ps
Report running processes.
KaliParrotLinuxpassive
pkg: procps
ps snapshots running processes with owners, CPU/memory and command lines — essential for triage and spotting odd binaries.
Syntax
ps {aux | -ef}
Example
ps aux --sort=-%mem | head
Shows the most memory-hungry processes with full command lines.
Options & flags
What each switch does. Toggle them in the builder below to assemble a command.
Command builder
Tick options (and fill any values) to build a ready-to-copy command.
ps
Usage examples
ps aux --sort=-%mem | head
Top memory-consuming processes.
ps -ef | grep ssh
Find SSH-related processes.
Advantages
- Universal process snapshot
- Full command-line visibility
- Pipes into grep/sort
Disadvantages
- Static snapshot (see top/htop for live)
- BSD vs UNIX flag confusion
- Truncation without options
Tags
#process#triage
Official docs: ps ↗
Related commands
Frequently asked questions
What is ps used for?
ps snapshots running processes with owners, CPU/memory and command lines — essential for triage and spotting odd binaries.
What is an example ps command?
A common example is: ps aux --sort=-%mem | head — Shows the most memory-hungry processes with full command lines.
Is ps part of Kali Linux?
Yes. ps ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install procps.
What category of security tool is ps?
ps is a Core Linux tool with a passive-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.