1
00:00:06,420 --> 00:00:08,100
- So we have seen the top utility

2
00:00:08,100 --> 00:00:11,580
and the top utility really
is very common utility.

3
00:00:11,580 --> 00:00:14,700
But there's another utility
that's important when it comes

4
00:00:14,700 --> 00:00:18,123
down to managing processes and that's ps.

5
00:00:19,170 --> 00:00:23,223
Ps is what you used to find
properties about your processes.

6
00:00:24,090 --> 00:00:27,440
So you can use your own
ps as the main command

7
00:00:27,440 --> 00:00:32,130
to show running processes, but
it'll only give you processes

8
00:00:32,130 --> 00:00:34,170
for your current user account.

9
00:00:34,170 --> 00:00:37,800
If you wanna see all
processes, use ps aux.

10
00:00:37,800 --> 00:00:39,240
That'll show all processes,

11
00:00:39,240 --> 00:00:42,453
including the most useful
information about these processes.

12
00:00:43,410 --> 00:00:46,740
The A is for all the U is showing users,

13
00:00:46,740 --> 00:00:48,750
the user that has started the process,

14
00:00:48,750 --> 00:00:52,320
and the X is showing some
additional information.

15
00:00:52,320 --> 00:00:54,000
Notice that in ps aux

16
00:00:54,000 --> 00:00:56,490
we don't have a hyphen
in front of the aux.

17
00:00:56,490 --> 00:00:57,900
And that is because ps

18
00:00:57,900 --> 00:01:02,400
by default is BSD style, Linux command.

19
00:01:02,400 --> 00:01:04,803
Like we have seen for
the tar command earlier.

20
00:01:05,670 --> 00:01:08,250
Ps fax is quite convenient as well.

21
00:01:08,250 --> 00:01:11,790
It'll show you parent-child
relations between processes.

22
00:01:11,790 --> 00:01:13,920
And that is convenient because

23
00:01:13,920 --> 00:01:15,810
if you are killing a parent process,

24
00:01:15,810 --> 00:01:18,570
normally you would kill the
child processes as well.

25
00:01:18,570 --> 00:01:22,290
So if you wanna be careful
about process management,

26
00:01:22,290 --> 00:01:25,981
you better investigate
having a look at ps fax

27
00:01:25,981 --> 00:01:30,483
to see if there are any
children available as well.

28
00:01:31,800 --> 00:01:33,750
Now ps can be used with many other options

29
00:01:33,750 --> 00:01:37,800
to display specific properties
only and apply filtering.

30
00:01:37,800 --> 00:01:40,590
Honestly, it's so many that
you probably are better

31
00:01:40,590 --> 00:01:42,060
off using the top utility,

32
00:01:42,060 --> 00:01:44,790
because in top you can
also see these properties

33
00:01:44,790 --> 00:01:46,650
in a context that makes sense,

34
00:01:46,650 --> 00:01:49,653
context that is based
on busiest processes.

35
00:01:50,730 --> 00:01:53,430
You should consider piping
ps output to other tools

36
00:01:53,430 --> 00:01:57,210
like awk and sort to filter
and sort specific output.

37
00:01:57,210 --> 00:01:59,760
And that is how you will normally use it.

38
00:01:59,760 --> 00:02:01,260
You want to monitor HCTP.

39
00:02:01,260 --> 00:02:02,880
You want to know if your web service

40
00:02:02,880 --> 00:02:04,320
is up and running.

41
00:02:04,320 --> 00:02:05,730
Now, what are you going to do?

42
00:02:05,730 --> 00:02:08,217
Well, ps aux pipe, grab HCTP.

43
00:02:08,217 --> 00:02:10,770
And you will see whether
or not it is running,

44
00:02:10,770 --> 00:02:12,600
including all of the
properties that you need

45
00:02:12,600 --> 00:02:14,190
for further management.

46
00:02:14,190 --> 00:02:15,303
Let me demonstrate.

47
00:02:17,790 --> 00:02:21,930
So to start with, let me
do a ps aux pipe less,

48
00:02:21,930 --> 00:02:24,750
so that we can see the
header column as well.

49
00:02:24,750 --> 00:02:27,263
So we have the username. We have the PID.

50
00:02:27,263 --> 00:02:30,900
The PID is pretty important
for managing the process.

51
00:02:30,900 --> 00:02:33,831
The CPU use it, the memory use it,

52
00:02:33,831 --> 00:02:36,883
VSZ and RSS is about memory usage.

