; they just print slightly different columns.

How do I find one particular process?

Pipe into grep: `ps aux | grep node`. On a real machine the grep itself also shows up in the list, so add `grep -v grep` when that matters.

It is what `kill` takes. Find the process with `ps`, read its PID, then `kill `.

How is this different from top?

`ps` prints one snapshot and stops; `top` keeps refreshing. Use `ps` when you want to keep the output or pipe it somewhere.

← Linux command list

ps command: see what is running right now

__ __ _ _____

\ \ / /__| |_|_ _|__ _ __ _ __ ___

\ \ /\ / / _ \ '_ \| |/ _ \ '__| '_ ` _ \

\ V V / __/ |_) | | __/ | | | | | |

\_/\_/ \___|_.__/|_|\___|_| |_| |_| |_

A sandbox for trying ps. Nothing here can touch your real files.

user@webterm:~/project$

ps lists the processes that are running. Learn how to read the columns of `ps aux`, how to find one process with `grep`, and how to get the PID that `kill` needs, by running the commands in a real terminal in your browser.

Updated: 2026-09-06

Syntax

ps [options]

It lists the processes that are running.

Try it first

$ ps
  PID TTY              TIME CMD
 1234 pts/0        00:00:00 zsh
 2847 pts/0        00:01:23 node
 3456 pts/0        02:34:56 python3
 2345 pts/0        00:00:00 ps

With no options, ps shows what you are running in this terminal. PID is the process number, and that number is what kill takes.

Everything, in detail

$ ps aux
USER         PID %CPU %MEM     VSZ    RSS TTY      STAT START     TIME COMMAND
root           1  0.0  0.1  169232  13120 ?        Ss   00:00     0:02 /sbin/init
root           2  0.0  0.0       0      0 ?        S    00:00     0:00 [kthreadd]
root         123  0.3  0.2  120344   9876 ?        Ss   00:01     0:01 /lib/systemd/systemd-journald
root         456  0.0  0.1   45672   5432 ?        Ss   00:01     0:00 /usr/sbin/sshd -D
user         789  0.1  0.1   45672   5432 ?        S    10:30     0:00 sshd: user@pts/0
user        1234  0.2  0.1   23456   3456 pts/0    Ss   10:30     0:00 -zsh
user        2847  1.2  1.5  345678  56789 pts/0    S    10:35     1:23 node server.js
user        3456 98.5  4.2  456789  87654 pts/0    R    09:15   154:56 python3 backup_sync.py
root        5678  0.0  0.0   12345   2345 ?        Ss   00:01     0:00 /usr/sbin/crond
root         301  0.0  0.0    5678   1234 ?        Ss   00:00     0:00 /etc/init.d/networking
systemd+     201  0.0  0.1   24576   6789 ?        Ss   00:00     0:01 /lib/systemd/systemd-resolved
user        2345  0.0  0.0   11234   1234 pts/0    R+   10:45     0:00 ps

Only a few columns matter day to day.

Column	Meaning
`USER`	Who is running it
`PID`	Process number
`%CPU`	Share of the CPU
`%MEM`	Share of the memory
`RSS`	Memory actually in use, in KB
`STAT`	State (`R` running, `S` sleeping, `Z` zombie)
`TIME`	CPU time used so far
`COMMAND`	What is running

In this list, python3 backup_sync.py at 98.5 percent CPU is obviously the odd one out. Finding that single line is usually the whole point of ps aux.

Finding one process

When the list is long, pipe it into grep.

$ ps aux | grep node
user        2847  1.2  1.5  345678  56789 pts/0    S    10:35     1:23 node server.js

With the PID in hand, here 2847, you can hand it to kill 2847.

The other spelling

$ ps -ef
UID          PID  PPID  C STIME TTY              TIME CMD
root           1     0  0 00:00 ?            00:00:02 /sbin/init
root           2     0  0 00:00 ?            00:00:00 [kthreadd]
root         123     1  0 00:01 ?            00:00:01 /lib/systemd/systemd-journald
root         456     1  0 00:01 ?            00:00:00 /usr/sbin/sshd -D
user         789   456  0 10:30 ?            00:00:00 sshd: user@pts/0
user        1234   789  0 10:30 pts/0        00:00:00 -zsh
user        2847  1234  0 10:35 pts/0        00:01:23 node server.js
user        3456  1234  0 09:15 pts/0        02:34:56 python3 backup_sync.py
root        5678     1  0 00:01 ?            00:00:00 /usr/sbin/crond
root         301     1  0 00:00 ?            00:00:00 /etc/init.d/networking
systemd+     201     1  0 00:00 ?            00:00:01 /lib/systemd/systemd-resolved
user        2345  1234  0 10:45 pts/0        00:00:00 ps

aux and -ef both mean everything in detail. The difference is the columns: -ef includes PPID, the process that started it. Reach for -ef when you need to know who launched what.

When you actually reach for it

ps is what you type to check something is slow, will not stop, or is running twice.

Situation	What to type
Find what is eating the CPU	`ps aux`
Check whether an app is running	`ps aux \| grep node`
Get the PID of something to stop	`ps aux \| grep node`
Trace what started what	`ps -ef`
Count how many are running	`ps aux \| grep -c node`

Things that trip people up

The grep shows up in its own results. On a real machine ps aux | grep node also prints the grep node line. It throws off counts, so add grep -v grep when the number matters.

ps is a snapshot. The list is from the moment you pressed enter and never updates itself. Use top when you want to watch.

A Z in STAT cannot be killed. A zombie has already exited; it is only waiting for its parent to collect the result. Fix the parent process instead.

Practise it hands-on

webterm.appthis site

Advanced Terminal Commands
Learn commands for specific situations
Try the tutorial

learn.webterm.appa separate site

>_WEBTERM LEARN

WebTerm Learn: from one command to actually using it

Commands stick when they show up in a real sequence of work, not one at a time. There is a course that builds them up in order.

See the course

Related commands

kill / top / grep / jobs

Frequently asked questions

What is the difference between ps and ps aux?: Plain `ps` shows only what you are running in this terminal. `ps aux` shows everything, including other users and background processes.
Why does aux have no dash?: ps accepts two styles of option. `aux` is the BSD form and `-ef` is the UNIX form. Both mean everything in detail; they just print slightly different columns.
How do I find one particular process?: Pipe into grep: `ps aux | grep node`. On a real machine the grep itself also shows up in the list, so add `grep -v grep` when that matters.
What is the PID for?: It is what `kill` takes. Find the process with `ps`, read its PID, then `kill <PID>`.
How is this different from top?: `ps` prints one snapshot and stops; `top` keeps refreshing. Use `ps` when you want to keep the output or pipe it somewhere.