Skip to content

Process information fields

Synopsis

ps -e -o FIELD[,FIELD…] [--sort=[+|-]FIELD]
ps -p PID -o FIELD[,FIELD…]
top -b -n 1 [-o FIELD]
/proc/<PID>/{status,stat,statm,cmdline,environ,cgroup,limits,io,fd/,task/,…}

Description

ps and top read their information from /proc, the kernel's process information filesystem. Each process has a directory /proc/<PID>/, where <PID> is its process ID; /proc/self/ refers to the process reading it. Each thread also has a directory /proc/<PID>/task/<TID>/ with the same files.

Most files are readable by every user. Files that reveal a process's memory or secrets (environ, mem, the targets of fd/ and cwd) need the reader to be the process's owner or root (precisely, to pass a ptrace access check). Mounting /proc with hidepid= hides other users' processes entirely; none of the distributions covered here do that by default.

Checked against procps-ng 4.0.4 (Debian 13, Ubuntu 26.04, AlmaLinux 10, Rocky Linux 10), 4.0.6 (Gentoo) and 4.0.7 (Arch Linux), and Linux 6.12 (Debian 13, AlmaLinux 10, Rocky Linux 10), 6.18 (Gentoo), 7.0 (Ubuntu 26.04) and 7.2 (Arch Linux), in November 2026.

ps output fields

Select fields with -o (for example ps -eo pid,user,stat,rss,comm). Append :WIDTH to widen a column (wchan:32, args:80), and = to suppress its header (pid=).

Identity

Field Header Content
pid PID Process ID (the thread group ID)
ppid PPID Parent's process ID
pgid PGID Process group ID
sid SID Session ID
tpgid TPGID Foreground process group of the controlling terminal; -1 if none
tty TT Controlling terminal; ? if none
user USER Effective user name (uid for the number)
ruser RUSER Real user name
lwp LWP Thread ID, with -L (one line per thread)
nlwp NLWP Number of threads
cgroup CGROUP Control group membership, as in /proc/<PID>/cgroup
label LABEL Security label, such as the SELinux context on RHEL, AlmaLinux and Rocky Linux

Command

Field Header Content
comm COMMAND Name of the executable, at most 15 characters (from /proc/<PID>/comm); kernel threads are shown by name
args COMMAND Full command line (from /proc/<PID>/cmdline); kernel threads, which have none, are shown in square brackets. Aliases: cmd, command

A program can change both comm and its own command line, so neither is proof of which file is running; /proc/<PID>/exe is.

State and scheduling

Field Header Content
stat STAT State code plus modifiers; see Process state codes
s S State code only
ni NI Nice value, from -20 (highest priority) to 19 (lowest); - for real-time tasks
pri PRI Priority as ps computes it; higher means more priority. Not the same scale as PR in top
cls CLS Scheduling class: TS (normal, SCHED_OTHER), FF (SCHED_FIFO), RR (SCHED_RR), B (SCHED_BATCH), IDL (SCHED_IDLE), DLN (SCHED_DEADLINE)
rtprio RTPRIO Real-time priority; - for normal tasks
psr PSR CPU the task last ran on
wchan WCHAN Kernel function the task is sleeping in; - if running

CPU and time

Field Header Content
%cpu %CPU CPU time used divided by the time the process has existed, as a percentage of one CPU. It's a lifetime average, not the current rate
time TIME Total CPU time used (user plus system), [DD-]HH:MM:SS
etime ELAPSED Time since the process started, [[DD-]hh:]mm:ss; etimes gives seconds
lstart STARTED Date and time the process started, in full
start STARTED Start time; only the date for processes started more than 24 hours ago

Memory

Field Header Content
rss RSS Resident set size: physical memory in use, in KiB, including shared pages such as libraries; excludes swapped-out pages
vsz VSZ Virtual memory size: all mapped address space, in KiB, whether used or not
%mem %MEM rss as a percentage of physical memory
pss PSS Proportional set size, in KiB: like rss, but each shared page counted as a fraction for each process sharing it (slow; reads smaps_rollup)
uss USS Unique set size, in KiB: memory not shared with any other process
maj_flt MAJFLT Major page faults: page accesses that needed a read from disk or swap
min_flt MINFLT Minor page faults: page accesses resolved without I/O

Common combinations

Command Shows
ps -ef Every process, System V style: UID PID PPID C STIME TTY TIME CMD
ps aux Every process, BSD style: USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
ps -ef --forest Every process as a tree
ps -eLf Every thread
ps -eo pid,stat,wchan:32,comm States and wait channels, for finding D tasks

--sort=-rss sorts in descending order of a field, --sort=rss in ascending order; several keys may be given, separated by commas.

