To begin, let's look at some commands you can issue from the UNIX prompt to give you some information about your system. The commands I'll cover are:
iostat
vmstat
netstat
ps
kill
showmount
swapinfo and swap
sar
timex
We'll first look at each of these commands so that you get an understanding of the output produced by them and how this output may be used. There are manual pages for some of the commands in Appendix A.
Please keep in mind that, like all topics we have covered, the output of these commands may differ somewhat among UNIX variants. The basic information produced on most UNIX variants is the same; however, the format of the outputs may differ somewhat. This usually is not significant if you're viewing the outputs; however, if you're writing programs that accept these outputs and manipulate them in some way, then the format of the outputs is important.
Here is a Solaris example executed ten times at five-second intervals:
# iostat 5 10
tty fd0 sd1 sd3 sd6 cpu
tin tout kps tps serv kps tps serv kps tps serv kps tps serv us sy wt id
0 0 0 0 0 0 0 0 3 0 57 0 79 0 0 7 49 43
0 47 0 0 0 0 0 0 14 2 75 0 0 0 0 2 0 98
0 16 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 98
0 16 0 0 0 0 0 0 0 0 0 0 0 0 0 2 0 98
0 16 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 100
0 16 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 100
0 16 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 99
0 16 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 100
0 16 0 0 0 0 0 0 6 1 35 0 0 0 0 4 0 96
0 16 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 100
An HP-UX example includes the -t option executed five times at five-second intervals:
# iostat -t 5 5 tty cpu tin tout us ni sy id 1 58 5 1 10 84 device bps sps msps c1t2d0 0 0.0 1.0 tty cpu tin tout us ni sy id 0 30 0 2 26 72 device bps sps msps c1t2d0 484 249.6 1.0 tty cpu tin tout us ni sy id 0 31 1 3 23 73 device bps sps msps c1t2d0 517 256.1 1.0 tty cpu tin tout us ni sy id 0 35 0 2 23 75 device bps sps msps c1t2d0 456 254.4 1.0 tty cpu tin tout us ni sy id 0 744 1 6 38 55 device bps sps msps c1t2d0 155 83.1 1.0 #
Here is an AIX example executed ten times at five-second intervals: |
# iostat 5 10
tty: tin tout avg-cpu: % user % sys % idle % iowait
0.0 0.0 0.3 1.0 98.4 0.3
Disks: % tm_act Kbps tps Kb_read Kb_wrtn
hdisk0 0.4 2.7 0.4 2366635 959304
hdisk1 0.0 0.0 0.0 18843 37928
hdisk2 0.1 0.6 0.1 269803 423284
hdisk3 0.0 0.0 0.0 20875 172
cd0 0.0 0.0 0.0 14 0
tty: tin tout avg-cpu: % user % sys % idle % iowait
0.0 108.2 0.0 0.2 99.8 0.0
Disks: % tm_act Kbps tps Kb_read Kb_wrtn
hdisk0 0.0 0.0 0.0 0 0
hdisk1 0.0 0.0 0.0 0 0
hdisk2 0.0 0.0 0.0 0 0
hdisk3 0.0 0.0 0.0 0 0
cd0 0.0 0.0 0.0 0 0
tty: tin tout avg-cpu: % user % sys % idle % iowait
0.0 108.4 0.2 0.8 99.0 0.0
Disks: % tm_act Kbps tps Kb_read Kb_wrtn
hdisk0 0.0 0.0 0.0 0 0
hdisk1 0.0 0.0 0.0 0 0
hdisk2 0.0 0.0 0.0 0 0
hdisk3 0.0 0.0 0.0 0 0
cd0 0.0 0.0 0.0 0 0
tty: tin tout avg-cpu: % user % sys % idle % iowait
0.0 108.4 0.4 0.2 99.4 0.0
Disks: % tm_act Kbps tps Kb_read Kb_wrtn
hdisk0 0.0 0.0 0.0 0 0
hdisk1 0.0 0.0 0.0 0 0
hdisk2 0.0 0.0 0.0 0 0
hdisk3 0.0 0.0 0.0 0 0
cd0 0.0 0.0 0.0 0 0
tty: tin tout avg-cpu: % user % sys % idle % iowait
0.0 108.2 0.4 0.6 99.0 0.0
Disks: % tm_act Kbps tps Kb_read Kb_wrtn
hdisk0 0.0 0.0 0.0 0 0
hdisk1 0.0 0.0 0.0 0 0
hdisk2 0.0 0.0 0.0 0 0
hdisk3 0.0 0.0 0.0 0 0
cd0 0.0 0.0 0.0 0 0
tty: tin tout avg-cpu: % user % sys % idle % iowait
0.0 108.4 0.0 0.4 99.6 0.0
Disks: % tm_act Kbps tps Kb_read Kb_wrtn
hdisk0 0.0 0.0 0.0 0 0
hdisk1 0.0 0.0 0.0 0 0
hdisk2 0.0 0.0 0.0 0 0
hdisk3 0.0 0.0 0.0 0 0
cd0 0.0 0.0 0.0 0 0
tty: tin tout avg-cpu: % user % sys % idle % iowait
0.0 108.4 0.6 0.0 99.4 0.0
Disks: % tm_act Kbps tps Kb_read Kb_wrtn
hdisk0 0.0 0.0 0.0 0 0
hdisk1 0.0 0.0 0.0 0 0
hdisk2 0.0 0.0 0.0 0 0
hdisk3 0.0 0.0 0.0 0 0
cd0 0.0 0.0 0.0 0 0
tty: tin tout avg-cpu: % user % sys % idle % iowait
0.0 108.2 0.2 0.8 99.0 0.0
Disks: % tm_act Kbps tps Kb_read Kb_wrtn
hdisk0 0.0 0.0 0.0 0 0
hdisk1 0.0 0.0 0.0 0 0
hdisk2 0.0 0.0 0.0 0 0
hdisk3 0.0 0.0 0.0 0 0
cd0 0.0 0.0 0.0 0 0
tty: tin tout avg-cpu: % user % sys % idle % iowait
0.0 108.4 0.4 0.0 99.6 0.0
Disks: % tm_act Kbps tps Kb_read Kb_wrtn
hdisk0 0.0 0.0 0.0 0 0
hdisk1 0.0 0.0 0.0 0 0
hdisk2 0.0 0.0 0.0 0 0
hdisk3 0.0 0.0 0.0 0 0
cd0 0.0 0.0 0.0 0 0
tty: tin tout avg-cpu: % user % sys % idle % iowait
0.0 108.4 0.4 0.4 99.2 0.0
Disks: % tm_act Kbps tps Kb_read Kb_wrtn
hdisk0 0.0 0.0 0.0 0 0
hdisk1 0.0 0.0 0.0 0 0
hdisk2 0.0 0.0 0.0 0 0
hdisk3 0.0 0.0 0.0 0 0
cd0 0.0 0.0 0.0 0 0
The following are descriptions of the reports you receive with iostat for terminals, the CPU, and mounted file systems. Because the reports are somewhat different, I have included detailed information from the HP-UX output. A more detailed description of these fields is included in the iostat manual page in Appendix A. Most of the fields appear in the outputs; however, the outputs of the commands differ somewhat among UNIX variants. |
For every terminal you have connected (tty), you see a “tin” and “tout,” which represent the number of characters read from your terminal and the number of characters written to your terminal, respectively.
