检索进程：ps
ps这个命令最常见的，我们经常用它来检索进程，但在我认真阅读过ps的man文档之前，我使用的最多的选项是aux，用grep匹配出特定的进程，然后再处理它，现在看来这种做法非常笨拙，呵呵！其实我们完全可以用pgrep快速的完成这一串操作。
今天暂不讲解pgrep的用法，先让我们更多的了解一下ps，首先ps支持三种选项格式：unix options这种选项通常需要在其前加横杠-，多值可梱绑;BSD options 选项前不用加任何符号；GNU Long options即GNU长选项，选项前加两个横杠；这三种选项可以混用，在产生冲突时程序会提示。
ps选项分类：检索类、输出列格式控制、线程信息、其他信息，在此我只列举一些常用到的用法，其他选项在用到时可以查看手册页。
-e用于显示所有进程，以下是输出的一小部分：
[root@supersun.biz ~]#ps -e
PID TTY TIME CMD
1 ? 00:00:00 init
2 ? 00:00:00 migration/0
3 ? 00:00:00 ksoftirqd/0
4 ? 00:00:00 watchdog/0
5 ? 00:00:00 events/0
域定义：
PID 进程ID
TTY 与进程关联的终端
TIME 进程使用CPU累计时间
CMD 执行文件的名称
-f选项定义为full-format listing
[root@supersun.biz ~]#ps -ef
UID PID PPID C STIME TTY TIME CMD
root 1 0 0 08:31 ? 00:00:00 init [5]
root 2 1 0 08:31 ? 00:00:00 [migration/0]
root 3 1 0 08:31 ? 00:00:00 [ksoftirqd/0]
root 4 1 0 08:31 ? 00:00:00 [watchdog/0]
域定义：
UID 用户ID
C CPU利用率，以整数表示。
STIME 进程的启动时间
-F选项添加了进程使用内存方面的一些信息：（测试了一下，该选项在AIX下是输出格式定制选项，同-o选项。）
[root@supersun ~]# ps -eF
UID PID PPID C SZ RSS PSR STIME TTY TIME CMD
root 1 0 0 508 684 1 Nov29 ? 00:00:00 init [5]
root 2 1 0 0 0 0 Nov29 ? 00:00:00 [migration/0]
root 3 1 0 0 0 0 Nov29 ? 00:00:00 [ksoftirqd/0]
root 4 1 0 0 0 0 Nov29 ? 00:00:00 [watchdog/0]
root 5 1 0 0 0 1 Nov29 ? 00:00:00 [migration/1]
root 6 1 0 0 0 1 Nov29 ? 00:00:00 [ksoftirqd/1]
root 7 1 0 0 0 1 Nov29 ? 00:00:00 [watchdog/1]
SZ 进程用到的swap的量，这是一个粗略计算；
RSS 驻留内存大小
PSR 进程使用的处理器，在多处理器上可以体现出来，如下面的两个进程使用的不同的处理器（超线程的也算）：
UID PID PPID C SZ RSS PSR STIME TTY TIME CMD
root 1 0 0 508 684 1 Nov29 ? 00:00:00 init [5]
root 2 1 0 0 0 0 Nov29 ? 00:00:00 [migration/0]
-L用于显示线程（测试了一下， 在AIX下-L选项需要后跟PID才行。）
[root@supersun.biz ~]#ps -eLf
UID PID PPID LWP C NLWP STIME TTY TIME CMD
root 1 0 1 0 1 08:31 ? 00:00:00 init [5]
root 2 1 2 0 1 08:31 ? 00:00:00 [migration/0]
root 2233 2228 2233 3 8 08:35 ? 00:04:50 /root/firefox/firefox-bin
root 2233 2228 2271 0 8 08:36 ? 00:00:00 /root/firefox/firefox-bin
root 2233 2228 2272 0 8 08:36 ? 00:00:01 /root/firefox/firefox-bin
root 2233 2228 2277 0 8 08:36 ? 00:00:00 /root/firefox/firefox-bin
root 2233 2228 2278 0 8 08:36 ? 00:00:00 /root/firefox/firefox-bin
root 2233 2228 2279 0 8 08:36 ? 00:00:00 /root/firefox/firefox-bin
LWP light weight process ID 可以称其为线程ID。
NLWP 进程中的线程数number of lwps (threads) in the process。
显示进程树
[root@supersun.biz ~]#ps -ejH
PID PGID SID TTY TIME CMD
1 1 1 ? 00:00:00 init
2 1 1 ? 00:00:00 migration/0
3 1 1 ? 00:00:00 ksoftirqd/0
4 1 1 ? 00:00:00 watchdog/0
5 1 1 ? 00:00:00 events/0
6 1 1 ? 00:00:00 khelper
7 1 1 ? 00:00:00 kthread
10 1 1 ? 00:00:00 kblockd/0
11 1 1 ? 00:00:00 kacpid
86 1 1 ? 00:00:00 cqueue/0
89 1 1 ? 00:00:00 khubd
SID 即session ID
F即flag,其值有：
1 forked but didn\'t exec
4 used super-user privileges
S即STAT，其值有：
D Uninterruptible sleep (usually IO)
R Running or runnable (on run queue)
S Interruptible sleep (waiting for an event to complete)
T Stopped, either by a job control signal or because it is being traced.
