.\"	$NetBSD: ps.1,v 1.115 2021/11/06 06:38:03 msaitoh Exp $
.\"
.\" Copyright (c) 1980, 1990, 1991, 1993, 1994
.\"	The Regents of the University of California.  All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\"    notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\"    notice, this list of conditions and the following disclaimer in the
.\"    documentation and/or other materials provided with the distribution.
.\" 3. Neither the name of the University nor the names of its contributors
.\"    may be used to endorse or promote products derived from this software
.\"    without specific prior written permission.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
.\"     @(#)ps.1	8.3 (Berkeley) 4/18/94
.\"
.Dd November 6, 2021
.Dt PS 1
.Os
.Sh NAME
.Nm ps
.Nd process status
.Sh SYNOPSIS
.Nm
.Op Fl AaCcdehjlmrSsTuvwx
.Op Fl G Ar group
.Op Fl k Ar key
.Op Fl M Ar core
.Op Fl N Ar system
.Op Fl O Ar fmt
.Op Fl o Ar fmt
.Op Fl p Ar pid
.Op Fl t Ar tty
.Op Fl U Ar user
.Op Fl W Ar swap
.Nm
.Fl L
.Sh DESCRIPTION
.Nm
displays a header line followed by lines containing information about
running processes.
By default, the display includes only processes that have
controlling terminals and are owned by your uid.
The default sort order of controlling terminal and
(among processes with the same controlling terminal) process ID
may be changed using the
.Fl k , Fl m ,
or
.Fl r
options.
.Pp
The information displayed for each process
is selected based on a set of keywords (see the
.Fl L ,
.Fl O ,
and
.Fl o
options).
The default output format includes, for each process, the process' ID,
controlling terminal, CPU time (including both user and system time),
state, and associated command.
.Pp
The options are as follows:
.Bl -tag -width XNXsystemXX
.It Fl A
Display information about all processes.
This is equivalent to
.Fl a Fl x .
.It Fl a
Display information about other users' processes as well as your own.
Note that this does not display information about processes
without controlling terminals.
.It Fl C
Change the way the CPU percentage is calculated by using a
.Dq raw
CPU calculation that ignores
.Dq resident
time (this normally has no effect).
.It Fl c
Do not display full command with arguments, but only the
executable name.
This may be somewhat confusing; for example, all
.Xr sh 1
scripts will show as
.Dq sh .
.It Fl d
Arrange processes into descendancy order and prefix each command with
indentation text showing sibling and parent/child relationships.
If either of the
.Fl m
and
.Fl r
options are also used, they control how sibling processes are sorted
relative to each other.
.It Fl e
Display the environment as well.
The environment for other
users' processes can only be displayed by the super-user.
.It Fl G Ar group
Display processes belonging to the users belonging to the specified group,
given either as a group name or a gid.
.It Fl h
Repeat the information header as often as necessary to guarantee one
header per page of information.
.It Fl j
Print information associated with the following keywords:
.Ar user , pid , ppid , pgid , sess , jobc , state , tt , time ,
and
.Ar command .
.It Fl k Ar key
Sort the output using the space or comma separated list of keywords.
Multiple sort keys may be specified, using any of the
.Fl k , Fl m ,
or
.Fl r
options.
The default sort order is equivalent to
.Fl k Ar tdev,pid .
.It Fl L
List the set of available keywords.
.It Fl l
Display information associated with the following keywords:
.Ar uid , pid , ppid , cpu , pri , nice , vsz , rss , wchan , state ,
.Ar tt , time ,
and
.Ar command .
.It Fl M Ar core
Extract values from the specified core file instead of the running system.
.It Fl m
Sort by memory usage.
This is equivalent to
.Fl k Ar vsz .
.It Fl N Ar system
Extract the name list from the specified system instead of the default,
.Dq Pa /netbsd .
Ignored unless
.Fl M
is specified.
.It Fl O Ar fmt
Display information associated with the space or comma separated list
of keywords specified.
The
.Fl O
option does not suppress the default display;
it inserts additional keywords just after the
.Ar pid
keyword in the default display, or after the
.Ar pid
keyword (if any) in a non-default display specified before the
first use of the
.Fl O
flag.
