ps while being only two letters is a massively complex, complicated and powerful tool.

per default it outputs all running processes sorted for Process ID (PID) but you can change that sorting.

here are the „ps info page/man“

ps.info.txt

ps --help all; # gives detailed info about usage

and some help instructions:

ps-help-all.txt

examples:

(the only thing that actually helps :-D)

#Usage:
# ps [options]
#
# Try 'ps --help <simple|list|output|threads|misc|all>'
#  or 'ps --help <s|l|o|t|m|a>'
# for additional help text.

# task is to output all processes

#       To see every process on the system using standard syntax:
#          ps -e
#          ps -ef
#          ps -eF
#          ps -ely

ps -ely |wc -l
131 <- this command prints out lines

#       To see every process on the system using BSD syntax:
#          ps ax
#          ps axu

ps uax|wc -l
129 <- this command prints out lines

so what is the difference? basically the difference is uax gives more details and different formatting

comparison-ps-uax-vs-ps-ely

# example output
S   UID   PID  PPID  C PRI  NI   RSS    SZ WCHAN  TTY          TIME CMD
S     0     1     0  0  80   0  3788  7201 -      ?        00:00:02 systemd
S     0     2     0  0  80   0     0     0 -      ?        00:00:00 kthreadd
S     0     3     2  0  80   0     0     0 -      ?        00:00:02 ksoftirqd/0
S     0     5     2  0  60 -20     0     0 -      ?        00:00:00 kworker/0:0H
S     0     7     2  0  80   0     0     0 -      ?        00:00:10 rcu_sched
S     0     8     2  0  80   0     0     0 -      ?        00:00:00 rcu_bh
S     0     9     2  0 -40   -     0     0 -      ?        00:00:00 migration/0
S     0    10     2  0 -40   -     0     0 -      ?        00:00:07 watchdog/0
S     0    11     2  0  60 -20     0     0 -      ?        00:00:00 khelper
S     0    12     2  0  80   0     0     0 -      ?        00:00:00 kdevtmpfs
S     0    13     2  0  60 -20     0     0 -      ?        00:00:00 netns
S     0    14     2  0  80   0     0     0 -      ?        00:00:00 khungtaskd
S     0    15     2  0  60 -20     0     0 -      ?        00:00:00 writeback
S     0    16     2  0  85   5     0     0 -      ?        00:00:00 ksmd
S     0    17     2  0  99  19     0     0 -      ?        00:00:00 khugepaged
S     0    18     2  0  60 -20     0     0 -      ?        00:00:00 crypto
S     0    19     2  0  60 -20     0     0 -      ?        00:00:00 kintegrityd
S     0    20     2  0  60 -20     0     0 -      ?        00:00:00 bioset
S     0    21     2  0  60 -20     0     0 -      ?        00:00:00 kblockd
S     0    23     2  0  80   0     0     0 -      ?        00:00:00 kworker/u2:1
S     0    26     2  0  80   0     0     0 -      ?        00:00:16 kswapd0
S     0    27     2  0  60 -20     0     0 -      ?        00:00:00 vmstat
S     0    28     2  0  80   0     0     0 -      ?        00:00:00 fsnotify_mark
S     0    34     2  0  60 -20     0     0 -      ?        00:00:00 kthrotld
...

