What are the main ps command variations and what do they show?
ps aux (BSD style) gives a detailed all-process snapshot with CPU/MEM; ps -ef (UNIX style) gives all processes with the parent PID (PPID).
ps prints a one-time snapshot of processes. Its quirk is two historical syntaxes — BSD (no dash: aux) and UNIX (dash: -ef) — which pick different default columns. You choose the variant by what you need to see:
| Command | Style | Best for |
|---|---|---|
ps |
– | Just your own shell's processes |
ps aux |
BSD | Everything, with %CPU and %MEM |
ps -ef |
UNIX | Everything, with PPID (parent) |
ps lax |
BSD | Adds priority/nice and flags |
ps f |
BSD | ASCII process tree (forest view) |
ps aux columns — note VSZ (virtual size) vs RSS (resident, the RAM actually used), and STAT (the state letters):
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.1 12345 1234 ? Ss Jan01 0:05 /sbin/init
ps -ef columns — the PPID here lets you trace parentage:
UID PID PPID C STIME TTY TIME CMD
root 1 0 0 Jan01 ? 00:00:05 /sbin/init
The practical split: reach for aux when you want resource hogs (%CPU/%MEM), and -ef when you want to see who spawned what (PPID — handy for finding a runaway parent). For a live, refreshing view instead of a snapshot, use top or htop.
Go deeper:
ps(1) man page (man7.org) — the BSD (aux) vs UNIX (-ef) syntaxes and every column (VSZ, RSS, STAT, PPID).