Please explain this output of ps -ef command?

Question

A part of the output from the ps -ef command is given below :

UID        PID  PPID  C STIME TTY          TIME CMD
root         1     0  0  2012 ?        00:00:01 init [3]         
root         2     1  0  2012 ?        00:00:01 [migration/0]
root         3     1  0  2012 ?        00:00:00 [ksoftirqd/0]
root         4     1  0  2012 ?        00:00:00 [watchdog/0]
root         5     1  0  2012 ?        00:00:00 [events/0]
root         6     1  0  2012 ?        00:00:00 [khelper]
root         7     1  0  2012 ?        00:00:00 [kthread]
root         9     7  0  2012 ?        00:00:00 [xenwatch]
root        10     7  0  2012 ?        00:00:00 [xenbus]
root        18     7  0  2012 ?        00:00:01 [migration/1]
root        19     7  0  2012 ?        00:00:00 [ksoftirqd/1]

What does the "?" for all the rows in the TTY column mean? Also what does C and CMD column stand for?

Answer 1

You can check the manpage using man ps to find out what the columns mean. The Linux ps manpage, for example, gives:

c              C           integer value of the processor utilisation percentage.
                           (see %cpu)
tname          TTY         controlling tty (terminal). (alias tt, tty).
args           COMMAND     command with all its arguments as a string. May chop as
                           desired. Modifications to the arguments are not shown.
                           The output in this column may contain spaces.
                           (alias cmd, command)
cmd            CMD         see args. (alias args, command)

If the TTY is ? that means that the process is not associated with any user terminal.

Answer 2

Since these are all kernel processes, they are not attached to a TTY (hence the ? value in the TTY field).

Answer 3

UID PID PPID C STIME TTY TIME CMD

root 1 0 0 2012 ? 00:00:01 init [3]

Understanding the output:-

1. The name of the user who have started the process.

2. This column is PID i.e. process id. This act as the identification no of the process running in the memory.

3. This column is PPID i.e. parent process id. This id is the pid of the process because of which these process has been started. All the Oracle processes don’t have a parent process and are thus adopted by init process, init process having pid as 1 so all the oracle processes will have ppid as 1.

4. Processor utilization information in %.

5. This is the start time of the process, for a long running process like in case of Oracle it will show only the date in process was started. If you want to know full year and time of a lone running process, fire the command with this option ps –efo user, pid, ppid, etime, args – etime will tell for last how many days process has been running.

6. This is the terminal from which the process was started. As in case of grep pmon command was fired in terminal pts/2 thus it is showing that this process is started by terminal pts/2. All the oracle process are not started by any terminal.

7. Total time for which the process has utilized CPU.

8. The command and arguments executed.

Answer 4

Examples of Few headers

F   S   UID     ID  PPID C  PRI NI  ADDR        SZ  WCHAN   STIME   TTY    TIME COMD

1   R   obiwan  792 779 22  183 20  10ec5f80    29    -    12:52:24 pts/2   0:00    ps -elf

Explanation

ColumnHeader    Contents
%CPU            How much of the CPU the process is using
%MEM            How much memory the process is using
ADDR            Memory address of the process
C or CP         CPU usage and scheduling information
COMMAND*        Name of the process, including arguments, if any
NI              nice value
F               Flags
PID             Process ID number
PPID            ID number of the process's parent process
PRI             Priority of the process
RSS             Real memory usage
S or STAT       Process status code
START or STIME  Time when the process started
SZ              Virtual memory usage
TIME            Total CPU usage
TT or TTY       Terminal associated with the process
UID or USER     Username of the process's owner
WCHAN           Memory address of the event the process is waiting for

Credits : Indiana University Knowledge Base