W paging (not valid since the 2.6.xx kernel)
X dead (should never be seen)
Z Defunct ("zombie") process, terminated but not reaped by its parent.
对于BSD选项产生的值：
< high-priority (not nice to other users)
N low-priority (nice to other users)
L has pages locked into memory (for real-time and custom IO)
s is a session leader
l is multi-threaded (using CLONE_THREAD, like NPTL pthreads do)
+ is in the foreground process group
当然我们还可以定义ps的输出域，如：
[root@supersun ~]# ps -e -o pid
PID
1
2
3
也可以指定多个域：
[root@supersun.biz ~]#ps -e -o pid,cmd
PID CMD
1 init [5]
2 [migration/0]
3 [ksoftirqd/0]
4 [watchdog/0]
5 [events/0]
6 [khelper]
需要注意的是在提定域输出的时使就不要使用-f等定义域输出的选项，这样会有冲突。
使用进程名对进程进行检索：
[root@supersun.biz ~]#ps -C syslogd -F
UID PID PPID C SZ RSS PSR STIME TTY TIME CMD
root 1479 1 0 424 632 0 08:32 ? 00:00:00 syslogd -m 0
对输出进行排序：
[root@supersun.biz ~]#ps -e -o pid,rss,pcpu,cmd --sort pcpu,rss
PID RSS %CPU CMD
2 0 0.0 [migration/0]
3 0 0.0 [ksoftirqd/0]
4 0 0.0 [watchdog/0]
2507 35948 0.2 stardict
2206 2276 2.0 gnome-screensaver
2170 15248 2.2 /usr/libexec/wnck-applet --oaf-activate-iid=OAFIID:GNOME_Wncklet_Factory
2064 8328 2.4 /usr/libexec/gnome-settings-daemon
2084 10860 2.5 metacity --sm-client-id=default1
6434 3284 2.6 rdesktop -T192.168.1.177 - Terminal Server Client -usunchao -rsoundff -
2213 22428 3.1 gnome-terminal
2233 104276 4.3 /root/firefox/firefox-bin
因为输出太长，我截去了一些 ，还有与selinux有关的信息，检索一系列进程等等我就不再列举了，自己用到的时候看看手册吧。
作者：ixdba
来源：http://bbs.ixdba.net/redirect.php?tid=181&goto=lastpost
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
以下是AIX手册中队-o选项、-L选项的说明：
-o Format
Displays information in the format specified by the Format variable. Multiple field specifiers can be specified for
the Format variable. The Format variable is either a comma-separated list of field specifiers or a list of field
specifiers enclosed within a set of " " (double-quotation marks) and separated from one another by a comma or by one
or more spaces, or both.
Each field specifier has a default header. The default header can be overridden by appending an = (equal sign)
followed by the user-defined text for the header. The fields are written in the order specified on the command line in
column format. The field widths are specified by the system to be at least as wide as the default or user-defined
header text. If the header text is null, (such as if -o user= is specified), the field width is at least as wide as
the default header text. If all header fields are null, no header line is written.
The following field specifiers are recognized by the system:
args
Indicates the full command name being executed. All command-line arguments are included, though truncation may
occur. The default header for this field is COMMAND.
bnd
Indicates to which (if any) processor a process or kernel thread is bound. The default header for this field is
BND.
class
Indicates the workload managekment class assigned to the process. the default header for this field is CLASS.
comm
Indicates the short name of the command being executed. Command-line arguments are not included. The default
header for this field is COMMAND.
cpu
Determines process scheduling priority. CPU utilization of process or thread, incremented each time the system
clock ticks and the process or thread is found to be running. The value is decayed by the scheduler by dividing
it by 2 once per second. For the sched_other policy, Large values indicate a CPU intensive process and result
in lower process priority whereas small values indicate an I/O intensive process and result in a more favorable
priority.
etime
Indicates the elapsed time since the process started. The elapsed time is displayed in the following format:
[[ dd-]hh:]mm:ss
where dd specifies the number of days, hh specifies the number of hours, mm specifies the number of minutes,
and ss specifies the number of seconds. The default header for this field is ELAPSED.
group
Indicates the effective group ID of the process. The textual group ID is displayed. If the textual group ID
cannot be obtained, a decimal representation is used. The default header for this field is GROUP.
nice
Indicates the decimal value of the process nice value. The default header for this field is NI.
