How do I list running Linux processes and identify their owner?
ps provides a snapshot of running processes. Start with identity and ownership before deciding whether a process belongs to an application, an administrator or the operating system. A process name alone is not enough to justify stopping it; the service manager and application role provide additional context.
Before you start
- An authorised SSH session on the Linux server.
Instructions
1. List a bounded set of useful fields
The example omits full argument strings, which can contain tokens in poorly configured applications. It shows a name, owner and resource summary instead.
ps -eo pid,ppid,user,etime,%cpu,%mem,comm --sort=-%cpu | head -n 21PID identifies the process, PPID its parent, and etime its elapsed lifetime. CPU percentages here are not the same as a fresh one-second sample.
2. Inspect one selected process
Replace 12345 only after selecting the intended live PID from the first command. Processes can exit and PIDs can be reused, so recheck immediately before an administrative action.
ps -p 12345 -o pid,ppid,user,lstart,stat,commThe start time and owner help confirm that this is still the same process. The status field describes its current scheduling state.
Check the result
- The process is mapped to the intended application or service and its owner is understood. Use service-specific controls for managed applications.
Troubleshooting
- The process disappears between commands
- It may have completed or restarted. Refresh the evidence rather than acting on a stale PID.
- Several processes share a name
- Use their owner, parent and service membership to distinguish workers from unrelated workloads.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.