What is the difference between ps aux and ps -ef?
Both list every process on the system. ps aux uses BSD-style options and shows %CPU, %MEM and memory sizes; ps -ef uses the POSIX style and shows the parent PID (PPID) and full start time. Choose aux for resource use and -ef for process relationships.
Explain it simply
Two different forms from two different Unix families, both answering "what is running?".
ps aux (BSD style, no dash): a is all users' processes, u is user-oriented format, x includes processes without a terminal. Columns include USER, PID, %CPU, %MEM, VSZ, RSS, STAT, START, TIME and COMMAND. It is the one to use when asking "who is eating CPU or RAM?".
ps -ef (POSIX style, with a dash): -e is every process and -f is full format. Columns are UID, PID, PPID, C, STIME, TTY, TIME and CMD. PPID shows who started the process, so you can trace a parent and child.
Mixing styles is a common slip. ps -aux with a dash usually still works on Linux but can warn, because -u then expects a username. For a tree view try ps -ef --forest.
Example
ps aux | head -3
# USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
ps -ef | grep [n]ginx # [n] trick hides the grep line itself
ps -eo pid,ppid,%mem,cmd --sort=-%mem | head -5What to say in the interview
"Both show all processes. aux gives CPU and memory columns, so I use it to find heavy processes; -ef gives PPID, so I use it to see parent-child relationships. For custom columns I use ps -eo with --sort."
Common mistakes
- Grepping ps output and getting the grep command itself in the results.