show process tree

ps axjf; # print process tree, also very nice
 PPID   PID  PGID   SID TTY      TPGID STAT   UID   TIME COMMAND
    0     2     0     0 ?           -1 S        0   0:00 [kthreadd]
    2     3     0     0 ?           -1 S        0   0:00  \_ [ksoftirqd/0]
    2     5     0     0 ?           -1 S<       0   0:00  \_ [kworker/0:0H]
    2     7     0     0 ?           -1 S        0   0:00  \_ [rcu_sched]
    2     8     0     0 ?           -1 S        0   0:00  \_ [rcu_bh]
...
  860   884   884   884 tty7       884 Ss+      0   0:18  \_ /usr/bin/X :0 -seat seat0 -auth /var/run/lightdm/root/:0 -nolisten tcp vt7 -novtswitch
  860  1191   860   860 ?           -1 Sl       0   0:00  \_ lightdm --session-child 13 22
 1191  1203  1203  1203 ?           -1 Ssl   1000   0:00      \_ x-session-manager
 1203  1226  1226  1226 ?           -1 Ss    1000   0:00          \_ /usr/bin/ssh-agent /usr/bin/dbus-launch --exit-with-session x-session-manager
 1203  1241  1203  1203 ?           -1 Sl    1000   0:00          \_ /usr/bin/mate-settings-daemon
 1203  1243  1203  1203 ?           -1 Sl    1000   0:01          \_ marco
 1203  1248  1203  1203 ?           -1 Sl    1000   0:03          \_ mate-panel
 1248  1594  1203  1203 ?           -1 S     1000   0:00          |   \_ xterm -class UXTerm -title uxterm -u8
 1594  1598  1598  1598 pts/0     1869 Ss    1000   0:00          |   |   \_ bash
 1598  1869  1869  1598 pts/0     1869 S+    1000   0:00          |   |       \_ ssh -v username@sshserver
 1248  1691  1203  1203 ?           -1 Sl    1000   1:32          |   \_ firefox-esr
 1248  1744  1203  1203 ?           -1 Sl    1000   0:30          |   \_ icedove
 1248  1836  1203  1203 ?           -1 Sl    1000   0:35          |   \_ vlc
 1248  1852  1203  1203 ?           -1 Sl    1000   0:01          |   \_ python /usr/bin/streamtuner2
 1248  1924  1203  1203 ?           -1 S     1000   0:00          |   \_ xterm -class UXTerm -title uxterm -u8
 1924  1928  1928  1928 pts/2     2072 Ss    1000   0:00          |       \_ bash
 1928  2072  2072  1928 pts/2     2072 R+    1000   0:00          |           \_ ps axjf
 1203  1260  1203  1203 ?           -1 Sl    1000   0:00          \_ caja
 1203  1266  1203  1203 ?           -1 Sl    1000   0:00          \_ /usr/bin/python /usr/share/system-config-printer/applet.py
 1203  1268  1203  1203 ?           -1 Sl    1000   0:00          \_ mate-volume-control-applet
 1203  1270  1203  1203 ?           -1 Sl    1000   0:00          \_ nm-applet
 1203  1277  1203  1203 ?           -1 Sl    1000   0:00          \_ mate-power-manager
 1203  1280  1203  1203 ?           -1 Sl    1000   0:00          \_ mate-screensaver
 1203  1281  1203  1203 ?           -1 Sl    1000   0:00          \_ /usr/lib/i386-linux-gnu/polkit-mate/polkit-mate-authentication-agent-1
 1203  1283  1203  1203 ?           -1 Sl    1000   0:14          \_ psensor

what about sorting?

       k spec Specify sorting order.  Sorting syntax is
              [+|-]key[,[+|-]key[,...]].  Choose a multi-letter key from the

              STANDARD FORMAT SPECIFIERS section.  The "+" is optional since
              default direction is increasing numerical or lexicographic
              order.  Identical to --sort.

                      Examples:
                      ps jaxkuid,-ppid,+pid
                      ps axk comm o comm,args
                      ps kstart_time -ef

       --lines n
              Set screen height.

this is kind of complicated.

examples:

sorts for „start time“

😀 so you actually know in what timely order the processes were started

ps kstart_time -ef

# example output
UID        PID  PPID  C STIME TTY      STAT   TIME CMD
root         1     0  0 15:56 ?        Ss     0:01 /sbin/init
root         2     0  0 15:56 ?        S      0:00 [kthreadd]
root         3     2  0 15:56 ?        S      0:00 [ksoftirqd/0]
root         5     2  0 15:56 ?        S<     0:00 [kworker/0:0H]
root         7     2  0 15:56 ?        S      0:00 [rcu_sched]
root         8     2  0 15:56 ?        S      0:00 [rcu_bh]
...
username  1691  1248  8 16:03 ?        Sl     3:56 firefox-esr
username  1744  1248  1 16:03 ?        Sl     0:35 icedove
username  1836  1248  3 16:04 ?        Sl     1:38 vlc
root      1915     2  0 16:11 ?        S      0:00 [kworker/1:1]
root      1917     2  0 16:11 ?        S      0:00 [kworker/3:0]
username  1924  1248  0 16:16 ?        S      0:00 xterm -class UXTerm -title uxterm -u8
username  1928  1924  0 16:16 pts/2    Ss     0:00 bash
username  2083  1248  0 16:23 ?        Sl     0:01 pluma
username  2142     1  0 16:31 ?        Sl     0:00 mate-screenshot
username  2150  2142  0 16:31 ?        S      0:00 mate-screenshot