Keywords inserted by multiple
.Fl O
options will be adjacent.
.Pp
An equals sign
.Pq Dq \&=
followed by a customised header string may be appended to a keyword,
as described in more detail under the
.Fl o
option.
.It Fl o Ar fmt
Display information associated with the space or comma separated list
of keywords specified.
Use of the
.Fl o
option suppresses the set of keywords that would be displayed by default,
or appends to the set of keywords specified by other options.
.Pp
An equals sign
.Pq Dq \&=
followed by a customised header string may be appended to a keyword.
This causes the printed header to use the specified string instead of
the default header associated with the keyword.
.Pp
Everything after the first equals sign is part of the customised
header text, and this may include embedded spaces
.Pq Dq " " ,
commas
.Pq Dq \&, ,
or equals signs
.Pq Dq \&= .
To specify multiple keywords with customised headers, use multiple
.Fl o
or
.Fl O
options.
.Pp
If all the keywords to be displayed have customised headers,
and all the customised headers are entirely empty,
then the header line is not printed at all.
.Pp
If the keyword is capitalized, then an alternate (symbolic) form of it
is printed, if available.
.It Fl p Ar pid
Display information associated with the specified process ID.
.It Fl r
Sort by current CPU usage.
This is equivalent to
.Fl k Ar %cpu .
.It Fl S
Change the way the process time is calculated by summing all exited
children to their parent process.
.It Fl s
Display one line for each LWP, rather than one line for each process,
and display information associated with the following keywords:
.Ar uid , pid , ppid , cpu , lid , nlwp , pri , nice , vsz , rss ,
.Ar wchan , lstate , tt , time ,
and
.Ar command .
.It Fl T
Display information about processes attached to the device associated
with the standard input.
.It Fl t Ar tty
Display information about processes attached to the specified terminal
device.
Use a question mark
.Pq Dq \&?
for processes not attached to a
terminal device and a minus sign
.Pq Dq -
for processes that have
been revoked from their terminal device.
.It Fl U Ar user
Display processes belonging to the specified user,
given either as a user name or a uid.
.It Fl u
Display information associated with the following keywords:
.Ar user , pid , %cpu , %mem , vsz , rss , tt , state , start , time ,
and
.Ar command .
The
.Fl u
option implies the
.Fl r
option.
.It Fl v
Display information associated with the following keywords:
.Ar pid , state , time , sl , re , pagein , vsz , rss , lim , tsiz ,
.Ar %cpu , %mem ,
and
.Ar command .
The
.Fl v
option implies the
.Fl m
option.
.It Fl W Ar swap
Extract swap information from the specified file instead of the default,
.Dq Pa /dev/drum .
Ignored unless
.Fl M
is specified.
.It Fl w
Use 132 columns to display information instead of the default, which
is your window size.
If the
.Fl w
option is specified more than once,
.Nm
will use as many columns as necessary without regard to your window size.
.It Fl x
Also display information about processes without controlling terminals.
.El
.Pp
A complete list of the available keywords are listed below.
Some of these keywords are further specified as follows:
.Bl -tag -width indent
.It Ar %cpu
The CPU utilization of the process; this is a decaying average over up to
a minute of previous (real) time.
Since the time base over which this is computed varies (since processes may
be very young) it is possible for the sum of all %CPU fields to exceed 100%.
.It Ar %mem
The percentage of real memory used by this process.