For your CPU, you see the percentage of time spent in user mode (“us”), the percentage of time spent running user processes at a low priority called nice (“ni”), the percentage of time spent in system mode (“sy”), and the percentage of time the CPU is idle (“id”).
For every locally mounted file system, you receive information on the kilobytes transferred per second (“bps”), number of seeks per second (“sps”), and number of milliseconds per average seek (“msps”). For disks that are NFS-mounted or disks on client nodes of your server, you will not receive a report; iostat reports only on locally mounted file systems.
When viewing the output of iostat, there are some parameters to take note of.
First, note that the time that your CPU is spending in the four categories shown. The CPU report is produced with the -t option. I have worked on systems with poor performance that the administrator assumed to be a result of a slow CPU because the “id” number was very high, indicating that the CPU was actually idle most of the time. If the CPU is mostly idle, the chances are that the bottleneck is not the CPU, but may be I/O, memory, or networking. If the CPU is indeed busy most of the time (“id” is very low), see whether any processes are running “nice” (check the “ni” number). It may be that there are some background processes consuming a lot of CPU time that can be changed to run “nice.”
Second, compare the number of transfers taking place. These are usually indicated by something like blocks per second (bps), transfers per second (tps), or seeks per second (sps). These numbers give an indication of the amount of activity taking place on a disk. If one volume is consistently much higher than other volumes, then it may be performing an inordinate amout of the workload. Notice on HP-UX that the milliseconds per average seek (msps) for all disks is always equal to one.
Solaris example:
# vmstat 5 9
procs memory page disk faults cpu
r b w swap free re mf pi po fr de sr f0 s1 s3 s6 in sy cs us sy id
0 0 0 4480 4696 0 0 1 0 0 0 0 0 0 0 79 864 130 297 0 7 92
0 0 0 133020 5916 0 3 0 0 0 0 0 0 0 3 0 102 42 24 0 2 98
0 0 0 133020 5916 0 0 0 0 0 0 0 0 0 0 0 70 48 24 0 0 100
0 0 0 133020 5916 0 0 0 0 0 0 0 0 0 0 0 74 42 24 0 0 100
0 0 0 133020 5916 0 0 0 0 0 0 0 0 0 0 0 35 45 23 0 0 99
0 0 0 133020 5916 0 0 0 0 0 0 0 0 0 0 0 65 66 26 0 0 100
0 0 0 133020 5916 0 0 0 0 0 0 0 0 0 0 0 52 44 23 0 1 99
0 0 0 133020 5916 0 0 0 0 0 0 0 0 0 0 0 53 54 24 0 1 99
0 0 0 133020 5916 0 0 0 0 0 0 0 0 0 1 0 60 53 25 0 2 98
HP-UX example:
# vmstat 5 9
procs memory page faults cpu
r b w avm free re at pi po fr de sr in sy cs us sy id
5 240 0 17646 3979 2 0 0 0 0 0 0 0 778 193 17 3 80
4 242 0 16722 4106 0 0 0 0 0 0 0 814 20649 258 89 10 2
4 240 0 16649 4106 0 0 0 0 0 0 0 83 18384 218 91 9 0
4 240 0 16468 4106 0 0 0 0 0 0 0 792 19552 273 89 11 1
5 239 0 15630 4012 9 0 0 0 0 0 0 804 18295 270 93 8 -1
5 241 0 16087 3934 6 0 0 0 0 0 0 920 21044 392 89 10 0
5 241 0 15313 3952 11 0 0 0 0 0 0 968 20239 431 90 10 0
4 242 0 16577 4043 3 0 0 0 0 0 0 926 19230 409 89 10 0
6 238 0 17453 4122 0 0 0 0 0 0 0 837 19269 299 89 9 2
AIX example:
martyp $ vmstat 5 9 kthr memory page faults cpu ----- ----------- ------------------------ ------------ ----------- r b avm fre re pi po fr sr cy in sy cs us sy id wa 0 0 16604 246 0 0 0 0 2 0 149 79 36 0 1 98 0 0 0 16604 246 0 0 0 0 0 0 153 125 41 0 0 99 0 0 0 16604 246 0 0 0 0 0 0 143 83 33 0 0 99 0 0 0 16604 246 0 0 0 0 0 0 140 94 35 0 1 99 0 0 0 16604 246 0 0 0 0 0 0 166 62 32 0 0 99 0 0 0 16604 246 0 0 0 0 0 0 150 102 38 1 0 99 0 0 0 16604 246 0 0 0 0 0 0 183 78 34 0 0 99 0 0 0 16604 246 0 0 0 0 0 0 132 87 33 0 1 99 0 0 0 16604 246 0 0 0 0 0 0 147 84 38 0 0 99 0
Linux example:
# vmstat 5 5
procs memory swap io system cpu
r b w swpd free buff cache si so bi bo in cs us sy id
1 0 0 9432 1160 656 12024 1 2 14 1 138 274 3 1 96
1 0 0 9684 828 652 12148 0 50 0 14 205 8499 82 18 0
1 0 0 9684 784 652 11508 0 0 0 1 103 8682 81 19 0
1 0 0 9684 800 652 10996 0 0 0 0 101 8683 80 20 0
0 0 0 9772 796 652 9824 12 18 3 4 160 6577 66 17 18
You certainly get a lot for your money out of the vmstat command. Here is a brief description of the categories of information produced by vmstat. I have included a description of the fields in the HP-UX example because of the manual page that appears in Appendix A for HP-UX. You can see, however, that the outputs are very similar. |
Processes are classified into one of three categories: runnable (“r”), blocked on I/O or short-term resources (“b”), or swapped (“w”).