sorts for „CPU/RAM/CPU-TIME USAGE“

ps uax --sort cputime; # sort processes for cpu time (cumulated cpu usage)
ps uax --sort %cpu; # sort for current cpu usage
ps uax --sort %mem; # sort for current ram usage

keys you can sort for: (some keys not available for sorting)

       Some keywords may not be available for sorting.


       CODE        HEADER    DESCRIPTION

       %cpu        %CPU      cpu utilization of the process in "##.#" format.
                             Currently, it is the CPU time used divided by the
                             time the process has been running
                             (cputime/realtime ratio), expressed as a
                             percentage.  It will not add up to 100% unless
                             you are lucky.  (alias pcpu).

       %mem        %MEM      ratio of the process's resident set size  to the
                             physical memory on the machine, expressed as a
                             percentage.  (alias pmem).

       args        COMMAND   command with all its arguments as a string.
                             Modifications to the arguments may be shown.  The
                             output in this column may contain spaces.  A
                             process marked <defunct> is partly dead, waiting
                             to be fully destroyed by its parent.  Sometimes
                             the process args will be unavailable; when this
                             happens, ps will instead print the executable
                             name in brackets.  (alias cmd, command).  See
                             also the comm format keyword, the -f option, and
                             the c option.
                             When specified last, this column will extend to
                             the edge of the display.  If ps can not determine
                             display width, as when output is redirected
                             (piped) into a file or another command, the
                             output width is undefined (it may be 80,
                             unlimited, determined by the TERM variable, and
                             so on).  The COLUMNS environment variable or
                             --cols option may be used to exactly determine
                             the width in this case.  The w or -w option may
                             be also be used to adjust width.

       blocked     BLOCKED   mask of the blocked signals, see signal(7).
                             According to the width of the field, a 32 or
                             64-bit mask in hexadecimal format is displayed.
                             (alias sig_block, sigmask).

       bsdstart    START     time the command started.  If the process was
                             started less than 24 hours ago, the output format
                             is " HH:MM", else it is " Mmm:SS" (where Mmm is
                             the three letters of the month).  See also
                             lstart, start, start_time, and stime.

       bsdtime     TIME      accumulated cpu time, user + system.  The display
                             format is usually "MMM:SS", but can be shifted to
                             the right if the process used more than 999
                             minutes of cpu time.

       c           C         processor utilization. Currently, this is the
                             integer value of the percent usage over the
                             lifetime of the process.  (see %cpu).

       caught      CAUGHT    mask of the caught signals, see signal(7).
                             According to the width of the field, a 32 or 64
                             bits mask in hexadecimal format is displayed.
                             (alias sig_catch, sigcatch).


       cgroup      CGROUP    display control groups to which the process
                             belongs.

       class       CLS       scheduling class of the process.  (alias
                             policy, cls).  Field'
s possible values are:

                                      -   not reported
                                      TS  SCHED_OTHER
                                      FF  SCHED_FIFO
                                      RR  SCHED_RR
                                      B   SCHED_BATCH
                                      ISO SCHED_ISO
                                      IDL SCHED_IDLE
                                      ?   unknown value

       cls         CLS       scheduling class of the process.  (alias
                             policy, cls).  Field's possible values are:

                                      -   not reported
                                      TS  SCHED_OTHER
                                      FF  SCHED_FIFO
                                      RR  SCHED_RR
                                      B   SCHED_BATCH
                                      ISO SCHED_ISO
                                      IDL SCHED_IDLE
                                      ?   unknown value

       cmd         CMD       see args.  (alias args, command).