53
00:02:36,883 --> 00:02:41,340
TTY showing where the process is running.

54
00:02:41,340 --> 00:02:44,820
If it is running on a TTY,
we can see the status,

55
00:02:44,820 --> 00:02:47,700
where an S is what you see most frequently

56
00:02:47,700 --> 00:02:49,860
is for a sleeping process.

57
00:02:49,860 --> 00:02:52,737
You see start information, you see time,

58
00:02:52,737 --> 00:02:55,800
the that's the amount of time
that process has been running.

59
00:02:55,800 --> 00:03:00,150
And in the last column, you
see the command as well.

60
00:03:00,150 --> 00:03:02,220
User, PID, Command.

61
00:03:02,220 --> 00:03:05,490
That's the information
that you will be looking at

62
00:03:05,490 --> 00:03:07,680
in most cases.

63
00:03:07,680 --> 00:03:09,420
Now about ps fax.

64
00:03:09,420 --> 00:03:10,980
Well, if I use ps fax,

65
00:03:10,980 --> 00:03:15,450
we can see this hierarchical overview,

66
00:03:15,450 --> 00:03:17,430
like what we see here.

67
00:03:17,430 --> 00:03:19,950
Here we see there is this
known terminal server.

68
00:03:19,950 --> 00:03:22,350
The known terminal server
has a child process,

69
00:03:22,350 --> 00:03:23,657
which is bash,

70
00:03:23,657 --> 00:03:28,047
and that one is child processes
process, which is ps fax.

71
00:03:28,047 --> 00:03:28,950
And it means that

72
00:03:28,950 --> 00:03:32,040
if anything happens to
the known terminal server,

73
00:03:32,040 --> 00:03:35,550
that will have consequences
for all of the child processes.

74
00:03:35,550 --> 00:03:40,503
And that is why you might be
interested in using ps fax.

75
00:03:41,580 --> 00:03:44,670
Ps - ef, hey, suddenly we have a minus.

76
00:03:44,670 --> 00:03:45,503
Yes, it is right.

77
00:03:45,503 --> 00:03:48,900
Because ps has a nature as a BSD command,

78
00:03:48,900 --> 00:03:53,900
but it also has system
a five way of working.

79
00:03:54,180 --> 00:03:58,260
And if you want to display more
or less the same information

80
00:03:58,260 --> 00:04:01,290
using either BSD or system five dialect,

81
00:04:01,290 --> 00:04:03,750
you will see that the options
are completely different.

82
00:04:03,750 --> 00:04:07,170
So ps - ef is more or less compatible

83
00:04:07,170 --> 00:04:09,510
to what you have seen in ps aux,

84
00:04:09,510 --> 00:04:11,880
but it's a different approach.

85
00:04:11,880 --> 00:04:15,000
You can also apply
advanced filtering options,

86
00:04:15,000 --> 00:04:20,000
like ps - e - o pid, args -- forest

87
00:04:25,350 --> 00:04:28,950
which is showing PIDs
and the process forest,

88
00:04:28,950 --> 00:04:30,510
which is the tree like structure

89
00:04:30,510 --> 00:04:33,390
that we have just seen in ps fax as well,

90
00:04:33,390 --> 00:04:38,370
which allows you to display
parent and child relations.

91
00:04:38,370 --> 00:04:39,930
Ps has many options.

92
00:04:39,930 --> 00:04:41,460
There's one more that I want to show you.

93
00:04:41,460 --> 00:04:43,607
And that's ps aux -- sort pmem

94
00:04:47,703 --> 00:04:48,600
What is that?

95
00:04:48,600 --> 00:04:50,493
That's sorting on memory usage,

96
00:04:51,360 --> 00:04:54,390
where we can see that
the process that is using

97
00:04:54,390 --> 00:04:57,750
the largest amount of
memory is listed last.

98
00:04:57,750 --> 00:05:00,041
And that can be useful to figure out

99
00:05:00,041 --> 00:05:03,000
who is busiest on your system.

100
00:05:03,000 --> 00:05:05,520
I think this is enough about ps.

101
00:05:05,520 --> 00:05:07,770
There are so much more
that you can do with ps,

102
00:05:07,770 --> 00:05:10,410
but these options are not as important.

103
00:05:10,410 --> 00:05:14,340
As I said before, you probably
are better off using top

104
00:05:14,340 --> 00:05:18,213
if you want to find
advanced process properties.