Next you will see information about memory. “avm” is the number of virtual memory pages owned by processes that have run within the last 20 seconds. If this number is roughly the size of physical memory minus your kernel, then you are near forced paging. The “free” column indicates the number of pages on the system's free list. It doesn't mean that the process is finished running and these pages won't be accessed again; it just means that they have not been accessed recently. I suggest that you ignore this column.
Next is paging activity. The first field (“re”) shows the pages that were reclaimed. These pages made it to the free list but were later referenced and had to be salvaged.
Next you see the number of faults in three categories: interrupts per second, which usually come from hardware (“in”), system calls per second (“sy”), and context switches per second (“cs”).
The final output is CPU usage percentage for user (“us”), system (“sy”), and idle (“id”). This is not as complete as the iostat output, which also shows nice entries. |
If you are running an I/O intensive workload you may indeed see a lot of activity in runnable processes (“r”), blocked processes(“b”), and the runnable but swapped (“w”) processes. If you have many runnable but swapped processes, then you probably have an I/O bottleneck.
I use two forms of netstat to obtain network statistics. The first is netstat -i, which shows the state of interfaces that are autoconfigured. Although netstat -i gives a good rundown of the primary LAN interface, such as the network it is on, its name, and so on, it does not show useful statistical information.
The following shows the output of netstat -i:
# netstat -i | ||||||||
---|---|---|---|---|---|---|---|---|
Name | Mtu | Network | Address | Ipkts | Ierrs | Opkts | Oerrs | Col |
lan0 | 1497 | 151.150 | a4410.e.h.c | 242194 | 120 | 107665 | 23 | 19884 |
netstat provides a concise output. Put another way, most of what you get from netstat is useful. Here is a description of the nine fields in the netstat example: |
Name | The name of your network interface (Name), in this case, “lan0.” |
Mtu | The “maximum transmission unit,” which is the maximum packet size sent by the interface card. |
Network | The network address of the LAN to which the interface card is connected (151.150). |
Address | The host name of your system. This is the symbolic name of your system as it appears in the /etc/hosts file if your networking is configured to use /etc/hosts. |
Below is the statistical information. Depending on the system you are using, or revision of OS, you may not see some of these commands:
Ipkts | The number of packets received by the interface card, in this case, “lan0.” |
Ierrs | The number of errors detected on incoming packets by the interface card. |
Opkts | The number of packets transmitted by the interface card. |
Oerrs | The number of errors detected during the transmission of packets by the interface card. |
Col | The number of collisions that resulted from packet traffic. |
Solaris example:
# netstat -I le0 5
input le0 output input (Total) output
packets errs packets errs colls packets errs packets errs colls
116817990 0 3299582 11899 1653100 116993185 0 3474777 11899 1653100
185 0 3 0 0 185 0 3 0 0
273 0 8 0 0 273 0 8 0 0
153 0 3 0 0 153 0 3 0 0
154 0 3 0 0 154 0 3 0 0
126 0 3 0 0 126 0 3 0 0
378 0 2 0 0 378 0 2 0 0
399 0 4 0 0 399 0 4 0 0
286 0 2 0 0 286 0 2 0 0
HP-UX example:
# netstat -I lan0 5
(lan0)-> input output (Total)-> input output
packets errs packets errs colls packets errs packets errs colls
269841735 27 256627585 1 5092223 281472199 27 268258048 1 5092223
1602 0 1238 0 49 1673 0 1309 0 49
1223 0 1048 0 25 1235 0 1060 0 25
1516 0 1151 0 42 1560 0 1195 0 42
1553 0 1188 0 17 1565 0 1200 0 17
2539 0 2180 0 44 2628 0 2269 0 44
3000 0 2193 0 228 3000 0 2193 0 228
2959 0 2213 0 118 3003 0 2257 0 118
2423 0 1981 0 75 2435 0 1993 0 75
AIX example:
# netstat -I en0 5
input (en0) output input (Total) output
packets errs packets errs colls packets errs packets errs colls
46333531 0 1785025 0 0 47426087 0 2913405 0 0
203 0 1 0 0 204 0 2 0 0
298 0 1 0 0 298 0 1 0 0
293 0 1 0 0 304 0 12 0 0
191 0 1 0 0 191 0 1 0 0
150 0 2 0 0 151 0 3 0 0
207 0 3 0 0 218 0 15 0 0
162 0 3 0 0 162 0 4 0 0
120 0 2 0 0 120 0 2 0 0
With this example, you get multiple outputs of what is taking place on the LAN interface, including the totals on the right side of the output. As I mentioned earlier, you may want to ignore the first output, because it includes information over a long time period. This may include a time when your network was idle, and therefore the data may not be important to you.
