ps — List a snapshot of currently running processes across all 5 shells
Equivalents in every shell
ps auxps auxps auxGet-ProcessAliased as `ps` and `gps`. Unix `ps` flags (`aux`, `-ef`) will error — PowerShell `ps` is a different cmdlet, not the GNU binary.
tasklistAdd `/v` for verbose (window title, user), `/svc` to list services per PID, `/fo csv` for machine-parseable output.
Worked examples
Find a process by name
ps aux | grep [n]odeGet-Process nodetasklist /fi "imagename eq node.exe"Show PID, parent PID, and full command line
ps -eo pid,ppid,cmdGet-CimInstance Win32_Process | Select-Object ProcessId, ParentProcessId, CommandLinewmic process get processid,parentprocessid,commandlineTop 10 processes by memory
ps aux --sort=-%mem | head -n 11Get-Process | Sort-Object WorkingSet64 -Desc | Select-Object -First 10Gotchas
- BSD-style (`ps aux`) and System V-style (`ps -ef`) flags both work on Linux, but only BSD-style works on macOS without `-A`. Pick the one your scripts target.
- PowerShell `ps` is an alias for `Get-Process` — running `ps aux` inside PowerShell errors. Either use `Get-Process` directly or shell out: `bash -c "ps aux"`.
- `tasklist` does not show parent PID. Use `Get-CimInstance Win32_Process` (or `wmic`, which Microsoft removed from default Windows 11 24H2 installs) when you need the process tree.
- Memory columns differ by tool: `ps` `RSS` is resident set in KB; `Get-Process` `WS` (WorkingSet) is bytes; `tasklist` "Mem Usage" is KB with thousands separators — don’t compare across tools without converting.
WSL & PowerShell Core notes
Related glossary
Common tasks using ps
- Count the running processes
Report how many processes are alive — useful for load testing, capacity baselining, or detecting fork-bomb / runaway-parallelism conditions.
- Find a process by its current working directory
Locate which PIDs have a specific directory as their CWD — for unmounting a busy filesystem, debugging "device busy" errors, or auditing what is running out of a particular path.
- Find a process ID by name
Look up the PID(s) of a running process given its executable name — the lookup that precedes most kill / signal / inspect operations.
- Find processes using the most CPU
List the top CPU-consuming processes — useful for performance triage, runaway-script detection, and capacity planning.
- Get how long a process has been running
Find the wall-clock age of a process — how long ago it started — for debugging stuck daemons, validating a recent restart, or pinning a leak to "this process has been up for 47 days".
- Get the memory usage of a specific process
Read the RAM footprint of one running PID — RSS, virtual size, or proportional share — for sizing investigations, leak hunts, and "is this process growing" longitudinal checks.
- Kill a process by name
Terminate every running process whose executable matches a given name.
- Kill all processes of a user
Terminate every process owned by a given user — useful for forced logout, cleanup, and runaway-session containment.
- List zombie processes
Find defunct child processes whose parent forgot to `wait()` for them — the classic "Z" state — for triaging fork-bomb-like leaks, badly-written supervisors, and PID-table exhaustion incidents.
- Monitor CPU and memory live
Watch CPU and memory utilisation continuously from a shell — for triage, capacity planning, and detecting transient spikes that a one-shot ps would miss.
- Run a command when a file changes
Auto-execute a build / test / reload step the moment a watched file is saved — the dev-loop primitive behind every "live-reload" tool, without committing to a specific framework.
- Show the process tree
Render the parent/child relationships between running processes — useful for tracing rogue children, debugging fork bombs, and understanding shell-spawned subprocess chains.
- Show the top processes by memory usage
Identify which running processes consume the most RAM — for debugging memory pressure, leak hunts, or "what is eating my laptop".