<BR></FONT></A></CENTER></H3>

<P>You have probably noticed that, while throughout the rest of this chapter the commands are listed under the topic in which they are used (for example, nfsstat is listed in the section &quot;Monitoring Network Performance&quot;), this section is 
dedicated to just one command. What's so special about ps? It is singled out in this manner because of the way that it is used in the performance monitoring process. It is a starting point for generating theories (for example, processes are using up so 
much memory that you are paging and that is slowing down the system). Conversely, it is an ending point for confirming theories (for example, here is a burst of network activity&#151;I wonder if it is caused by that communications test job that the 
programmers keep running?). Since it is so pivotal, and provides a unique snapshot of the processes on the system, ps is given its own section.

<BR></P>

<P>One of the most valuable commands for performance monitoring is the ps command. It enables you to monitor the status of the active processes on the system. Remember the words from the movie Casablanca, &quot;round up the usual suspects&quot;? Well, ps 
helps to identify the usual suspects (that is, suspect processes that could be using inordinate resources). Then you can proceed to determine which of the suspects is actually guilty of causing the performance degradation. It is at once a powerful tool and 

a source of overhead for the system itself. Using various options, the following information is shown:

<BR></P>

<TABLE BORDER>

<TR>

<TD>

<P>Current status of the process</P>

<TD>

<P>Process ID</P>

<TR>

<TD>

<P>Parent process ID</P>

<TD>

<P>User ID</P>

<TR>

<TD>

<P>Scheduling class</P>

<TD>

<P>Priority</P>

<TR>

<TD>

<P>Address of process</P>

<TD>

<P>Memory used</P>

<TR>

<TD>

<P>CPU time used</P>

<TD>

<P><BR></P></TABLE>

<P>Using ps provides you a snapshot of the system's active processes. It is used in conjunction with other commands throughout this section. Frequently, you will look at a report from a command, for example vmstat, and then look to ps either to confirm or 

to deny a theory you have come up with about the nature of your system's problem. The particular performance problem that motivated you to look at ps in the first place may have been caused by a process that is already off the list. It provides a series of 

clues to use in generating theories that can then be tested by detailed analysis of the particular subsystem.

<BR></P>

<P>The ps command is described in detail in Chapter 19, &quot;Administrating Processes.&quot; The following are the fields that are important in terms of performance tuning:

<BR></P>

<TABLE BORDER>

<TR>

<TD>

<PRE><I>Field</I>

<BR></PRE>

<TD>

<PRE><I><BR></I>

<BR></PRE>

<TD>

<PRE><I>Description</I>

<BR></PRE>

<TR>

<TD>

<P>F</P>

<TD>

<P><BR></P>

<TD>

<P>Flags that indicate the process's current state and are calculated by adding each of the hexadecimal values:</P>

<TR>

<TD>

<P><BR></P>

<TD>

<P>00</P>

<TD>

<P>Process has terminated</P>

<TR>

<TD>

<P><BR></P>

<TD>

<P>01</P>

<TD>

<P>System process, always in memory</P>

<TR>

<TD>

<P><BR></P>

<TD>

<P>02</P>

<TD>

<P>Process is being traced by its parent</P>

<TR>

<TD>

<P><BR></P>

<TD>

<P>04</P>

<TD>

<P>Process is being traced by parent, and is stopped</P>

<TR>

<TD>

<P><BR></P>

<TD>

<P>08</P>

<TD>

<P>Process cannot be awakened by a signal</P>

<TR>

<TD>

<P><BR></P>

<TD>

<P>10</P>

<TD>

<P>Process is in memory and locked, pending an event</P>

<TR>

<TD>

<P><BR></P>

<TD>

<P>20</P>

<TD>

<P>Process cannot be swapped</P>

<TR>

<TD>

<P>S</P>

<TD>

<P><BR></P>

<TD>

<P>The current state of the process, as indicated by one of the following letters:</P>

<TR>

<TD>

<P><BR></P>

<TD>

<P>O</P>

<TD>

<P>Process is currently running on the processor</P>

<TR>

<TD>

<P><BR></P>

<TD>

<P>S</P>

<TD>

<P>Process is sleeping, waiting for an I/O event (including terminal I/O) to complete</P>

<TR>

<TD>

<P><BR></P>

<TD>

<P>R</P>

<TD>

<P>Process is ready to run</P>

<TR>

<TD>

<P><BR></P>

<TD>

<P>I</P>

<TD>

<P>Process is idle</P>

<TR>

<TD>

<P><BR></P>

<TD>

<P>Z</P>

<TD>

<P>Process is a zombie process (it has terminated, and the parent is not waiting but is still in the process table)</P>

<TR>

<TD>

<P><BR></P>

<TD>

<P>T</P>

<TD>

<P>Process is stopped because of parent tracing it</P>

<TR>

<TD>

<P><BR></P>

<TD>

<P>X</P>

<TD>

<P>Process is waiting for more memory</P>

<TR>

<TD>

<P>UID</P>

<TD>

<P><BR></P>

<TD>

<P>User ID of the process's owner</P>

<TR>

<TD>

<P>PID</P>

<TD>

<P><BR></P>

<TD>

<P>Process ID number</P>

<TR>

<TD>

<P>PPID</P>

<TD>

<P><BR></P>

<TD>

<P>Parent process ID number</P>

<TR>

<TD>

<P>C</P>

<TD>

<P><BR></P>

<TD>

<P>CPU utilization for scheduling (not shown when -c is used)</P>

<TR>

<TD>

<P>CLS</P>

<TD>

<P><BR></P>

<TD>

<P>Scheduling class, real-time, time sharing, or system (only shown when the -c option is used)</P>

<TR>

<TD>

<P>PRI</P>

<TD>

<P><BR></P>

<TD>

<P>Process scheduling priority (higher numbers mean lower priorities).</P>

<TR>

<TD>

<P>NI</P>

<TD>

<P><BR></P>

<TD>

<P>Process nice number (used in scheduling priorities&#151;raising the number lowers the priority so the process gets less CPU time)</P>

<TR>

<TD>

<P>SZ</P>

<TD>

<P><BR></P>

<TD>

<P>The amount of virtual memory required by the process (This is a good indication of the memory load the process places on the systems memory.)</P>

<TR>

<TD>

<P>TTY</P>

<TD>

<P><BR></P>

<TD>

<P>The terminal that started the process, or its parent (A ? indicates that no terminal exists.)</P>

<TR>

<TD>

<P>TIME</P>

<TD>