Process status, information about processes running in memory.
Syntax ps [-aCcefhjlMmrSTuvwx] [-O fmt] [-o fmt] [-p pid] [-t tty] [-U username] ps [-L] Options -a Display information about other users' processes as well as your own. -c Change the `command' column output to just contain the executable name rather than the full command line. -C Change the way the cpu percentage is calculated by using a 'raw' cpu calculation that ignores `resident' time (this normally has no effect). -e Display the environment as well. -f Show commandline and environment information about swapped out processes. This option is honored only if the uid of the user is 0. -h Repeat the information header as often as necessary to guarantee one header per page of information. -j Print information associated with the following keywords: user, pid, ppid, pgid, sess, jobc, state, tt, time and command. -L List the set of available keywords. -l Display information associated with the following keywords: uid, pid, ppid, cpu, pri, nice, vsz, rss, wchan, state, tt, time and command. -M Print the threads corresponding to each task. -m Sort by memory usage, instead of by process ID. -O Add the information associated with the space or comma separated list of keywords specified, after the process ID, in the default information display. Keywords can be appended with an equals (`=') sign and a string. This causes the printed header to use the specified string instead of the standard header. -o Display information associated with the space or comma separated list of keywords specified. Keywords can be appended with an equals (`=') sign and a string. This causes the printed header to use the specified string instead of the standard header. -p Display information associated with the specified process ID. -r Sort by current cpu usage, instead of by process ID. -S Change the way the process time is calculated by summing all exited children to their parent process. -T Display information about processes attached to the device asso- ciated with the standard input. -t Display information about processes attached to the specified terminal device. -U Display the processes belonging to the specified username. -u Display information associated with the following keywords: user, pid, %cpu, %mem, vsz, rss, tt, state, start, time and command. The -u option implies the -r option. -v Display information associated with the following keywords: pid, state, time, sl, re, pagein, vsz, rss, lim, tsiz, %cpu, %mem and command. The -v option implies the -m option. -w Use 132 columns to display information, instead of the default which is your window size. If the -w option is specified more than once, ps will use as many columns as necessary without regard for your window size. -x Display information about processes without controlling terminals.
Since ps cannot run faster than the system and is run as any other scheduled process, the information it displays can never be exact.
“A human being is a part of the whole, called by us "Universe”, a part limited in time and space" ~ Albert Einstein
ps man page - Apple.com
execsnoop - Snoop new process execution.
kill - Stop a process from running.
lsof - List open files.
opensnoop - Snoop file opens as they occur.
top - Display process information.
w - Show who is logged on and what they are doing.