Linux System Hogs and Child Processes

http://www.linux.com/learn/docs/691117-linux-system-hogs-and-child-processes


There are a lot of good old Linux commands to see what's happening inside your system, with all the power and flexibility you need to zero in on just the information you want. Want to see who is sucking up the most resources on your computer? You can use the good old ps command. This example lists the top 7 hogs, excluding your own processes:

$ ps aux  --sort=-%cpu | grep -m 8 -v `whoami`
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root      1558  4.1  1.6 193620 68532 tty8     Rs+  07:05  16:10 /usr/bin/X 
root        55  0.0  0.0      0     0 ?        S    07:05   0:21 [kswapd0]
root      7615  0.0  0.0      0     0 ?        S    12:06   0:02 [kworker/2:0]
root      1772  0.0  0.0      0     0 ?        S    07:05   0:10 [flush-8:16]
mysql     1262  0.0  4.5 549912 185232 ?       Ssl  07:05   0:10 /usr/sbin/mysqld
root      9478  0.0  0.0      0     0 ?        S    12:54   0:00 [kworker/1:1]
root      9832  0.0  0.0      0     0 ?        S    13:25   0:00 [kworker/0:1]

You can modify this particular incantation to sort by any ps category, like this example that displays the seven biggest memory users (that are not you):

$ ps aux  --sort=-%mem | grep -m 8 -v `whoami`
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
mysql     1262  0.0  4.5 549912 185232 ?       Ssl  07:05   0:12 /usr/sbin/mysqld
root      1558  4.0  1.7 197268 72352 tty8     Ss+  07:05  18:10 /usr/bin/X 
root      1310  0.0  1.3 122728 53032 ?        Ss   07:05   0:05 /usr/sbin/spamd 
root      1329  0.0  1.2 122728 52164 ?        S    07:05   0:00 spamd child
root      1328  0.0  1.2 122728 52140 ?        S    07:05   0:00 spamd child
root      3156  0.0  0.2  95320 10204 ?        S    08:53   0:00 /usr/bin/python 
root      1559  0.0  0.2 311480  8156 ?        Ss   07:05   0:00 /usr/sbin/apache2 -k start

Or who has been running the longest:

$ ps aux  --sort=-time | grep -m 8 -v `whoami`
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root      1558  4.0  1.7 197268 72352 tty8     Ss+  07:05  18:12 /usr/bin/X
root        55  0.0  0.0      0     0 ?        S    07:05   0:21 [kswapd0]
mysql     1262  0.0  4.5 549912 185232 ?       Ssl  07:05   0:12 /usr/sbin/mysqld
root      1772  0.0  0.0      0     0 ?        S    07:05   0:11 [flush-8:16]
root         3  0.0  0.0      0     0 ?        S    07:05   0:05 [ksoftirqd/0]
root      1310  0.0  1.3 122728 53032 ?        Ss   07:05   0:05 /usr/sbin/spamd 
root       845  0.0  0.0      0     0 ?        S    07:05   0:03 [jbd2/sdb3-8]

You might have noticed that to get 7 results, you need to use grep -m 8. I shall leave it as your homework to read man grep to learn why.
The ps command has some built-in sorting options. ps aux displays all running processes, and the users they belong to. You can view processes per user with the -U option:

$ ps -U carla

Or multiple users:

$ ps  -U postfix -U mysql

Child processes? Piglet processes!
You can see all child processes:

$ ps -eo pid,args --forest
[...]
  397 /sbin/udevd --daemon
 9900  \_ /sbin/udevd --daemon
 9901  \_ /sbin/udevd --daemon
  815 upstart-socket-bridge --daemon
  881 smbd -F
  896  \_ smbd -F
  884 /usr/sbin/sshd -D
[...]

Or all child processes of a particular process:

$ ps -f --ppid 1559
UID        PID  PPID  C STIME TTY          TIME CMD
www-data  1576  1559  0 07:05 ?        00:00:00 /usr/sbin/apache2 -k start
www-data  1577  1559  0 07:05 ?        00:00:00 /usr/sbin/apache2 -k start
www-data  1578  1559  0 07:05 ?        00:00:00 /usr/sbin/apache2 -k start
www-data  1579  1559  0 07:05 ?        00:00:00 /usr/sbin/apache2 -k start
www-data  1580  1559  0 07:05 ?        00:00:00 /usr/sbin/apache2 -k start
www-data  9526  1559  0 13:00 ?        00:00:00 /usr/sbin/apache2 -k start

Please read man ps, man sort, and man grep to learn more.