procs ps Replacement

procs cheatsheet — modern ps replacement with colors and filtering. procs nginx, procs --tree, procs --sort cpu, procs --watch. Better process listing than ps.

5 min read

What it is

procs is a modern, enhanced replacement for ps that offers better output formatting, interactive filtering, and more detailed process information.

Installation

Linux:

sudo apt update && sudo apt install procs
# or
sudo dnf install procs
# or
sudo pacman -S procs

macOS:

brew install procs

Windows: (Windows support is experimental and may have limitations. It’s generally recommended to use procs on Linux/macOS or via WSL.)

winget install procs
# or
scoop install procs

Core Concepts

procs displays processes with a focus on rich information and interactivity. Key differences from ps include:

Colorized Output: By default, output is colorized for readability.
Interactive Filtering: You can type directly into the procs output to filter processes in real-time.
Expanded Information: Includes more details like I/O stats, CPU usage over time, and network connections by default.
Tree View: Easily visualize process parent-child relationships.

Commands / Usage

Basic Process Listing

List all processes:
```
procs
```
Displays a table of running processes with detailed columns.
List processes for a specific user:
```
procs --user root
```
Shows only processes owned by the root user.
List processes by a specific command name:
```
procs --name firefox
```
Filters to show processes whose command name contains "firefox".
List processes with specific PIDs:
```
procs --pid 1234 --pid 5678
```
Shows only processes with PIDs 1234 and 5678.
List processes by parent PID (PPID):
```
procs --ppid 1
```
Shows processes whose parent process ID is 1 (typically init or systemd).

Interactive Filtering and Control

Enter interactive mode:
```
procs
```
Once procs is running, you can type directly into the terminal to filter the list.
- Type firefox to see only processes related to Firefox.
- Type ^root to find processes owned by root.
- Press Ctrl+C to exit interactive mode.
Toggle color output:
```
procs --color off
```
Disables color highlighting in the output.
Force color output:
```
procs --color on
```
Enables color highlighting even if procs doesn’t detect a TTY.

Process Details and Sorting

Show process tree view:
```
procs --tree
```
Displays processes in a hierarchical tree structure.
Sort by CPU usage (descending):
```
procs --sort cpu:desc
```
Lists processes with the highest CPU usage at the top.
Sort by memory usage (ascending):
```
procs --sort mem:asc
```
Lists processes with the lowest memory usage at the top.
Sort by process name:
```
procs --sort name:asc
```
Sorts the process list alphabetically by command name.
Show only specific columns:
```
procs --display pid,cpu,mem,comm
```
Only shows the PID, CPU usage, Memory usage, and Command Name columns.
Show all available columns:
```
procs --display all
```
Lists all possible columns procs can display.
Add more columns to default display:
```
procs --extra pid,ppid,user,cpu,mem,io,net,cmd
```
Shows default columns plus PID, PPID, User, CPU, Memory, I/O, Network, and full Command.

Killing Processes

Send SIGTERM to a process:
```
procs --kill 1234
```
Attempts to gracefully terminate process with PID 1234.
Send SIGKILL to a process:
```
procs --kill 1234 --signal KILL
```
Forcefully terminates process with PID 1234.
Kill multiple processes:
```
procs --pid 1234 --pid 5678 --kill 1234 --kill 5678
```
Kills processes 1234 and 5678.
Kill all processes matching a name (use with caution!):
```
procs --name "unwanted_process" --kill --signal KILL
```
Forcefully kills all processes whose command name contains "unwanted_process".

Filtering Options

Filter by CPU usage greater than a percentage:
```
procs --cpu-min 10
```
Shows processes using more than 10% CPU.
Filter by memory usage greater than a percentage:
```
procs --mem-min 5
```
Shows processes using more than 5% of memory.
Filter by I/O read rate:
```
procs --io-read-min 1M
```
Shows processes with a read rate of at least 1 Megabyte per second.
Filter by I/O write rate:
```
procs --io-write-max 0
```
Shows processes with no write activity.
Filter by network traffic (received):
```
procs --net-recv-min 10k
```
Shows processes receiving at least 10 Kilobytes per second.
Filter by network traffic (sent):
```
procs --net-send-max 1k
```
Shows processes sending less than 1 Kilobyte per second.
Exclude processes by PID:
```
procs --exclude-pid 1234
```
Shows all processes except the one with PID 1234.
Exclude processes by name:
```
procs --exclude-name systemd
```
Shows all processes except those named "systemd".

Other Options

Update interval:
```
procs --interval 2
```
Updates the process list every 2 seconds (default is 1 second).
Show process status:
```
procs --status running
```
Show only processes in the 'running' state. Valid states include: running, sleeping, disk-sleep, stopped, zombie, trace-stop, dead, wake-kill, waking, parser.
Show command line arguments:
```
procs --cmdline
```
Displays the full command line with arguments for each process.

Common Patterns

Find and kill a runaway process:

procs --sort cpu:desc | head -n 10 # View top 10 CPU consumers
procs --name "apache2" --sort mem:desc # Find memory-hungry apache processes
procs --name "bad_script.sh" --kill --signal KILL # Kill all instances of a bad script

Monitor network activity of specific services:

procs --name "nginx" --extra net
procs --user www-data --extra net --sort net:desc # See what www-data processes are sending/receiving

Identify processes with high I/O wait:

procs --sort io:desc --extra io # Find processes doing heavy disk I/O

View processes in a tree, filtered by user:
```
procs --user myuser --tree
```

Batch kill processes by name (use with extreme caution):

# First, list them to be sure:
procs --name "old_service"
# Then, if confident, kill them:
procs --name "old_service" --kill --signal KILL

Combine interactive filtering with sorting: Run procs, type python to filter, then press Shift+M to sort by memory.

Gotchas

Permissions for killing: You can only kill processes that you own, or if you are running procs as root.
--kill with --name or --user: When using --kill with broad filters like --name or --user, procs will attempt to kill all matching processes. Double-check your filters before executing.
Signal names: The --signal option accepts standard signal names (e.g., KILL, TERM, HUP). procs will often default to TERM if not specified.
Interactive mode limitations: While interactive filtering is powerful, complex regex might be slow or behave unexpectedly. For advanced filtering, using command-line arguments is more robust.
Resource Usage: procs itself consumes some system resources. For extremely low-resource environments or when monitoring a very large number of processes, its overhead might be noticeable compared to ps.
Windows Experimental: Network and I/O statistics might be less reliable or unavailable on Windows due to OS differences.