       comm        COMMAND   command name (only the executable name).
                             Modifications to the command name will not be
                             shown.  A process marked <defunct> is partly
                             dead, waiting to be fully destroyed by its
                             parent.  The output in this column may contain
                             spaces.  (alias ucmd, ucomm).  See also the args
                             format keyword, the -f option, and the c option.
                             When specified last, this column will extend to
                             the edge of the display.  If ps can not determine
                             display width, as when output is redirected
                             (piped) into a file or another command, the
                             output width is undefined (it may be 80,
                             unlimited, determined by the TERM variable, and
                             so on).  The COLUMNS environment variable or
                             --cols option may be used to exactly determine
                             the width in this case.  The w or -w option may
                             be also be used to adjust width.

       command     COMMAND   See args.  (alias args, command).

       cp          CP        per-mill (tenths of a percent) CPU usage.  (see
                             %cpu).

       cputime     TIME      cumulative CPU time, "[DD-]hh:mm:ss" format.
                             (alias time).

       egid        EGID      effective group ID number of the process as a
                             decimal integer.  (alias gid).

       egroup      EGROUP    effective group ID of the process.  This will be
                             the textual group ID, if it can be obtained and
                             the field width permits, or a decimal
                             representation otherwise.  (alias group).

       eip         EIP       instruction pointer.

       esp         ESP       stack pointer.



       etime       ELAPSED   elapsed time since the process was started, in
                             the form [[DD-]hh:]mm:ss.

       etimes      ELAPSED   elapsed time since the process was started, in
                             seconds.

       euid        EUID      effective user ID (alias uid).

       euser       EUSER     effective user name.  This will be the textual
                             user ID, if it can be obtained and the field
                             width permits, or a decimal representation
                             otherwise.  The n option can be used to force the
                             decimal representation.  (alias uname, user).

       f           F         flags associated with the process, see the
                             PROCESS FLAGS section.  (alias flag, flags).

       fgid        FGID      filesystem access group ID.  (alias fsgid).

       fgroup      FGROUP    filesystem access group ID.  This will be the
                             textual group ID, if it can be obtained and the
                             field width permits, or a decimal representation
                             otherwise.  (alias fsgroup).

       flag        F         see f.  (alias f, flags).

       flags       F         see f.  (alias f, flag).

       fname       COMMAND   first 8 bytes of the base name of the process'
s
                             executable file.  The output in this column may
                             contain spaces.

       fuid        FUID      filesystem access user ID.  (alias fsuid).

       fuser       FUSER     filesystem access user ID.  This will be the
                             textual user ID, if it can be obtained and the
                             field width permits, or a decimal representation
                             otherwise.

       gid         GID       see egid.  (alias egid).

       group       GROUP     see egroup.  (alias egroup).

       ignored     IGNORED   mask of the ignored signals, see signal(7).
                             According to the width of the field, a 32 or 64
                             bits mask in hexadecimal format is displayed.
                             (alias sig_ignore, sigignore).

       ipcns       IPCNS     Unique inode number describing the namespace the
                             process belongs to. See namespaces(7).

       label       LABEL     security label, most commonly used for SELinux
                             context data.  This is for the Mandatory Access
                             Control ("MAC") found on high-security systems.

       lstart      STARTED   time the command started.  See also
                             bsdstart, start, start_time, and stime.

       lsession    SESSION   displays login session identifier of a process.

       lwp         LWP       light weight process (thread) ID of the
                             dispatchable entity (alias spid, tid).  See tid
                             for additional information.

       machine     MACHINE   displays machine name for processes assigned to
                             VM or container.



       maj_flt     MAJFLT    The number of major page faults that have
                             occurred with this process.

       min_flt     MINFLT    The number of minor page faults that have
                             occurred with this process.

       mntns       MNTNS     Unique inode number describing the namespace the
                             process belongs to. See namespaces(7).

       netns       NETNS     Unique inode number describing the namespace the
                             process belongs to. See namespaces(7).

       ni          NI        nice value. This ranges from 19 (nicest) to -20
                             (not nice to others), see nice(1).  (alias nice).

       nice        NI        see ni.(alias ni).

       nlwp        NLWP      number of lwps (threads) in the process.  (alias
                             thcount).

       nwchan      WCHAN     address of the kernel function where the process
                             is sleeping (use wchan if you want the kernel
                             function name).  Running tasks will display a
                             dash ('-') in this column.

       ouid        OWNER     displays the Unix user identifier of the owner of
                             the session of a process.

       pcpu        %CPU      see %cpu.  (alias %cpu).