Process state codes

Code Meaning
R Running, or runnable (on a run queue)
S Interruptible sleep: waiting for an event
D Uninterruptible sleep, usually waiting for I/O
T Stopped by a job-control signal
t Stopped by a debugger (tracing stop)
Z Zombie: terminated, but not yet reaped by its parent
I Idle kernel thread
X Dead (never normally seen)

Modifiers shown after the code by the stat field:

Modifier Meaning
< High priority (negative nice value)
N Low priority (positive nice value)
L Has pages locked in memory
s Session leader
l Multi-threaded
+ In the foreground process group of its terminal

top fields

Column Content
PID, USER As in ps
PR Scheduling priority as the kernel reports it: 20 plus the nice value for normal tasks, rt for the highest real-time priority
NI Nice value
VIRT Virtual memory, in KiB (as vsz)
RES Resident memory, in KiB (as rss)
SHR The part of RES that is shared (file-backed or shared memory)
S State code
%CPU Share of one CPU used during the last refresh interval; up to 100 per CPU for a multi-threaded process (Irix mode, the default)
%MEM RES as a percentage of physical memory
TIME+ Total CPU time, to hundredths of a second
COMMAND comm, or args after pressing c

The %Cpu(s) summary line divides all CPU time into us (user), sy (system), ni (user time of positive-nice processes), id (idle), wa (idle while I/O was outstanding), hi and si (hardware and software interrupts) and st (steal: time the hypervisor gave to other guests). -o FIELD sets the sort column in batch mode (top -b -n 1 -o %MEM); interactively, P, M and T sort by CPU, memory and time.

Files in /proc/<PID>/

File Content Readable by
status Human-readable summary; see status fields Everyone
stat One line of space-separated fields, used by ps and top; see stat fields Everyone
statm Memory sizes in pages: total, resident, shared, text, (unused), data + stack, (unused) Everyone
cmdline Command-line arguments, each ending in a NUL byte; empty for kernel threads and zombies Everyone
comm Executable name, up to 15 characters; writable by the process itself Everyone
environ Initial environment, NAME=value strings separated by NUL bytes; later changes made by the process aren't reflected Owner, root
exe Symbolic link to the executable file Owner, root
cwd Symbolic link to the current working directory Owner, root
root Symbolic link to the process's root directory (differs inside a chroot or container) Owner, root
fd/ One symbolic link per open file descriptor, named by its number, pointing to the file, socket:[INODE], pipe:[INODE] or anon_inode:… Owner, root
fdinfo/ Per-descriptor file offset, flags and, for some types, more detail Owner, root
limits Resource limits: soft and hard value and unit for each limit Everyone
cgroup Control group membership; one 0::<PATH> line with cgroup v2 Everyone
io I/O counters: rchar, wchar (bytes read and written through system calls), read_bytes, write_bytes (bytes that reached storage) Owner, root
maps Memory mappings: address range, permissions, offset, device, inode and path Owner, root
smaps, smaps_rollup Memory use per mapping, or totalled, including Rss, Pss, Swap Owner, root
oom_score Current badness score used by the OOM killer; higher means more likely to be killed Everyone
oom_score_adj Adjustment to the badness score, -1000 (never kill) to 1000; writable by root, or by the owner to raise it Everyone
ns/ Symbolic links identifying the process's namespaces Owner, root
task/ One directory per thread, named by thread ID Everyone
wchan Kernel function the process is sleeping in; shows 0 to readers without ptrace access Everyone

Example of reading a NUL-separated file:

$ tr '\0' ' ' < /proc/1/cmdline; echo
/sbin/init

status fields

Selected fields from /proc/<PID>/status, in the order they appear:

Field Content
Name As comm
Umask File creation mask, in octal
State State code and description, such as S (sleeping)
Tgid, Pid, PPid Thread group ID (the PID), thread ID, parent's PID
TracerPid PID of the process tracing this one (a debugger); 0 if none
Uid, Gid Real, effective, saved and filesystem user and group IDs
FDSize Number of file descriptor slots currently allocated
Groups Supplementary group IDs
NSpid The PID in each nested PID namespace, outermost first
VmPeak, VmSize Peak and current virtual memory size
VmHWM, VmRSS Peak and current resident set size
RssAnon, RssFile, RssShmem Resident anonymous memory, file mappings and shared memory; together VmRSS
VmData, VmStk, VmExe, VmLib Data, stack, executable and library mapping sizes
VmSwap Anonymous memory swapped out
Threads Number of threads
SigQ Queued signals, and the limit for the real user ID
SigPnd, ShdPnd, SigBlk, SigIgn, SigCgt Pending (thread, process), blocked, ignored and caught signals, as hexadecimal bit masks
CapInh, CapPrm, CapEff, CapBnd, CapAmb Capability sets, as hexadecimal bit masks
NoNewPrivs 1 if the process can't gain privileges through execve()
Seccomp 0 none, 1 strict, 2 filter mode
Cpus_allowed_list, Mems_allowed_list CPUs and memory nodes the process may use
voluntary_ctxt_switches, nonvoluntary_ctxt_switches Times the task gave up the CPU by blocking, and times it was preempted

Memory sizes are in kB (KiB).

stat fields

/proc/<PID>/stat is a single line. Field 2 is the command name in parentheses, and can itself contain spaces and parentheses, so parsers split the line at the last ). Selected fields, numbered from 1:

Number Field Content
1 pid Process ID
2 comm Command name, in parentheses
3 state State code
4 ppid Parent's PID
5 pgrp Process group ID
6 session Session ID
7 tty_nr Controlling terminal, as a device number
8 tpgid Foreground process group of the terminal
10, 12 minflt, majflt Minor and major page faults
14, 15 utime, stime CPU time in user and kernel mode, in clock ticks (getconf CLK_TCK, normally 100 per second)
16, 17 cutime, cstime The same, for children that have been waited for
18, 19 priority, nice Kernel priority and nice value
20 num_threads Number of threads
22 starttime Start time, in clock ticks after boot
23 vsize Virtual memory size, in bytes
24 rss Resident set size, in pages
39 processor CPU last run on
40, 41 rt_priority, policy Real-time priority and scheduling policy
42 delayacct_blkio_ticks Time spent waiting for block I/O, in clock ticks (needs delay accounting)

limits fields

/proc/<PID>/limits has one line per resource limit with columns Limit, Soft Limit, Hard Limit and Units:

Limit ulimit option Resource
Max cpu time -t CPU seconds (SIGXCPU, then SIGKILL)
Max file size -f Largest file the process may write (SIGXFSZ)
Max data size -d Data segment and heap
Max stack size -s Main thread's stack
Max core file size -c Core dump size; 0 disables core dumps
Max processes -u Processes and threads for the real user ID
Max open files -n Open file descriptors
Max locked memory -l Memory locked with mlock()
Max address space -v Virtual memory
Max pending signals -i Queued signals for the real user ID
Max msgqueue size -q POSIX message queues
Max nice priority, Max realtime priority -e, -r Ceilings for raising priority

On the systemd distributions covered here, services start with a soft limit of 1024 open files and a hard limit of 524288 (DefaultLimitNOFILESoft= and DefaultLimitNOFILE= in systemd-system.conf(5)). OpenRC sets no default of its own (unless rc_ulimit is set in /etc/rc.conf), so on Gentoo services inherit the kernel's defaults: sshd, for example, runs with a soft limit of 1024 and a hard limit of 4096 open files.

See also

  • ps(1) and top(1) from procps-ng 4.0
  • proc(5) and, with man-pages 6.x, the split pages proc_pid_status(5), proc_pid_stat(5), proc_pid_cmdline(5), proc_pid_fd(5) and others
  • getrlimit(2) for resource limits
  • The kernel's The /proc Filesystem