Listing Processes in Linux: ps for a Snapshot, top for Live, ss for Ports

Q: How do I list all running processes in Linux?

Run ps aux for a full one-time snapshot of every process, showing owner, PID, CPU and memory use, state, and command. For a live updating view use top or htop, and to find a process by name use pgrep -a name rather than ps aux | grep name.

Q: What is the difference between ps and top?

ps gives a static snapshot of processes at the instant you run it. top (and htop) give a live, continuously updating view sorted by resource use. Use ps to list or grep for what exists, and top/htop to watch what is using CPU or memory right now.

Q: How do I find which process is using a port in Linux?

Run ss -tulpn | grep :8080 to see the listening process and its PID on that port, or lsof -i :8080 for the same answer a different way. This is how you resolve an address-already-in-use error - find the PID, then stop that process.

Q: Why does ps aux grep show an extra grep line?

Because the grep command matches its own text in the process list, so you see the grep process itself as an extra result. Use pgrep -a name instead, which searches process names directly and does not match its own invocation.

Q: How do I find the processes using the most CPU or memory?

Use ps aux --sort=-%cpu | head for the top CPU users or ps aux --sort=-%mem | head for the top memory users. The leading minus sorts descending, and head trims to the heaviest few - a quick alternative to opening top.

To list running processes in Linux, ps aux gives you a full snapshot of everything running right now. For a live, updating view use top or the friendlier htop. To find which process holds a port - the reason you are usually looking - use ss -tulpn or lsof -i. The mistake is reaching for ps aux | grep name for everything; it works, but pgrep, top, and ss each answer a specific question faster. Pick the tool that matches what you actually want to know.

ps aux: the full snapshot
pgrep and pkill: find and act by name
top and htop: the live view
Finding what holds a port
Filtering and sorting ps
How this fits the rest of the stack
FAQ

ps aux: the full snapshot

ps aux is the workhorse - a one-time list of every process on the system:

ps aux

The columns that matter: USER (who owns it), PID (its ID, the thing you need to signal it), %CPU and %MEM (its resource use), STAT (its state), and COMMAND (what it is). It is a snapshot - the state at the instant you ran it, not a live feed.

To find a specific process, people pipe to grep:

ps aux | grep nginx

This works but has a famous flaw: the grep nginx command matches itself, so you always see one extra line - the grep process. pgrep avoids that entirely, which is the next section. Still, ps aux piped to grep is the universal, always-available way to see what is running, and it is worth knowing even though better tools exist for specific questions.

pgrep and pkill: find and act by name

When you want processes by name, pgrep is cleaner than ps | grep:

pgrep nginx           # just the PIDs
pgrep -a nginx        # PIDs with the full command line
pgrep -u www-data     # processes owned by a user

pgrep does not match its own process, so no spurious grep line. pgrep -a (or -af) shows the command alongside the PID, which is usually what you want.

Its companion pkill finds and signals in one step:

pkill nginx           # send SIGTERM to everything named nginx
pkill -9 stuck_proc   # force-kill by name (last resort)

pkill is convenient and dangerous in equal measure - it signals every match, so a broad name can hit more than you intended. Check with pgrep -a first to see exactly what will be signalled, then pkill. Look before you kill, and the convenience is safe.

top and htop: the live view

ps is a snapshot; top is a live, continuously updating view - what you open when something is eating CPU right now:

top

It refreshes every couple of seconds, sorted by CPU usage by default, so the busiest process floats to the top. Press M to sort by memory, P back to CPU, k to kill a PID, and q to quit. The header shows load average, total memory, and a per-core breakdown.

htop is the same idea with a far nicer interface - color, mouse support, scrolling, and tree view - if it is installed or you can apt install htop:

htop

Reach for top or htop when the question is what is using resources right now, and ps when the question is what exists at this instant, maybe to grep for one thing. Live monitoring versus a static list - that is the split between them.

Finding what holds a port

The single most common reason to list processes: something says address already in use and you need to know what is squatting on the port. ss answers it:

ss -tulpn                 # all listening TCP/UDP ports with PIDs
ss -tulpn | grep :8080    # what is on 8080?

The flags: -t TCP, -u UDP, -l listening, -p show the process, -n numeric (no slow name lookups). The output gives you the PID and program holding the port.

lsof answers the same question a different way:

lsof -i :8080             # what is using port 8080
lsof -i -P -n             # all network connections, numeric

Both get you from a port to the PID that owns it, which is exactly what you need to free the port - find the PID, then stop that process. ss has largely replaced the older netstat; if a guide tells you netstat -tulpn, ss -tulpn is the modern equivalent and is what ships on current distributions.

Filtering and sorting ps

ps can sort and select without piping to other tools, which is handy for finding resource hogs:

ps aux --sort=-%cpu | head       # top CPU users
ps aux --sort=-%mem | head       # top memory users
ps -ef                           # another common full-listing format
ps -p 1234 -o pid,stat,comm      # specific PID, specific columns

--sort=-%cpu sorts descending by CPU so the heaviest process is first; head trims to the top few. This is the quick what is using the most memory question answered in one line, without opening top.

The -o flag lets you choose exactly which columns you want, which is useful in scripts where you need just the PID and state. Between ps aux for the human-readable snapshot, ps --sort for finding hogs, pgrep for by-name lookup, top/htop for live monitoring, and ss/lsof for ports, you have a tool for every process question - and knowing which one fits is faster than forcing ps | grep to do all of them.

How this fits the rest of the stack

Listing processes and hunting for what holds a port is the daily grind of running things on a server yourself. A platform that shows you running services, their resource use, and their logs in one view is doing the ps, top, and ss work for you - so the question becomes read a dashboard, not remember five flag combinations. The RunxBuild hosting calculator lays out the service, database, storage, and bandwidth as separate line items, and the RunxBuild dashboard is where the team watches deploys, logs, and restarts as they happen.

Useful related references:

FAQ

How do I list all running processes in Linux?

Run ps aux for a full one-time snapshot of every process, showing owner, PID, CPU and memory use, state, and command. For a live updating view use top or htop, and to find a process by name use pgrep -a name rather than ps aux | grep name.

What is the difference between ps and top?

ps gives a static snapshot of processes at the instant you run it. top (and htop) give a live, continuously updating view sorted by resource use. Use ps to list or grep for what exists, and top/htop to watch what is using CPU or memory right now.

How do I find which process is using a port in Linux?

Run ss -tulpn | grep :8080 to see the listening process and its PID on that port, or lsof -i :8080 for the same answer a different way. This is how you resolve an address-already-in-use error - find the PID, then stop that process.

Why does ps aux grep show an extra grep line?

Because the grep command matches its own text in the process list, so you see the grep process itself as an extra result. Use pgrep -a name instead, which searches process names directly and does not match its own invocation.

How do I find the processes using the most CPU or memory?

Use ps aux --sort=-%cpu | head for the top CPU users or ps aux --sort=-%mem | head for the top memory users. The leading minus sorts descending, and head trims to the heaviest few - a quick alternative to opening top.