       pending     PENDING   mask of the pending signals. See signal(7).
                             Signals pending on the process are distinct from
                             signals pending on individual threads.  Use the m
                             option or the -m option to see both.  According
                             to the width of the field, a 32 or 64 bits mask
                             in hexadecimal format is displayed.  (alias sig).

       pgid        PGID      process group ID or, equivalently, the process ID
                             of the process group leader.  (alias pgrp).

       pgrp        PGRP      see pgid.  (alias pgid).

       pid         PID       a number representing the process ID (alias
                             tgid).

       pidns       PIDNS     Unique inode number describing the namespace the
                             process belongs to. See namespaces(7).

       pmem        %MEM      see %mem.  (alias %mem).

       policy      POL       scheduling class of the process.  (alias
                             class, cls).  Possible values are:

                                      -   not reported
                                      TS  SCHED_OTHER
                                      FF  SCHED_FIFO
                                      RR  SCHED_RR
                                      B   SCHED_BATCH
                                      ISO SCHED_ISO
                                      IDL SCHED_IDLE
                                      ?   unknown value

       ppid        PPID      parent process ID.

       pri         PRI       priority of the process.  Higher number means
                             lower priority.

       psr         PSR       processor that process is currently assigned to.


       rgid        RGID      real group ID.

       rgroup      RGROUP    real group name.  This will be the textual group
                             ID, if it can be obtained and the field width
                             permits, or a decimal representation otherwise.

       rss         RSS       resident set size, the non-swapped physical
                             memory that a task has used (inkiloBytes).
                             (alias rssize, rsz).

       rssize      RSS       see rss.  (alias rss, rsz).

       rsz         RSZ       see rss.  (alias rss, rssize).

       rtprio      RTPRIO    realtime priority.

       ruid        RUID      real user ID.

       ruser       RUSER     real user ID.  This will be the textual user ID,
                             if it can be obtained and the field width
                             permits, or a decimal representation otherwise.

       s           S         minimal state display (one character).  See
                             section PROCESS STATE CODES for the different
                             values.  See also stat if you want additional
                             information displayed.  (alias state).

       sched       SCH       scheduling policy of the process.  The policies
                             SCHED_OTHER (SCHED_NORMAL), SCHED_FIFO, SCHED_RR,
                             SCHED_BATCH, SCHED_ISO, and SCHED_IDLE are
                             respectively displayed as 0, 1, 2, 3, 4, and 5.

       seat        SEAT      displays login session identifier of a process.

       sess        SESS      session ID or, equivalently, the process ID of
                             the session leader.  (alias session, sid).

       sgi_p       P         processor that the process is currently executing
                             on.  Displays "*" if the process is not currently
                             running or runnable.

       sgid        SGID      saved group ID.  (alias svgid).

       sgroup      SGROUP    saved group name.  This will be the textual group
                             ID, if it can be obtained and the field width
                             permits, or a decimal representation otherwise.

       sid         SID       see sess.  (alias sess, session).

       sig         PENDING   see pending.  (alias pending, sig_pend).

       sigcatch    CAUGHT    see caught.  (alias caught, sig_catch).

       sigignore   IGNORED   see ignored.  (alias ignored, sig_ignore).

       sigmask     BLOCKED   see blocked.  (alias blocked, sig_block).

       size        SIZE      approximate amount of swap space that would be
                             required if the process were to dirty all
                             writable pages and then be swapped out.  This
                             number is very rough!

       slice       SLICE     displays slice unit which a process belongs to.

       spid        SPID      see lwp.  (alias lwp, tid).



       stackp      STACKP    address of the bottom (start) of stack for the
                             process.

       start       STARTED   time the command started.  If the process was
                             started less than 24 hours ago, the output format
                             is "HH:MM:SS", else it is "  Mmm dd" (where Mmm
                             is a three-letter month name).  See also
                             lstart, bsdstart, start_time, and stime.

       start_time  START     starting time or date of the process.  Only the
                             year will be displayed if the process was not
                             started the same year ps was invoked, or "MmmDD"
                             if it was not started the same day, or "HH:MM"
                             otherwise.  See also bsdstart, start, lstart,
                             and stime.

       stat        STAT      multi-character process state.  See section
                             PROCESS STATE CODES for the different values
                             meaning.  See also s and state if you just want
                             the first character displayed.