.It Ar flags
The flags (in hexadecimal) associated with the process as in
the include file
.In sys/sysctl.h :
.Bl -column P_NOCLDSTOP P_NOCLDSTOP compact
.It Dv "P_ADVLOCK" Ta No "0x00000001	process may hold a POSIX advisory lock"
.It Dv "P_CONTROLT" Ta No "0x00000002	process has a controlling terminal"
.It Dv "P_INMEM" Ta No "0x00000004	process is in memory"
.It Dv "P_NOCLDSTOP" Ta No "0x00000008	no" Dv SIGCHLD No when children stop
.It Dv "P_PPWAIT" Ta No "0x00000010	parent is waiting for child to exec/exit"
.It Dv "P_PROFIL" Ta No "0x00000020	process has started profiling"
.It Dv "P_SELECT" Ta No "0x00000040	selecting; wakeup/waiting danger"
.It Dv "P_SINTR" Ta No "0x00000080	sleep is interruptible"
.It Dv "P_SUGID" Ta No "0x00000100	process had set id privileges since last exec"
.It Dv "P_SYSTEM" Ta No "0x00000200	system process: no sigs or stats"
.It Dv "P_SA" Ta No "0x00000400	process is using scheduler activations (old)"
.It Dv "P_TRACED" Ta No "0x00000800	process is being traced"
.It Dv "P_WAITED" Ta No "0x00001000	debugging process has waited for child"
.It Dv "P_WEXIT" Ta No "0x00002000	working on exiting"
.It Dv "P_EXEC" Ta No "0x00004000	process called" Xr execve 2
.It Dv "P_OWEUPC" Ta No "0x00008000	owe process an addupc() call at next ast"
.It Dv "P_NOCLDWAIT" Ta No "0x00020000	no zombies if child dies"
.It Dv "P_32" Ta No "0x00040000	32-bit process (used on 64-bit kernels)"
.It Dv "P_CLDSIGIGN" Ta No "0x0008000	no" Dv SIGCHLD when children stop
.It Dv "P_SYSTRACE" Ta No "0x00200000	process is under" Xr systrace 1 (old)
.It Dv "P_CHTRACED" Ta No "0x00400000	process has been traced and reparented"
.It Dv "P_STOPFORK" Ta No "0x00800000	process stops at" Xr fork 2
.It Dv "P_STOPEXEC" Ta No "0x01000000	process stops at" Xr exec 2
.It Dv "P_STOPEXIT" Ta No "0x02000000	process stops at" Xr _exit 2"
.It Dv "P_SYSCALL" Ta No "0x04000000	process is tracing syscalls"
.El
.It Ar lim
The soft limit on memory used, specified via a call to
.Xr setrlimit 2 .
.It Ar lstart
The exact time the command started, using the
.Dq \&%c
format described in
.Xr strftime 3 .
.It Ar maxrss
the maximum resident set size of the process (in 1024 byte units).
.It Ar nice
The process scheduling increment (see
.Xr setpriority 2 ) .
.It Ar rss
the real memory (resident set) size of the process (in 1024 byte units).
.It Ar start
The time the command started.
If the command started less than 24 hours ago, the start time is
displayed using the
.Dq %l:%M%p
format described in
.Xr strftime 3 .
If the command started less than 7 days ago, the start time is
displayed using the
.Dq %a%p
format.
Otherwise, the start time is displayed using the
.Dq %e%b%y
format.
.It Ar state
The state is given by a sequence of letters, for example,
.Dq RNs .
The first letter indicates the run state of the process:
.Pp
.Bl -tag -width indent -compact
.It D
Marks a process in device or other short term, uninterruptible wait.
.It I
Marks a process that is idle (sleeping interruptibly for longer than about
.Dv MAXSLP
(default 20) seconds).
.It O
Marks a process running on a processor.
.It R
Marks a runnable process, or one that is in the process of creation.
.It S
Marks a process that is sleeping interruptibly for less than about
.Dv MAXSLP
(default 20) seconds.
.It T
Marks a stopped process.
.It U
Marks a suspended process.
.It Z
Marks a dead process that has exited, but not been waited for (a
.Dq zombie ) .
.El
.Pp
Additional characters after these, if any, indicate additional state
information:
.Pp
.Bl -tag -width indent -compact
.It +
The process is in the foreground process group of its control terminal.
.It -
The LWP is detached (can't be waited for).
.It <
The process has raised CPU scheduling priority.
.It a
The process is using scheduler activations (deprecated).
.It E
The process is in the process of exiting.
.It K
The process is a kernel thread or system process.
.It l
The process has multiple LWPs.
.It N
The process is niced (has reduced CPU scheduling priority) (see
.Xr setpriority 2 ) .
