System Information (ps, top, df, free)

Category: Linux Command Basics
Type: Linux Commands
Generated on: 2025-07-10 03:06:56
For: System Administration, Development & Technical Interviews

Linux System Information Cheat Sheet: ps, top, df, free

This cheat sheet provides a quick reference for essential Linux commands used to monitor system processes, disk space, and memory usage. It caters to both beginners and experienced system administrators and developers.

1. Command Overview

ps (Process Status): Displays information about running processes. Useful for identifying resource-intensive processes, finding process IDs (PIDs), and understanding process relationships.
top (Table of Processes): Provides a dynamic, real-time view of system processes, including CPU and memory usage. Great for identifying performance bottlenecks.
df (Disk Free): Reports file system disk space usage. Essential for monitoring disk space and preventing system crashes due to full disks.
free (Memory Usage): Displays the amount of free and used memory in the system. Crucial for understanding memory pressure and identifying potential memory leaks.

2. Basic Syntax

ps: ps [options]
top: top [options]
df: df [options] [file|directory]
free: free [options]

3. Practical Examples

3.1 ps Examples:

List all processes for the current user:

ps

PID TTY          TIME CMD
1234 pts/0    00:00:00 bash
5678 pts/0    00:00:00 ps

List all processes on the system (including those run by other users):

ps aux

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.0  16708  2548 ?        Ss   Jan01   0:01 /sbin/init
user      1234  0.0  0.1 299540 10340 pts/0    Ss   Jan01   0:00 bash
user      5678  0.0  0.0  23532  1972 pts/0    R+   Jan01   0:00 ps aux

List processes by user:

ps -u username

PID TTY          TIME CMD
1234 pts/0    00:00:00 bash
5678 pts/0    00:00:00 ps

Find a process by name (using grep):

ps aux | grep "process_name"

user     7890  0.0  0.1 345678 12345 ?        Sl   Jan01   0:00 /path/to/process_name

3.2 top Examples:

Run top in interactive mode:
Terminal window
```
top
```
(Press q to quit)
Run top and display the top 10 CPU-consuming processes:
Terminal window
```
top -n 1 -b | head -n 17
```
(This runs top once, outputs to standard output in batch mode, and takes the first 17 lines which contain the header and the top 10 processes). Note: The number of lines to head depends on the number of lines top displays. You can also redirect to a file for later analysis.
Run top with a delay of 5 seconds:
Terminal window
```
top -d 5
```

3.3 df Examples:

Display disk space usage in human-readable format (KB, MB, GB):

df -h

Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1        20G   12G  7.5G  62% /
/dev/sdb1       100G   80G   20G  80% /data

Display disk space usage for a specific directory:

df -h /path/to/directory

Filesystem      Size  Used Avail Use% Mounted on
/dev/sdb1       100G   80G   20G  80% /data

Display disk space usage in inodes instead of blocks:

df -i

Filesystem      Inodes  IUsed   IFree IUse% Mounted on
/dev/sda1      1310720 123456 1187264   10% /
/dev/sdb1      6553600 600000 5953600    9% /data

3.4 free Examples:

Display memory usage in kilobytes:

free

              total        used        free      shared  buff/cache   available
Mem:        8175632     1234567     6941065      123456      2345678     7890123
Swap:       2097152           0     2097152

Display memory usage in human-readable format (KB, MB, GB):

free -h

              total        used        free      shared  buff/cache   available
Mem:           7.8G        1.2G        6.6G        120M        2.2G        7.5G
Swap:          2.0G          0B        2.0G

Display memory usage continuously every 2 seconds:
Terminal window
```
free -s 2
```
Display memory usage in megabytes:
Terminal window
```
free -m
```

4. Common Options

4.1 ps Options:

-a: Select all processes on a terminal.
-u <user>: Select processes owned by the specified user.
-x: Include processes without controlling terminals.
-e: Select all processes.
aux: A combination of options that provides a comprehensive listing (user, PID, CPU%, MEM%, VSZ, RSS, TTY, STAT, START, TIME, COMMAND). a selects processes on all terminals, x includes processes without controlling terminals, and u displays user-oriented output.
-f: Full listing. Displays the command with all its arguments.
-p <pid>: Select process by PID.

4.2 top Options:

-d <seconds>: Specify the delay between updates in seconds.
-n <iterations>: Specify the number of iterations before exiting.
-u <user>: Display processes owned by the specified user.
-p <pid>: Monitor specific process IDs.
-b: Batch mode operation. Useful for scripting and logging.

4.3 df Options:

-h: Human-readable output (KB, MB, GB).
-i: Display inode information instead of block usage.
-T: Show file system type.
-a: Include all file systems, even those with 0 blocks.
-B <size>: Scale sizes by before printing them. For example, -B M for megabytes.