       state       S         see s. (alias s).

       suid        SUID      saved user ID.  (alias svuid).

       supgid      SUPGID    group ids of supplementary groups, if any.  See
                             getgroups(2).

       supgrp      SUPGRP    group names of supplementary groups, if any.  See
                             getgroups(2).

       suser       SUSER     saved user name.  This will be the textual user
                             ID, if it can be obtained and the field width
                             permits, or a decimal representation otherwise.
                             (alias svuser).

       svgid       SVGID     see sgid.  (alias sgid).

       svuid       SVUID     see suid.  (alias suid).

       sz          SZ        size in physical pages of the core image of the
                             process.  This includes text, data, and stack
                             space.  Device mappings are currently excluded;
                             this is subject to change.  See vsz and rss.

       tgid        TGID      a number representing the thread group to which a
                             task belongs (alias pid).  It is the process ID
                             of the thread group leader.

       thcount     THCNT     see nlwp.  (alias nlwp).  number of kernel
                             threads owned by the process.

       tid         TID       the unique number representing a dispatacable
                             entity (alias lwp, spid).  This value may also
                             appear as: a process ID (pid); a process group ID
                             (pgrp); a session ID for the session leader
                             (sid); a thread group ID for the thread group
                             leader (tgid); and a tty process group ID for the
                             process group leader (tpgid).

       time        TIME      cumulative CPU time, "[DD-]HH:MM:SS" format.
                             (alias cputime).

       tname       TTY       controlling tty (terminal).  (alias tt, tty).

       tpgid       TPGID     ID of the foreground process group on the tty
                             (terminal) that the process is connected to, or
                             -1 if the process is not connected to a tty.


       tt          TT        controlling tty (terminal).  (alias tname, tty).

       tty         TT        controlling tty (terminal).  (alias tname, tt).

       ucmd        CMD       see comm.  (alias comm, ucomm).

       ucomm       COMMAND   see comm.  (alias comm, ucmd).

       uid         UID       see euid.  (alias euid).

       uname       USER      see euser.  (alias euser, user).

       unit        UNIT      displays systemd unit which a process belongs to.

       user        USER      see euser.  (alias euser, uname).

       userns      USERNS    Unique inode number describing the namespace the
                             process belongs to. See namespaces(7).

       utsns       UTSNS     Unique inode number describing the namespace the
                             process belongs to. See namespaces(7).

       uunit       UUNIT     displays systemd user unit which a process
                             belongs to.

       vsize       VSZ       see vsz.  (alias vsz).

       vsz         VSZ       virtual memory size of the process in KiB
                             (1024-byte units).  Device mappings are currently
                             excluded; this is subject to change.  (alias
                             vsize).

       wchan       WCHAN     name of the kernel function in which the process
                             is sleeping, a "-" if the process is running, or
                             a "*" if the process is multi-threaded and ps is
                             not displaying threads.

sort and format output of ps

# will display
# 1. in the first row mem in percent (pmem)
# 2. in the second row current cpu usage in percent (pcpu)
# 3. in the third row will display cpu usage in percent (pcpu)
# 4. in the fourth row display "resident set size"
#       rss         RSS       resident set size, the non-swapped physical
#                             memory that a task has used (inkiloBytes).
#                             (alias rssize, rsz).

# 5. in the fifth row display "virtual memory size"
#        vsz         VSZ       virtual memory size of the process in KiB
#                             (1024-byte units).  Device mappings are currently
#                             excluded; this is subject to change.  (alias vsize).

# args = display the arguments the process was started with

# --sort %mem; -> sort the whole thing for percentage of ram used by the process

ps -eo pmem,pcpu,rss,vsize,args --sort %mem;

alternative: top: sorts for „CPU/RAM/CPU-TIME USAGE“

# live monitoring of CPU usage
top -o %CPU;

# output CPU usage to file
top -b -n1 -o %CPU > cpu.usage.log;

# live monitoring of RAM usage
top -o %MEM;

# output RAM usage to file
top -b -n1 -o %MEM > ram.usage.log;

# live monitoring of what process used most CPU-TIME
top -o TIME+;

# output of what process used most CPU-TIME
top -b -n1 -o TIME+ > cpu_time.usage.log;
admin