You can specify the network interface on which you want statistics reported by using -I interface; in the case of the example, it was -I and either le0, lan0, or en0. An interval of five seconds was also used in this example.
Analyzing netstat statistical information is intuitive. You want to verify that the collisions (Colls) are much lower than the packets transmitted (Opkts). Collisions occur on output from your LAN interface. Every collision your LAN interface encounters slows down the network. You will get varying opinions about what is too many collisions. If your collisions are less than 5 percent of “Opkts,” you're probably in good shape and better off spending your time analyzing some other system resource. If this number is high, you may want to consider segmenting your network in some way such as installing networking equipment between portions of the network that don't share a lot of data.
As a rule of thumb, if you reduce the number of packets you are receiving and transmitting (“Ipkts” and “Opkts”), then you will have less overall network traffic and fewer collisions. Keep this in mind as you plan your network or upgrades to your systems. You may want to have two LAN cards in systems that are in constant communication. That way, these systems have a “private” LAN over which to communicate and do not adversely affect the performance of other systems on the network. One LAN interface on each system is devoted to intrasystem communication. This provides a “tight” communication path among systems that usually act as servers. The second LAN interface is used to communicate with any systems that are usually clients on a larger network.
You can also obtain information related to routing with netstat (see Chapter 12). The -r option to netstat shows the routing tables, which you usually want to know about, and the -n option can be used to print network addresses as numbers rather than as names. In the following examples, netstat is issued with the -r option (this will be used when describing the netstat output) and the -rn options, so that you can compare the two outputs: |
$ netstat -r
Routing tables | ||||||
---|---|---|---|---|---|---|
Destination | Gateway | Flags | Refs | Use | Interface | Pmtu |
hp700 | localhost | UH | 0 | 28 | lo0 | 4608 |
default | router1 | UG | 0 | 0 | lan0 | 4608 |
128.185.61 | system1 | U | 347 | 28668 | lan0 | 1500 |
$ netstat -rn
Routing tables | ||||||
---|---|---|---|---|---|---|
Destination | Gateway | Flags | Refs | Use | Interface | Pmtu |
127.0.0.1 | 127.0.0.1 | UH | 0 | 28 | lo0 | 4608 |
default | 128.185.61.1 | UG | 0 | 0 | lan0 | 4608 |
128.185.61 | 128.185.61.2 | U | 347 | 28668 | lan0 | 1500 |
With netstat, some information is provided about the router, which is the middle entry. The -r option shows information about routing, but there are many other useful options to this command are available. Of particular interest in this output is “Flags,” which defines the type of routing that takes place. Here are descriptions of the most common flags, which may be different among UNIX variants, from the manual page in Appendix A.
The second line is for the default route. This entry says to send packets to Router 1 if a more specific route can't be found. In this case, the router has a UG under Flags. Some routers are configured with a U; others, such as the one in this example, with a UG. I've found that I usually end up determining through trial and error whether a U or UG is required. If there is a U in Flags and I am unable to ping a system on the other side of a router, a UG entry usually fixes the problem.
The third line is for the system's network interface, lan0. This means to use this network interface for packets to be sent to 128.185.61.
