Getting down and dirty with ps

Hey everyone,

I recently had to do some memory troubleshooting with one of our customers systems and decided it was time to really dig deep into ps. First off, I didn't realize just how lazy I had been with my use of the command had previously been relegated to a 'ps aux | grep processimlookingfor' without really understanding what each of the fields represented, let alone that I could create my own queries with custom headers which I could then pipe to something like Awk to manipulate the data (more on this later).

Now that I'm getting a little deeper into using ps to identify memory issues in the system, I'm coming across a few inconsistencies in the man pages and on the web about how some of the data is displayed by the command which is really leaving me scratching my head. I'm trying to get some questions together that might clarify some things for people really getting deep with the program for the first time, please feel free to add on if you have something that you've always wondered about. My hope if that this thread can turn into a good source of information for such an essential tool in a linux admins belt that those new in the field can turn to as a reference.

Here's what I've come across so far that I think would benefit from some clarification:

1. Standard vs. BSD syntax (BSD denoted by the '-' before the options). Is one preferred over the other, or does it just boil down to personal preference?
2. Memory types and how they are reported:
   • rss - resident set size. Actual memory being used by a system (non-swapped). Man page shows this is reported in kiloBytes (kB -- SI/metrix prefix), yet every reference I've found on the web points to this being reported in KiB (Kebibytes -- IEC/binary prefix)
   • vsz - virtual memory size of the process. Amount of memory the process has requested from the kernel. Man page (and everything I've found on the web) points to this being reported in KiB.
   • size - Not really sure what this is. I've seen numerous people use it in their troubleshooting guides without giving a thorough explanation of what's being reported. On all tests I've ran this number is reported as slightly smaller than the vsz.

• Understanding whether rss is being reported as kB or KiB is important when trying to combine output of the command with awk to translate the reported mem usage to MB (human readable...). If everyone on the net is incorrect and it is in fact reported as kB, then most of the tutorials have been providing incorrect values by dividing this value by 1024 instead of 1000. I know it's trivial, but when you're troubleshooting processes using huge amounts of memory this can be a big difference as the size grows.

• Why would rss report in kB and everything else in KiB? Is this just one of those inconsistencies in Unix tools things?

This is just from digging into the command for one day, and I'm going to cut this short since there's already a lot to digest. I'm sure as I continue to dive deep I'll find other places where I'm confused on things and will turn to you for help when the man pages let me down.