.It s
The process is a session leader.
.It V
The process is suspended during a
.Xr vfork 2 .
.It X
The process is being traced or debugged.
.El
.It Ar tt
An abbreviation for the pathname of the controlling terminal, if any.
The abbreviation consists of the two letters following
.Dq Pa /dev/tty
or, for the console,
.Dq co .
This is followed by a
.Dq \&-
if the process can no longer reach that
controlling terminal (i.e., it has been revoked).
.It Ar wchan
The event (an address in the system) on which a process waits.
When printed numerically, the initial part of the address is
trimmed off and the result is printed in hex, for example, 0x80324000 prints
as 324000.
.El
.Pp
When printing using the
.Ar command
keyword, a process that has exited and has a parent that has not yet
waited for the process (in other words, a zombie) is listed as
.Dq Aq defunct ,
and a process which is blocked while trying to exit is listed as
.Dq Aq exiting .
.Pp
.Nm
will try to locate the processes' argument vector from the user
area in order to print the command name and arguments.
This method is not reliable because a process is allowed to destroy this
information.
The
.Ar ucomm
(accounting) keyword will always contain the real command name as
contained in the process structure's
.Va p_comm
field.
.Pp
If the command vector cannot be located (usually because it has not
been set, as is the case of system processes and/or kernel threads)
the command name is printed within square brackets.
.Pp
To indicate that the argument vector has been tampered with,
.Nm
will append the real command name to the output within parentheses
if the basename of the first argument in the argument vector
does not match the contents of the real command name.
.Pp
In addition,
.Nm
checks for the following two situations and does not append the
real command name parenthesized:
.Bl -tag -width indent
.It -shellname
The login process traditionally adds a
.Sq -
in front of the shell name to indicate a login shell.
.Nm
will not append parenthesized the command name if it matches with
the name in the first argument of the argument vector, skipping
the leading
.Sq - .
.It daemonname: current-activity
Daemon processes frequently report their current activity by setting
their name to be like
.Dq daemonname: current-activity .
.Nm
will not append parenthesized the command name, if the string preceding the
.Sq \&:
in the first argument of the argument vector matches the command name.
.El
.Sh KEYWORDS
The following is a complete list of the available keywords and their
meanings.
Several of them have aliases (keywords which are synonyms).
.Pp
.Bl -tag -width groupnames -compact
.It Ar %cpu
percentage CPU usage (alias
.Ar pcpu )
.It Ar %mem
percentage memory usage (alias
.Ar pmem )
.It Ar acflag
accounting flag (alias
.Ar acflg )
.It Ar comm
command (the argv[0] value)
.It Ar command
command and arguments (alias
.Ar args )
.It Ar cpu
short-term CPU usage factor (for scheduling)
.It Ar cpuid
CPU number the current process or lwp is running on.
.It Ar ctime
accumulated CPU time of all children that have exited
.It Ar egid
effective group id
.It Ar egroup
group name (from egid)
.It Ar emul
emulation name
.It Ar etime
elapsed time since the process was started, in the form
.Li [[dd-]hh:]mm:ss
.It Ar euid
effective user id
.It Ar euser
user name (from euid)
.It Ar flags
the process flags, in hexadecimal (alias
.Ar f )
.It Ar gid
effective group id
.It Ar group
group name (from gid)
.It Ar groupnames
group names (from group access list)
.It Ar groups
group access list
.It Ar idrss
integral unshared data
.It Ar isrss
integral unshared stack
.It Ar ixrss
integral shared memory size
.It Ar inblk
total blocks read (alias
.Ar inblock )
.It Ar jobc
job control count
.It Ar ktrace
tracing flags
.It Ar ktracep
tracing vnode
.It Ar laddr
kernel virtual address of the
.Ft "struct lwp"
belonging to the LWP.
