Skip to main content
In this lesson we’ll use standard Linux utilities — ps, pstree, and top (with grep) — to examine process activity as snapshots and in real time. These tools are essential for troubleshooting CPU and memory usage, identifying runaway processes, and understanding parent/child relationships between processes.
A dark-themed presentation slide that says "Demo: Monitoring Process Activity" on the left. On the right is a blue line-art icon of a computer monitor with three vertical slider controls.

​
Quick reference — when to use which tool

See References at the end for man pages and further reading.

​
Inspect a snapshot with ps

ps prints a static snapshot of processes at the moment it runs. Two common output styles are BSD-style and System-V style. BSD-style (includes CPU and memory columns):
System V style:

​
Common ps use cases and options

To output specific fields for a PID:

​
Filter ps output with grep

Search the ps output for a process such as sshd:
ps gives a static snapshot of processes at the time it runs. When you need continuous, real-time monitoring of CPU, memory and process activity use top (or interactive tools like htop and glances).

​
View parent/child relationships with pstree

pstree prints a tree showing which processes spawned which children — useful for understanding process hierarchies:

​
Live monitoring with top

top provides an interactive, continuously updating view of system load and a sorted list of processes. Example top header and a few processes (truncated):

​
Useful interactive keys in top

Examples:
  • Press c while top is running to toggle full command lines.
  • Press M to immediately reorder by memory usage.
  • Use f then Space to toggle columns, Enter to apply, and W to save the layout.

​
Summary

  • Use ps for a point-in-time snapshot and custom, scriptable output.
  • Use pstree to visualize parent/child relationships.
  • Use top for an interactive live view with sorting and field selection.
  • Combine ps with grep to filter results and ps --sort to identify top consumers of CPU or memory.
That concludes the demo. You should now be able to capture process snapshots, filter and sort results, inspect parent-child trees, and monitor processes in real time.

Watch Video