Knowing about the processes running on your system, and knowing how to stop them, are important to both system administration and performance.
Solaris example:
martyp $ ps -ef
UID PID PPID C STIME TTY TIME CMD
root 0 0 0 Feb 18 ? 0:01 sched
root 1 0 0 Feb 18 ? 1:30 /etc/init -
root 2 0 0 Feb 18 ? 0:02 pageout
root 3 0 1 Feb 18 ? 613:44 fsflush
root 3065 3059 0 Feb 22 ? 5:10 /usr/dt/bin/sdtperfmeter -f -H -r
root 88 1 0 Feb 18 ? 0:01 /usr/sbin/in.routed -q
root 478 1 0 Feb 18 ? 0:00 /usr/lib/saf/sac -t 300
root 94 1 0 Feb 18 ? 2:50 /usr/sbin/rpcbind
root 150 1 0 Feb 18 ? 6:03 /usr/sbin/syslogd
root 96 1 0 Feb 18 ? 0:00 /usr/sbin/keyserv
root 144 1 0 Feb 18 ? 50:37 /usr/lib/autofs/automountd
root 1010 1 0 Apr 12 ? 0:00 /opt/perf/bin/midaemon
root 106 1 0 Feb 18 ? 0:02 /usr/lib/netsvc/yp/ypbind -broadt
root 156 1 0 Feb 18 ? 0:03 /usr/sbin/cron
root 176 1 0 Feb 18 ? 0:00 /usr/lib/lpsched
root 129 1 0 Feb 18 ? 0:00 /usr/lib/nfs/lockd
daemon 130 1 0 Feb 18 ? 0:01 /usr/lib/nfs/statd
root 14798 1 0 Mar 09 ? 31:10 /usr/sbin/nscd
root 133 1 0 Feb 18 ? 0:10 /usr/sbin/inetd -s
root 197 1 0 Feb 18 ? 0:00 /usr/lib/power/powerd
root 196 1 0 Feb 18 ? 0:35 /etc/opt/licenses/lmgrd.ste -c /d
root 213 1 0 Feb 18 ? 4903:09 /usr/sbin/vold
root 199 196 0 Feb 18 ? 0:03 suntechd -T 4 -c /etc/optd
root 219 1 0 Feb 18 ? 0:08 /usr/lib/sendmail -bd -q15m
root 209 1 0 Feb 18 ? 0:05 /usr/lib/utmpd
root 2935 266 0 Feb 22 ? 48:08 /usr/openwin/bin/Xsun :0 -nobanna
root 16795 16763 1 07:51:34 pts/4 0:00 ps -ef
root 2963 2954 0 Feb 22 ? 0:17 /usr/openwin/bin/fbconsole
root 479 1 0 Feb 18 console 0:00 /usr/lib/saf/ttymon -g -h -p sunc
root 10976 1 0 Jun 01 ? 0:00 /opt/perf/bin/ttd
root 7468 1 0 Feb 24 ? 0:13 /opt/perf/bin/pvalarmd
root 266 1 0 Feb 18 ? 0:01 /usr/dt/bin/dtlogin -daemon
martyp 16763 16761 0 07:46:46 pts/4 0:01 -ksh
root 10995 1 0 Jun 01 ? 0:01 /opt/perf/bin/perflbd
root 484 478 0 Feb 18 ? 0:00 /usr/lib/saf/ttymon
root 458 1 0 Feb 18 ? 20:06 /usr/lib/snmp/snmpdx -y -c /etc/f
root 16792 3059 0 07:50:37 ? 0:00 /usr/dt/bin/dtscreen -mode blank
root 471 1 0 Feb 18 ? 0:07 /usr/lib/dmi/dmispd
root 474 1 0 Feb 18 ? 0:00 /usr/lib/dmi/snmpXdmid -s
root 485 458 0 Feb 18 ? 739:44 mibiisa -r -p 32874
root 2954 2936 0 Feb 22 ? 0:01 /bin/ksh /usr/dt/bin/Xsession
root 2936 266 0 Feb 22 ? 0:00 /usr/dt/bin/dtlogin -daemon
root 3061 3059 0 Feb 22 ? 1:32 dtwm
root 3058 1 0 Feb 22 pts/2 0:01 /usr/dt/bin/ttsession
root 712 133 0 Feb 18 ? 0:01 rpc.ttdbserverd
root 11001 11000 0 0:01 <defunct>
root 2938 1 0 Feb 22 ? 0:00 /usr/openwin/bin/fbconsole -d :0
root 2999 2954 0 Feb 22 pts/2 0:16 /usr/dt/bin/sdt_shell -c unt
root 3059 3002 0 Feb 22 pts/2 283:35 /usr/dt/bin/dtsession
root 3063 3059 0 Feb 22 ? 0:03 /usr/dt/bin/dthelpview -helpVolur
root 3099 3062 0 Feb 22 ? 0:13 /usr/dt/bin/dtfile -geometry +700
root 11000 10995 0 Jun 01 ? 0:02 /opt/perf/bin/agdbserver -t alar/
root 3002 2999 0 Feb 22 pts/2 0:01 -ksh -c unset DT; DISPLg
root 730 133 0 Feb 18 ? 1:37 rpc.rstatd
root 3062 3059 0 Feb 22 ? 2:17 /usr/dt/bin/dtfile -geometry +700
root 3067 1 0 Feb 22 ? 0:00 /bin/ksh /usr/dt/bin/sdtvolcheckm
root 3000 1 0 Feb 22 ? 0:00 /usr/dt/bin/dsdm
root 3078 3067 0 Feb 22 ? 0:00 /bin/cat /tmp/.removable/notify0
root 10984 1 0 Jun 01 ? 12:42 /opt/perf/dce/bin/dced -b
root 16761 133 0 07:46:45 ? 0:00 in.telnetd
martyp $
AIX example: |
martyp $ ps -ef
UID PID PPID C STIME TTY TIME CMD
root 1 0 0 Feb 24 - 5:07 /etc/init
root 2208 15520 0 Feb 24 - 8:21 dtwm
root 2664 1 0 Feb 24 - 0:00 /usr/dt/bin/dtlogin -daemon
root 2882 1 0 Feb 24 - 158:41 /usr/sbin/syncd 60
root 3376 2664 5 Feb 24 - 3598:41 /usr/lpp/X11/bin/X -D /usr/lib/
root 3624 2664 0 Feb 24 - 0:00 dtlogin <:0> -daemon
root 3950 1 6 Feb 24 - 5550:30 /usr/lpp/perf/bin/llbd
root 4144 1 0 Feb 24 - 0:00 /usr/lpp/perf/bin/midaemon
root 4490 1 0 Feb 24 - 0:48 /usr/lpp/perf/bin/perflbd