.It Ar lid
ID of the LWP
.It Ar lim
memory use limit
.It Ar lname
descriptive name of the LWP
.It Ar logname
login name of user who started the process (alias
.Ar login )
.It Ar lstart
time started
.It Ar lstate
symbolic LWP state
.It Ar ltime
CPU time of the LWP
.It Ar majflt
total page faults
.It Ar maxrss
maximum resident set size
.It Ar minflt
total page reclaims
.It Ar msgrcv
total messages received (reads from pipes/sockets)
.It Ar msgsnd
total messages sent (writes on pipes/sockets)
.It Ar nice
nice value (alias
.Ar ni )
.It Ar nivcsw
total involuntary context switches
.It Ar nlwp
number of LWPs in the process
.It Ar nsigs
total signals taken (alias
.Ar nsignals )
.It Ar nvcsw
total voluntary context switches
.It Ar nwchan
wait channel (as an address)
.It Ar oublk
total blocks written (alias
.Ar oublock )
.It Ar p_ru
resource usage pointer (valid only for zombie)
.It Ar paddr
kernel virtual address of the
.Ft "struct proc"
belonging to the process.
.It Ar pagein
pageins (same as majflt)
.It Ar pgid
process group number
.It Ar pid
process ID
.It Ar ppid
parent process ID
.It Ar pri
scheduling priority
.It Ar re
core residency time (in seconds; 127 = infinity)
.It Ar rgid
real group ID
.It Ar rlink
reverse link on run queue, or 0
.It Ar rlwp
number of LWPs on a processor or run queue
.It Ar rss
resident set size
.It Ar rsz
resident set size + (text size / text use count) (alias
.Ar rssize )
.It Ar ruid
real user ID
.It Ar ruser
user name (from ruid)
.It Ar sess
session pointer
.It Ar sid
session ID
.It Ar sig
pending signals (alias
.Ar pending )
.It Ar sigcatch
caught signals (alias
.Ar caught )
.It Ar sigignore
ignored signals (alias
.Ar ignored )
.It Ar sigmask
blocked signals (alias
.Ar blocked )
.It Ar sl
sleep time (in seconds; 127 = infinity)
.It Ar start
time started
.It Ar state
symbolic process state (alias
.Ar stat )
.It Ar stime
accumulated system CPU time
.It Ar svgid
saved gid from a setgid executable
.It Ar svgroup
group name (from svgid)
.It Ar svuid
saved uid from a setuid executable
.It Ar svuser
user name (from svuid)
.It Ar tdev
control terminal device number
.It Ar time
accumulated CPU time, user + system (alias
.Ar cputime )
.It Ar tpgid
control terminal process group ID
.It Ar tsess
control terminal session pointer
.It Ar tsiz
text size (in Kbytes)
.It Ar tt
control terminal name (two letter abbreviation)
.It Ar tty
full name of control terminal
.It Ar uaddr
kernel virtual address of the
.Ft "struct user"
belonging to the LWP.
.It Ar ucomm
name to be used for accounting
.It Ar uid
effective user ID
.It Ar upr
scheduling priority on return from system call (alias
.Ar usrpri )
.It Ar user
user name (from uid)
.It Ar utime
accumulated user CPU time
.It Ar vsz
virtual size in Kbytes (alias
.Ar vsize )
.It Ar wchan
wait channel (as a symbolic name)
.It Ar xstat
exit or stop status (valid only for stopped or zombie process)
.El
.Sh FILES
.Bl -tag -width /var/run/kvm.db -compact
.It Pa /dev
special files and device names
.It Pa /dev/drum
default swap device
.It Pa /var/run/dev.cdb
/dev name database
.It Pa /var/db/kvm.db
system name list database
.It Pa /netbsd
default system name list
.El
.Sh SEE ALSO
.Xr kill 1 ,
.Xr pgrep 1 ,
.Xr pkill 1 ,
.Xr sh 1 ,
.Xr w 1 ,
.Xr kvm 3 ,
.Xr strftime 3 ,
.Xr dev_mkdb 8 ,
.Xr pstat 8
.Sh HISTORY
A
.Nm
utility appeared in
.At v3
in section 8 of the manual.
.Sh BUGS
Since
.Nm
cannot run faster than the system and is run as any other scheduled
process, the information it displays can never be exact.
.Pp
The
.Fl G
option should ideally take a list instead of a single group.