4.4 free Options:

-h: Human-readable output (KB, MB, GB).
-m: Display memory in megabytes.
-k: Display memory in kilobytes (default).
-g: Display memory in gigabytes.
-s <seconds>: Continuously display memory usage every .
-t: Display a total line at the bottom.

5. Advanced Usage

5.1 Combining Commands:

Find the process ID (PID) of a process and then kill it (WARNING: Use with caution):
Terminal window
```
PID=$(ps aux | grep "process_name" | grep -v grep | awk '{print $2}')
if [ -n "$PID" ]; then
  kill -9 $PID
  echo "Process with PID $PID killed."
else
  echo "Process not found."
fi
```
Explanation:
1. ps aux | grep "process_name": Finds lines containing “process_name.”
2. grep -v grep: Excludes the grep process itself from the results.
3. awk '{print $2}': Extracts the second field (the PID) from the output.
4. kill -9 $PID: Sends a SIGKILL signal (signal 9) to the process, forcefully terminating it. Use with extreme caution as it can lead to data loss. Consider using kill $PID first to allow a graceful shutdown.
Monitoring Disk I/O using top: While top shows CPU and memory, you can often infer disk I/O bottlenecks by observing processes spending a lot of time in the “D” (uninterruptible sleep) state. For more detailed disk I/O monitoring, use iotop.

5.2 Scripting:

Check for low disk space and send an email alert:
```
#!/bin/bash

THRESHOLD=90 # Percentage of disk usage
MOUNT_POINT="/"

USAGE=$(df -h | grep "$MOUNT_POINT" | awk '{print substr($5,1,length($5)-1)}')

if [ ${USAGE%.*} -ge $THRESHOLD ]; then
  echo "Warning: Disk usage on $MOUNT_POINT is above $THRESHOLD% ($USAGE%)" | mail -s "Disk Space Alert" your_email@example.com
fi
```
Explanation:
1. THRESHOLD=90: Sets the threshold for disk usage (90%).
2. MOUNT_POINT="/": Specifies the mount point to check (root directory).
3. USAGE=$(df -h | grep "$MOUNT_POINT" | awk '{print substr($5,1,length($5)-1)}'): Gets the disk usage percentage from df -h output.
4. if [ ${USAGE%.*} -ge $THRESHOLD ]: Checks if the disk usage is above the threshold.
5. echo "Warning..." | mail ...: Sends an email alert if the threshold is exceeded. Requires mail or a similar mail utility to be configured.

6. Tips & Tricks

ps auxf: Displays a process tree, showing parent-child relationships. Useful for understanding process hierarchies.
top Interactive Commands: While top is running, you can use various keys to sort, filter, and change the display. Press h for help. Common ones include:
- M: Sort by memory usage.
- P: Sort by CPU usage.
- k: Kill a process.
- 1: Show each CPU core individually.
Monitoring Specific Resources with vmstat and iostat: While free gives memory overview, vmstat provides more detailed memory statistics (swap usage, I/O). iostat provides detailed disk I/O statistics.
Use watch to periodically run commands: watch -n 5 df -h will run df -h every 5 seconds.
Understanding free output: The available column in free -h represents the best estimate of how much memory is available for starting new applications, without swapping. It accounts for file cache that can be dropped if needed.

7. Troubleshooting

ps not showing all processes: Ensure you are using ps aux to see all processes regardless of user or terminal.
df showing incorrect disk space: This can happen if files are deleted but still held open by running processes. Restarting the process or using lsof to identify the open files can help.
free showing low free memory: This is normal on Linux. The kernel aggressively caches files in memory. Use the available column to get a better estimate of usable memory. High swap usage indicates a true memory shortage.
top showing high CPU usage by kswapd0: This indicates the system is swapping heavily, likely due to memory pressure. Investigate memory usage and consider adding more RAM.
Permission denied errors: Ensure you have the necessary permissions to run the commands, especially when trying to view processes owned by other users. Use sudo if necessary.

8. Related Commands

lsof (List Open Files): Lists all open files and the processes using them. Useful for identifying which processes are using a particular file or directory.
vmstat (Virtual Memory Statistics): Reports information about processes, memory, paging, block I/O, traps, and CPU activity.
iostat (Input/Output Statistics): Reports CPU utilization and disk I/O statistics.
iotop (I/O Top): Similar to top, but displays real-time disk I/O usage.
kill: Sends a signal to a process, usually to terminate it.
pmap (Process Memory Map): Reports the memory map of a process.
du (Disk Usage): Estimates file space usage. Useful for finding large files or directories.

This cheat sheet should provide a solid foundation for understanding and using these essential Linux system information commands. Remember to practice and experiment to become proficient. Always exercise caution when using commands that can potentially impact system stability or data integrity.