> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Demo Monitoring Process Activity
> Guide to using ps, pstree, and top with grep to inspect process snapshots, monitor processes in real time, and troubleshoot CPU, memory, and parent child relationships.
In this lesson we'll use standard Linux utilities — `ps`, `pstree`, and `top` (with `grep`) — to examine process activity as snapshots and in real time. These tools are essential for troubleshooting CPU and memory usage, identifying runaway processes, and understanding parent/child relationships between processes.
## Quick reference — when to use which tool
| Task | Recommended command |
| - | - |
| Take a one-time snapshot of all processes | `ps aux` or `ps -ef` |
| Get a live, updating view of system load and processes | `top` (or `htop`, `glances`) |
| Visualize parent → child relationships | `pstree` |
| Search process lists for a pattern | `ps ... \| grep ` |
See References at the end for man pages and further reading.
***
## Inspect a snapshot with ps
`ps` prints a static snapshot of processes at the moment it runs. Two common output styles are BSD-style and System-V style.
BSD-style (includes CPU and memory columns):
```bash theme={null}
root@control:~# ps aux
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.1 1.1 50184 41892 ? Ss 14:13 0:02 /usr/lib/systemd/systemd --switched-root --system
root 2 0.0 0.0 0 0 ? S 14:13 0:00 [kthreadd]
root 3 0.0 0.0 0 0 ? S 14:13 0:00 [pool_workqueue_release]
...
root 31 0.0 0.0 0 0 ? S 14:13 0:00 [idle_inject/2]
```
System V style:
```bash theme={null}
root@control:~# ps -ef
UID PID PPID C STIME TTY TIME CMD
root 1 0 0 14:13 ? 00:00:02 /usr/lib/systemd/systemd --switched-root --system
root 5447 5420 0 14:47 pts/0 00:00:00 ps -ef
...
```
### Common ps use cases and options
| Use case | Command example |
| - | - |
| Show all processes (BSD-style) | `ps aux` |
| Show all processes (SysV-style) | `ps -ef` |
| Show processes for a real/effective user | `ps -U root -u root` |
| Show info for a specific PID with custom columns | `ps -p 1 -o pid,user,cmd` |
| Sort ps output (CPU or memory) | `ps aux --sort=-%cpu` or `ps aux --sort=-%mem` |
To output specific fields for a PID:
```bash theme={null}
# Basic info for PID 1
root@control:~# ps -p 1 -o pid,tty,time,cmd
PID TTY TIME CMD
1 ? 00:00:02 /usr/lib/systemd/systemd --switched-root --system
```
### Filter ps output with grep
Search the ps output for a process such as `sshd`:
```bash theme={null}
root@control:~# ps aux | grep sshd
root 1278 0.0 0.1 9136 6688 ? Ss 14:13 0:00 /usr/sbin/sshd -D
root 5505 0.0 0.0 227692 2212 pts/0 S+ 14:50 0:00 grep --color=auto sshd
```
***
`ps` gives a static snapshot of processes at the time it runs. When you need continuous, real-time monitoring of CPU, memory and process activity use `top` (or interactive tools like `htop` and `glances`).
***
## View parent/child relationships with pstree
`pstree` prints a tree showing which processes spawned which children — useful for understanding process hierarchies:
```bash theme={null}
root@control:~# pstree -p
systemd(1)─┬─sshd(1278)─┬─sshd(1280)
│ └─sshd(1281)
├─gnome-shell(2577)
└─bash(3840)───pstree(5526)
```
***
## Live monitoring with top
`top` provides an interactive, continuously updating view of system load and a sorted list of processes.
Example `top` header and a few processes (truncated):
```bash theme={null}
top - 14:52:40 up 39 min, 4 users, load average: 0.00, 0.04, 0.00
Tasks: 289 total, 1 running, 287 sleeping, 1 stopped, 0 zombie
%Cpu(s): 0.3 us, 0.2 sy, 0.0 ni, 99.3 id, 0.0 wa, 0.3 hi, 0.2 si, 0.0 st
MiB Mem : 3652.4 total, 1739.3 free, 1450.2 used, 694.4 buff/cache
MiB Swap: 2048.0 total, 2048.0 free, 0.0 used. 2202.2 avail Mem
PID COMMAND PPID USER TTY TIME+ %CPU %MEM S
2438 systemd 1 root ? 0:00.30 0.0 0.4 S
2577 gnome-shell 2438 student ? 0:30.52 1.9 11.6 S
3465 ptyxis 2438 student ? 0:23.14 4.0 9.9 S
```
### Useful interactive keys in top
| Key | Action |
| - | - |
| P | Sort by CPU usage (descending) |
| M | Sort by memory usage (descending) |
| T | Sort by total CPU time |
| d | Change the refresh delay (enter seconds) |
| c | Toggle display of full command line vs. program name |
| I | Toggle display of idle processes (hide/show) |
| f | Field management — select which columns to display |
| W | Write current configuration to `~/.toprc` (persist layout) |
| q | Quit `top` |
Examples:
* Press `c` while `top` is running to toggle full command lines.
* Press `M` to immediately reorder by memory usage.
* Use `f` then Space to toggle columns, Enter to apply, and `W` to save the layout.
***
## Summary
* Use `ps` for a point-in-time snapshot and custom, scriptable output.
* Use `pstree` to visualize parent/child relationships.
* Use `top` for an interactive live view with sorting and field selection.
* Combine `ps` with `grep` to filter results and `ps --sort` to identify top consumers of CPU or memory.
## Links and References
* [ps(1) manual - Linux man-pages project](https://man7.org/linux/man-pages/man1/ps.1.html)
* [top(1) manual - Linux man-pages project](https://man7.org/linux/man-pages/man1/top.1.html)
* [pstree(1) — Linux command reference](https://linux.die.net/man/1/pstree)
* [htop — interactive process viewer (alternative to top)](https://hisham.hm/htop/)
That concludes the demo. You should now be able to capture process snapshots, filter and sort results, inspect parent-child trees, and monitor processes in real time.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.