root 4906 1 0 Feb 24 - 0:00 /usr/lib/errdemon
root 5172 1 0 Feb 24 - 0:00 /usr/sbin/srcmstr
root 5724 5172 0 Feb 24 - 9:54 /usr/sbin/syslogd
root 6242 5172 0 Feb 24 - 0:00 /usr/sbin/biod 6
root 6450 5172 0 Feb 24 - 0:02 sendmail: accepting connections
root 6710 5172 0 Feb 24 - 7:34 /usr/sbin/portmap
root 6966 5172 0 Feb 24 - 0:23 /usr/sbin/inetd
root 7224 5172 0 Feb 24 - 1:09 /usr/sbin/timed -S
root 7482 5172 0 Feb 24 - 11:55 /usr/sbin/snmpd
root 8000 1 0 Feb 24 - 9:17 ovspmd
root 8516 8782 0 Feb 24 - 0:00 netfmt -CF
root 8782 1 0 Feb 24 - 0:00 /usr/OV/bin/ntl_reader 0 1 1 1
root 9036 8000 0 Feb 24 - 10:09 ovwdb -O -n5000
root 9288 8000 0 Feb 24 - 0:44 pmd -Au -At -Mu -Mt -m
root 9546 8000 0 Feb 24 - 20:05 trapgend -f
root 9804 8000 0 Feb 24 - 0:28 trapd
root 10062 8000 0 Feb 24 - 0:47 orsd
root 10320 8000 0 Feb 24 - 0:33 ovesmd
root 10578 8000 0 Feb 24 - 0:30 ovelmd
root 10836 8000 0 Feb 24 - 13:12 ovtopmd -O
root 11094 8000 0 Feb 24 - 17:50 netmon -P
root 11352 8000 0 Feb 24 - 0:02 snmpCollect
root 11954 1 0 Feb 24 - 1:22 /usr/sbin/cron
root 12140 5172 0 Feb 24 - 0:01 /usr/lib/netsvc/yp/ypbind
root 12394 5172 0 Feb 24 - 1:39 /usr/sbin/rpc.mountd
root 12652 5172 0 Feb 24 - 0:29 /usr/sbin/nfsd 8
root 12908 5172 0 Feb 24 - 0:00 /usr/sbin/rpc.statd
root 13166 5172 0 Feb 24 - 0:29 /usr/sbin/rpc.lockd
root 13428 1 0 Feb 24 - 0:00 /usr/sbin/uprintfd
root 14190 5172 0 Feb 24 - 72:59 /usr/sbin/automountd
root 14452 5172 0 Feb 24 - 0:17 /usr/sbin/qdaemon
root 14714 5172 0 Feb 24 - 0:00 /usr/sbin/writesrv
root 14992 1 0 Feb 24 - 252:26 /usr/lpp/perf/bin/scopeux
root 15520 3624 1 Feb 24 - 15:29 /usr/dt/bin/dtsession
root 15742 1 0 Feb 24 - 0:00 /usr/lpp/diagnostics/bin/diagd
root 15998 1 0 Feb 24 lft0 0:00 /usr/sbin/getty /dev/console
root 16304 18892 0 Feb 24 pts/0 0:00 /bin/ksh
root 16774 1 0 Feb 24 - 0:00 /usr/lpp/perf/bin/ttd
root 17092 4490 0 Feb 24 - 68:54 /usr/lpp/perf/bin/rep_server -t
root 17370 19186 3 0:00 <defunct>
root 17630 15520 0 Mar 25 - 0:00 /usr/dt/bin/dtexec -open 0 -ttp
root 17898 15520 0 Mar 20 - 0:00 /usr/dt/bin/dtexec -open 0 -ttp
root 18118 19888 0 Feb 24 pts/1 0:00 /bin/ksh
root 18366 6966 0 Feb 24 - 0:00 rpc.ttdbserver 100083 1
root 18446 15520 0 Mar 15 - 0:00 /usr/dt/bin/dtexec -open 0 -ttp
root 18892 15520 0 Feb 24 - 3:46 /usr/dt/bin/dtterm
root 19186 16304 0 Feb 24 pts/0 0:01 /usr/lpp/X11/bin/msmit
root 19450 1 0 Feb 24 - 26:53 /usr/dt/bin/ttsession -s
root 19684 2208 0 Feb 24 - 0:00 /usr/dt/bin/dtexec -open 0 -ttp
root 19888 19684 0 Feb 24 - 0:00 /usr/dt/bin/dtterm
root 20104 15520 0 Feb 27 - 0:00 /usr/dt/bin/dtexec -open 0 -ttp
root 20248 20104 0 Feb 27 - 0:03 /usr/dt/bin/dtscreen
root 20542 29708 0 May 14 - 0:03 /usr/dt/bin/dtscreen
root 20912 26306 0 Apr 05 - 0:03 /usr/dt/bin/dtscreen
root 33558 1 0 May 18 - 3:28 /usr/atria/etc/lockmgr -a /var/
root 33834 6966 3 07:55:49 - 0:00 telnetd
root 34072 1 0 May 18 - 0:00 /usr/atria/etc/albd_server
martyp 36296 36608 13 07:56:07 pts/2 0:00 ps -ef
martyp 36608 33834 1 07:55:50 pts/2 0:00 -ksh
root 37220 15520 0 May 28 - 0:00 /usr/dt/bin/dtexec -open 0 -ttp
HP-UX example (partial listing): |
martyp $ ps -ef
UID PID PPID C STIME TTY TIME COMMAND
root 0 0 0 Mar 9 ? 107:28 swapper
root 1 0 0 Mar 9 ? 2:27 init
root 2 0 0 Mar 9 ? 14:13 vhand
root 3 0 0 Mar 9 ? 114:55 statdaemon
root 4 0 0 Mar 9 ? 5:57 unhashdaemon
root 7 0 0 Mar 9 ? 154:33 ttisr
root 70 0 0 Mar 9 ? 0:01 lvmkd
root 71 0 0 Mar 9 ? 0:01 lvmkd
root 72 0 0 Mar 9 ? 0:01 lvmkd
root 13 0 0 Mar 9 ? 9:54 vx_sched_thread
root 14 0 0 Mar 9 ? 1:54 vx_iflush_thread
root 15 0 0 Mar 9 ? 2:06 vx_ifree_thread
root 16 0 0 Mar 9 ? 2:27 vx_inactive_cache_thread
root 17 0 0 Mar 9 ? 0:40 vx_delxwri_thread
root 18 0 0 Mar 9 ? 0:33 vx_logflush_thread
root 19 0 0 Mar 9 ? 0:07 vx_attrsync_thread
.
.