-o Format (Continued)
pcpu
Indicates the ratio of CPU time used to CPU time available, expressed as a percentage. The default header for
this field is %CPU.
pgid
Indicates the decimal value of the process group ID. The default header for this field is PGID.
pid
Indicates the decimal value of the process ID. The default header for this field is PID.
ppid
Indicates the decimal value of the parent process ID. The default header for this field is PPID.
rgroup
Indicates the real group ID of the process. The textual group ID is displayed. If the textual group ID cannot
be obtained, a decimal representation is used. The default header for this field is RGROUP.
ruser
Indicates the real user ID of the process. The textual user ID is displayed. If the textual user ID cannot be
obtained, a decimal representation is used. The default header for this field is RUSER.
scount
Indicates the suspend count for a kernel thread. The default header for this field is SC.
sched
Indicates the scheduling policy for a kernel thread. The default header for this field is SCH.
tag
Indicates the Workload Manager application tag. The default header for this field is TAG. The tag is a
character string up to 30 characters long and may be truncated when displayed by ps. For processes that do not
set their tag, this field displays as a - (hyphen).
tcpu
Total CPU time. Indicates the total accumulated CPU time for a single process. The default header for this
field is TCPU.
tctime
Total connect time. Indicates the total amount of time that a login session can be active. This is meaningful
only in the case of session leader processes. The default header for this field is TCTIME.
tdiskio
Total disk I/O. Indicates the total accumulated blocks of disk I/O for a single process. The default header for
this field is TDISKIO.
vmsize
Indicates the WLM virtual memory limits. When this is used, a new header, VMSIZ is displayed. VMSIZ displays
the virtual memory used by the process. This value is displayed in 1 MB units.
-o Format (Continued)
thcount
Indicates the number of kernel threads owned by the process. The default header for this field is THCNT.
THREAD
Indicates the following fields:
* User name (the uname field)
* Process and parent process IDs for processes (the pid and ppid fields)
* Kernel thread ID for threads (the tid field)
* The state of the process or kernel thread (the S field)
* The CPU utilization of the process or kernel thread (the C field)
* The priority of the process or kernel thread (the PRI field)
* The suspend count of the process or kernel thread (the scount field)
* The wait channel of the process or kernel thread (the WCHAN field)
* The flags of the process or kernel thread (the F field)
* The controlling terminal of the process (the tty field)
* The CPU to which the process or kernel thread is bound (the bnd field)
* The command being executed by the process (the comm field).
Threads are not actually displayed with the -o THREAD flag, unless the -m flag is also specified.
tid
Indicates the thread ID of a kernel thread. The default header for this field is TID.
time
Indicates the cumulative CPU time since the process started. The time is displayed in the following format:
[ dd-]hh:mm:ss
where dd specifies the number of days, hh specifies the number of hours, mm specifies the number of minutes,
and ss specifies the number of seconds. The default header for this field is TIME.
tty
Indicates the controlling terminal name of the process. The default header for this field is TT.
user
Indicates the effective user ID of the process. The textual user ID is displayed. If the textual user ID cannot
be obtained, a decimal representation is used. The default header for this field is USER.
vsz
Indicates, as a decimal integer, the size in kilobytes of the process in virtual memory. The default header for
this field is VSZ.
-o Format (Continued)
Otherwise, multiple fields in a specified format can be displayed by the Format variable, including field descriptors.
If field descriptors are used in the Format variable, it must be enclosed in double quotation marks (" "). The
following table shows how field descriptors correspond to field specifiers:
Field Field Default
Descriptors Specifiers Headers
%a args COMMAND
%c comm COMMAND
%t etime ELAPSED
%G group GROUP
%n nice NI
%C pcpu %CPU
%r pgid PGID
%p pid PID
%P ppid PPID
%g rgroup RGROUP
%u ruser RUSER
%x time TIME
%y tty TTY
%U user USER
%z vsz VSZ
-L pidlist
Generates a list of descendants of each and every pid that has been passed to it in the pidlist variable. The pidlist
variable is a list of comma-separated process IDs. The list of descendants from all of the given pid is printed in the
order in which they appear in the process table.
在linux操作系统中可以使用ps -eLf命令来查看线程信息：
下面的数据为db2数据库的db2sysc进程中所包括的线程：
192.168.100.228 [sde ~]$ ps -eLf |grep db2sysc|grep -v grep
UID PID PPID LWP C NLWP STIME TTY TIME CMD
UID为User ID.
PID为process id,进程标识符
PPID为 parent process id，父进程标识符2，
LWP为light weight process or thread， 轻量级进程，即线程标识符
NLWP为，number of lwps(threads) in the process, 线程的数量
C CPU利用率，以整数表示。