Sorting and counting
==========================
Imagine that you are administering a small unix system and you want to
know how many processes each user is running in parallel, and sort the
list in decreasing order of number of processes. The following
one-liner:
$ ps aux | cut -d " " -f 1 | tail -n +2 | sort | uniq -c | sort -rn
does the trick. Let's dissect it to understand how it works.
The command ps(1) can list all the processes currently running in your
system, together with the name of the user to whom each process belongs:
$ ps aux
USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND
root 11 100.0 0.0 0 16 - RNL 29Nov18 69599:49.33 [idle]
root 0 0.0 0.0 0 240 - DLs 29Nov18 0:13.81 [kernel]
root 1 0.0 0.0 5424 128 - ILs 29Nov18 0:01.03 /sbin/init --
root 2 0.0 0.0 0 16 - DL 29Nov18 0:00.00 [crypto]
...........
...........
uwu 30154 0.0 0.8 11680 8004 27 I+ 08:27 0:00.03 /usr/local/bin/lua52 /usr/local/bin/telem.lua uwu
uwu 27175 0.0 0.5 8520 5320 28 Is 06:35 0:00.03 -zsh (zsh)
uwu 27178 0.0 0.5 8188 5220 28 S+ 06:35 0:58.73 lua /usr/local/bin/odlli (lua52)
$
That is a fairly long list, but user names appear on the first column,
with other fields separated by (a variable number of) spaces. For the
moment we just need user names, so cut(1) comes handy:
$ ps aux | cut -d " " -f 1
USER
root
root
root
root
...........
...........
uwu
uwu
uwu
$
Notice that the first line contains "USER" which is not a real user name
(it's just part of the header added by ps(1)), so we will need to get
rid of it using the command tail(1):
$ ps aux | cut -d " " -f 1 | tail -n +2
root
...........
uwu
$
Now, each user name appears in that list a number of times equal to the
number of processes currently run by the user. How to count these
occurrencies? The trick is to use sort(1) and uniq(1). The command
sort(1) can sort a file (or a list of lines provided as input), and by
default it enforces a lexicographical order:
$ ps aux | cut -d " " -f 1 | tail -n +2 | sort
_dhcp
_pflogd
bbs
bbs
bbs
ben
ben
ben
...........
slugmax
slugmax
slugmax
spring
uwu
uwu
uwu
uwu
$
The command uniq(1) will remove contiguous repetitions of each line
given on input:
$ ps aux | cut -d " " -f 1 | tail -n +2 | sort | uniq
_dhcp
_pflogd
bbs
ben
cleber
irc
katolaz
leeb
lntl
nobody
postfix
root
slugmax
spring
uwu
$
Notice that this is just the list of users in the system currently
owning at least one running process, which is not exactly what we were
up to. However, the option '-c' of uniq(1) can do the job, since it
counts how many contiguous repetitions of the same line were found:
$ ps aux | cut -d " " -f 1 | tail -n +2 | sort | uniq -c
1 _dhcp
1 _pflogd
3 bbs
4 ben
5 cleber
1 irc
22 katolaz
10 leeb
3 lntl
1 nobody
3 postfix
56 root
12 slugmax
1 spring
8 uwu
$
This means that user _dhcp has 1 running process, user cleber has 5
running processes, user root has 56 running processes, and so on. We are
almost there. We just need to sort the resulting list according to the
numbers appearing at the beginning of each line. This is done by using
sort(1) again, with the option '-n':
$ ps aux | cut -d " " -f 1 | tail -n +2 | sort | uniq -c | sort -n
1 _dhcp
1 _pflogd
1 irc
1 nobody
1 spring
3 bbs
3 lntl
3 postfix
4 ben
5 cleber
8 uwu
10 leeb
12 slugmax
23 katolaz
50 root
$
If you want the list to to be sorted in descending order of number of
processes, you need to just reverse the ordering, which can be done by
passing the option '-r' to sort(1):
$ ps aux | cut -d " " -f 1 | tail -n +2 | sort | uniq -c | sort -rn
50 root
23 katolaz
12 slugmax
10 leeb
8 uwu
5 cleber
4 ben
3 postfix
3 lntl
3 bbs
1 spring
1 nobody
1 irc
1 _pflogd
1 _dhcp
$
This is the one-liner we had at the beginning of this post. The result
indicates that I should probably close some of the screens I am not
using... :P
-+-+-+-
Most of the tools we have seen here were forged by the ancient dwarven
blacksmiths at Murray Hill, in the Eastern Lands, and have survived
pretty unmodified in the unix environment for ages. In particular:
sort(1) appeared in UNIXv2 (March 1972)
uniq(1) appeared in UNIXv3 (February 1973)
tail(1) appeared in UNIXv7 (January 1979)
Some other tools, instead, were created in the Eastern Lands and
readjusted and perfected by the sapient master craftsmen of the West. In
particular:
ps(1) appeared in UNIXv4 (November 1973), although the syntax for
options that we have used here comes from early versions of
BSD2.x (ca 1979-1980)