.
root 69 0 0 Mar 9 ? 0:09 vx_inactive_thread
root 73 0 0 Mar 9 ? 0:01 lvmkd
root 74 0 19 Mar 9 ? 3605:29 netisr
root 75 0 0 Mar 9 ? 0:18 netisr
root 76 0 0 Mar 9 ? 0:17 netisr
root 77 0 0 Mar 9 ? 0:14 netisr
root 78 0 0 Mar 9 ? 0:48 nvsisr
root 79 0 0 Mar 9 ? 0:00 supsched
root 80 0 0 Mar 9 ? 0:00 smpsched
root 81 0 0 Mar 9 ? 0:00 smpsched
root 82 0 0 Mar 9 ? 0:00 sblksched
root 83 0 0 Mar 9 ? 0:00 sblksched
root 84 0 0 Mar 9 ? 0:00 strmem
root 85 0 0 Mar 9 ? 0:00 strweld
root 3730 1 0 16:39:22 console 0:00 /usr/sbin/getty console console
root 404 1 0 Mar 9 ? 3:57 /usr/sbin/swagentd
oracle 919 1 0 15:23:23 ? 0:00 oraclegprd (LOCAL=NO)
root 289 1 2 Mar 9 ? 78:34 /usr/sbin/syncer
root 426 1 0 Mar 9 ? 0:10 /usr/sbin/syslogd -D
root 576 1 0 Mar 9 ? 0:00 /usr/sbin/portmap
root 429 1 0 Mar 9 ? 0:00 /usr/sbin/ptydaemon
root 590 1 0 Mar 9 ? 0:00 /usr/sbin/biod 4
root 442 1 0 Mar 9 ? 0:00 /usr/lbin/nktl_daemon 0 0 0 0 0 1 -2
oracle 8145 1 0 12:02:48 ? 0:00 oraclegprd (LOCAL=NO)
root 591 1 0 Mar 9 ? 0:00 /usr/sbin/biod 4
root 589 1 0 Mar 9 ? 0:00 /usr/sbin/biod 4
root 592 1 0 Mar 9 ? 0:00 /usr/sbin/biod 4
root 604 1 0 Mar 9 ? 0:00 /usr/sbin/rpc.lockd
root 598 1 0 Mar 9 ? 0:00 /usr/sbin/rpc.statd
root 610 1 0 Mar 9 ? 0:16 /usr/sbin/automount -f /etc/auto_master
root 638 1 0 Mar 9 ? 0:06 sendmail: accepting connections
root 618 1 0 Mar 9 ? 0:02 /usr/sbin/inetd
root 645 1 0 Mar 9 ? 5:01 /usr/sbin/snmpdm
root 661 1 0 Mar 9 ? 11:28 /usr/sbin/fddisubagtd
root 711 1 0 Mar 9 ? 30:59 /opt/dce/sbin/rpcd
root 720 1 0 Mar 9 ? 0:00 /usr/sbin/vtdaemon
root 867 777 1 Mar 9 ? 0:00 <defunct>
lp 733 1 0 Mar 9 ? 0:00 /usr/sbin/lpsched
root 777 1 0 Mar 9 ? 8:55 DIAGMON
root 742 1 0 Mar 9 ? 0:15 /usr/sbin/cron
oracle 7880 1 0 11:43:47 ? 0:00 oraclegprd (LOCAL=NO)
root 842 1 0 Mar 9 ? 0:00 /usr/vue/bin/vuelogin
oracle 5625 1 0 07:00:14 ? 0:01 ora_smon_gprd
root 781 1 0 Mar 9 ? 0:00 /usr/sbin/envd
root 833 777 0 Mar 9 ? 0:00 DEMLOG DEMLOG;DEMLOG;0;0;
root 813 1 0 Mar 9 ? 0:00 /usr/sbin/nfsd 4
root 807 1 0 Mar 9 ? 0:00 /usr/sbin/rpc.mountd
root 815 813 0 Mar 9 ? 0:00 /usr/sbin/nfsd 4
root 817 813 0 Mar 9 ? 0:00 /usr/sbin/nfsd 4
root 835 777 0 Mar 9 ? 0:13 PSMON PSMON;PSMON;0;0;
Here is a brief description of the headings:
UID | The user ID of the process owner. |
PID | The process ID (you can use this number to kill the process). |
PPID | The process ID of the parent process. |
C | Processor utilization. On a multi-processor system, you may see this number go beyond 100%. It could potentially go to 100% per processor, so a two-processor system may show 200% utilization. This varies among UNIX variants. |
STIME | The start time of the process. |
TTY | The controlling terminal for the process. |
TIME | The cumulative execution time for the process. |
COMMAND | The command name and arguments. |
ps gives a quick profile of the processes running on your system. To get more detailed information, you can include the "l" option, which includes a lot of useful additional information, as shown in the following example: |
martyp $ ps -efl
F S UID PID PPID C PRI NI ADDR SZ WCHAN STIME TTY D
19 T root 0 0 0 0 SY f026f7f0 0 Feb 18 ? d
8 S root 1 0 0 41 20 f5b90808 175 f5b90a30 Feb 18 ? -
19 S root 2 0 0 0 SY f5b90108 0 f0283fd0 Feb 18 ? t
19 S root 3 0 0 0 SY f5b8fa08 0 f0287a44 Feb 18 ? 6h
8 S root 3065 3059 0 40 20 f626d040 1639 f62aab96 Feb 22 ? c
8 S root 88 1 0 40 20 f5b8d708 377 f5b59df6 Feb 18 ? q
8 S root 478 1 0 41 20 f5b8ec08 388 f5b51bb8 Feb 18 ? 0
8 S root 94 1 0 41 20 f5b8d008 527 f5b59e46 Feb 18 ? d
8 S root 150 1 0 41 20 f5da1a10 808 f5b59806 Feb 18 ? d
8 S root 96 1 0 67 20 f5da2810 535 f5b59ad6 Feb 18 ? v
8 S root 144 1 0 41 20 f5da0c10 2694 ef69f61c Feb 18 ? 5d
