Syntax
UPPERCASE words are placeholders to replace. Brackets in the syntax line describe optional arguments; do not type those brackets literally.
ps -eo FIELD_LIST [--sort=FIELD]Example
ps -eo pid,ppid,comm,%cpu,%mem --sort=-%cpuExpected result
A snapshot containing PID, parent PID, command name, CPU percentage and memory percentage, ordered by the reported CPU field. Values and visibility depend on this Linux host.
Notes and traps
This is procps-ng ps, an external utility, not a Bash builtin. %CPU is a lifetime CPU-time/elapsed-time ratio, not a precise instantaneous sample. comm avoids dumping all arguments, which can contain secrets. PID namespaces and /proc restrictions affect visibility.
Try it
Compare a long-idle process with a newly busy one. Why can a lifetime average understate a sudden spike? What additional evidence would you collect before terminating it?
Answer and reasoning
Past idle time dilutes the average. Collect repeated samples, application logs and workload context; identify the owner and dependencies. A large number in one snapshot does not establish a runaway process or authorize killing it.
Related commands
Related tasks may need different flags and have different semantics. Check the entry before translating a command between shells.
Official reference ↗Updated 14 September 2026. procps-ng manual reviewed 14 September 2026. Local ps could not initialize its process lookup, so this example is not claimed execution-tested.