8 S root 1010 1 0 0 RT f61da330 496 f5dbec1c Apr 12 ? n
8 S root 106 1 0 41 20 f5da1310 485 f5b59e96 Feb 18 ? s
8 S root 156 1 0 51 20 f5b8de08 446 f5b51eb8 Feb 18 ? n
8 S root 176 1 0 53 20 f5da2110 740 f5b59036 Feb 18 ? d
8 S root 129 1 0 56 20 f5d9fe10 447 f5b59cb6 Feb 18 ? d
8 S daemon 130 1 0 41 20 f5d9f710 564 f5b59b76 Feb 18 ? d
8 S root 14798 1 0 45 20 f5b8e508 616 f5b8e730 Mar 09 ? 3d
8 S root 133 1 0 51 20 f5e18818 507 f5b59c66 Feb 18 ? s
8 S root 197 1 0 63 20 f5e15e18 284 f5e16040 Feb 18 ? d
8 S root 196 1 0 41 20 f5da0510 429 f5c68f8e Feb 18 ? c
8 S root 213 1 0 41 20 f5e16518 586 f5c68b2e Feb 18 ? 4d
8 S root 199 196 0 41 20 f5e16c18 451 f5b59f86 Feb 18 ? i
8 S root 219 1 0 41 20 f5e17318 658 f5b59d06 Feb 18 ? m
8 S root 209 1 0 41 20 f5e18118 234 f5c68e4e Feb 18 ? d
8 S root 2935 266 0 40 20 f61db130 2473 f62aaa56 Feb 22 ? 4
8 S root 16800 3059 1 81 30 f626f340 1466 f61b345e 07:59:40 ? k
8 S root 2963 2954 0 40 20 f5f52028 513 f61b313e Feb 22 ? e
8 S root 479 1 0 55 20 f5ee7120 407 f5fde2c6 Feb 18 console g
8 S root 10976 1 0 65 20 f5f55828 478 f5c6853e Jun 01 ? d
8 S root 7468 1 0 46 20 f621da38 2851 8306c Feb 24 ? d
8 S root 266 1 0 41 20 f5ee5520 1601 f5c6858e Feb 18 ? n
8 S martyp 16763 16761 0 51 20 f6270140 429 f62701ac 07:46:46 pts/4 h
8 S root 10995 1 0 41 20 f5b8f308 2350 f5fde5e6 Jun 01 ? d
8 S root 484 478 0 41 20 f5ee4e20 408 f5ee5048 Feb 18 ? n
8 S root 458 1 0 41 20 f5f54a28 504 f5fde906 Feb 18 ? 2m
8 O root 16802 16763 1 61 20 f5ee7820 220 08:00:05 pts/4 l
8 S root 471 1 0 41 20 f5f53c28 658 f5fde726 Feb 18 ? d
8 S root 474 1 0 51 20 f5f53528 804 f61a58b6 Feb 18 ? g
8 S root 485 458 0 40 20 f5f52e28 734 f607ecde Feb 18 ? 74
8 S root 2954 2936 0 40 20 f626e540 433 f626e5ac Feb 22 ? n
8 S root 2936 266 0 66 20 f5ee4720 1637 f5ee478c Feb 22 ? n
8 S root 3061 3059 0 40 20 f5e17a18 2041 f61b359e Feb 22 ? m
8 S root 3058 1 0 40 20 f61daa30 1067 f62aadc6 Feb 22 pts/2 n
8 S root 712 133 0 41 20 f61d8e30 798 f61b390e Feb 18 ? d
8 Z root 11001 11000 0 0 >
8 S root 2938 1 0 60 20 f5ee6320 513 f601bfb6 Feb 22 ? 0
8 S root 2999 2954 0 40 20 f621e138 1450 f61b33be Feb 22 pts/2 t
8 S root 3059 3002 1 51 20 f626de40 4010 f62aafa6 Feb 22 pts/2 2n
8 S root 3063 3059 0 50 20 f621e838 1952 f62aa556 Feb 22 ?
8 S root 3099 3062 0 40 20 f5f52728 2275 f60a1d18 Feb 22 ? 0
8 S root 11000 10995 0 48 20 f626d740 2312 55694 Jun 01 ? e
8 S root 3002 2999 0 43 20 f61d8730 427 f61d879c Feb 22 pts/2 =
8 S root 730 133 0 40 20 f61d9530 422 f62aa9b6 Feb 18 ? d
8 S root 3062 3059 0 61 20 f621b738 2275 f62aa506 Feb 22 ? 0
8 S root 3067 1 0 40 20 f5ee5c20 424 f5ee5c8c Feb 22 ? d
8 S root 3000 1 0 40 20 f61d8030 518 f62aa8c6 Feb 22 ? m
8 S root 3078 3067 0 40 20 f61d9c30 211 f5b512b8 Feb 22 ? 0
8 S root 10984 1 0 41 20 f5f54328 2484 eee46e84 Jun 01 ? 1b
8 S root 16761 133 0 44 20 f5ee4020 411 f5c6894e 07:46:45 ? d
martyp $
In this example, the first column is F for flags. F provides octal information about whether the process is swapped, in core, a system process, and so on. The octal value sometimes varies from system to system, so check the manual pages for your system to see the octal value of the flags.
S is for state. The state can be sleeping, as indicated by S for most of the processes shown in the example, waiting, running, intermediate, terminated, and so on. Again, some of these values may vary from system to system, so check your manual pages.
Some additional useful information in this output are: NI for the nice value, ADDR for the memory address of the process, SZ for the size of the process in physical pages, and WCHAN, which is the event for which the process is waiting.
18.116.12.95