What does the | symbol mean in sudo ps -ef | grep processname command?

Also can anyone please explain this command? I have used this command only for getting the PID and killing that process, but I also saw sudo ps -ef | grep processname | grep -v grep and I am under the impression that -v grep is like killing the previous generated PID for grep. If that's so how does it work?

  • 4
    You don't need sudo to run ps -ef. Also a common trick to avoid the third command is enclosing a character of the process' name in square brackets: ps -ef | grep [p]rocessname
    – kos
    Dec 1, 2015 at 12:32
  • 1
    @kos That command needs quotes to work reliably: ps -ef | grep '[p]rocessname'
    – kasperd
    Dec 2, 2015 at 10:44
  • 2
    @kos If you write grep [p]rocessname, you are telling the shell to look for a file in the current directory with the name processname and substitute the pattern with the name of that file. If no file named processname exists, the shell may pass the pattern literally to grep. But that depends on your settings. So your version will break if a file named processname exists or if any of the following shell options has been enabled failglob, nullglob, nocaseglob.
    – kasperd
    Dec 2, 2015 at 12:18
  • 1
    @kasperd I misread your last comment, yes, you are correct about everything. I didn't consider that.
    – kos
    Dec 2, 2015 at 12:50
  • 1
    I can't believe this isn't a duplicate.
    – Mast
    Dec 2, 2015 at 19:15

4 Answers 4


It's called pipe. It gives the output of the first command as the input to the second command.

In your case it means:
The result of sudo ps -ef is fed as the input of grep processname

sudo ps -ef:
This lists all the processes running. Type man ps in the termial for more.

grep processname
So, this list of processes is fed into grep which just searches for the program defined by programname.


Typing sudo ps -ef | grep firefox in my terminal returns:

parto     6501  3081 30 09:12 ?        01:52:11 /usr/lib/firefox/firefox
parto     8295  3081  4 15:14 ?        00:00:00 /usr/bin/python3 /usr/share/unity-scopes/scope-runner-dbus.py -s web/firefoxbookmarks.scope
parto     8360  8139  0 15:14 pts/24   00:00:00 grep --color=auto firefox
  • ok, what -v grep, what does it do.
    – Aamir
    Dec 1, 2015 at 12:17
  • good explanation but i need some help on how -v grep functions..
    – Aamir
    Dec 1, 2015 at 12:25
  • Oh, I see why grep -v is used. To filter out the last line.
    – Pilot6
    Dec 1, 2015 at 12:25
  • @Aamir See my answer. grep -v filters OUT lines containing pattern.
    – Pilot6
    Dec 1, 2015 at 12:26
  • 1
    You could also add that you can use multiple pipes. E.g. echo "foobar" | grep foo | grep bar
    – Michael
    Dec 1, 2015 at 14:42
ps -ef | grep processname

It first runs sudo ps -ef and passes the output to the second command.

The second command filters all lines that contain word "processname".

ps -ef | grep processname | grep -v grep lists all lines containing processname and not containing grep.

According to man grep

-v, --invert-match
              Invert the sense of matching, to select non-matching lines.  (-v
              is specified by POSIX.)

According to man ps

ps displays information about a selection of the active processes.

-e     Select all processes.  Identical to -A.

-f     Do full-format listing. This option can be combined with many
          other UNIX-style options to add additional columns.  It also
          causes the command arguments to be printed.  When used with -L,
          the NLWP (number of threads) and LWP (thread ID) columns will be
          added.  See the c option, the format keyword args, and the
          format keyword comm.

You can combine parameters -ef means same as -e -f.

Actually ps -ef | grep processname list all occurrences of the process called processname.

  • thanks for explanation, what does ps -ef does exactly??
    – Aamir
    Dec 1, 2015 at 12:18
  • i think when we run | grep processName in terminal we also get output of grep which itself is a process so -v kills this output
    – Aamir
    Dec 1, 2015 at 12:24
  • You are correct.
    – Pilot6
    Dec 1, 2015 at 12:27

Im gonna try and answer this with a straight-forward practial answer:

The pipe | lets you do awesome stuff in the shell! It's the one single operator that i consider the most usefull and mighty.

how about counting files in a directory? simple:

ls | wc -l ..redirect the output of ls to wc wit parameter -l for lines

or counting of lines in a file?

cat someFile | wc -l

what if i want to search for something? 'grep' can search for occurences of strings:

cat someFile | grep aRandomStringYouWantToSearchFor

you just redirect the output of the command left of the Pipe to the command right of the pipe.

one more level: how often does something occure in a file?

cat someFile | grep aRandomStringYouWantToSearchFor | wc -l

you can use the | for nearly everything :)

fortune | cowsay

enter image description here

  • 2
    Yes, pipes are fun, +1, but please change the examples: UUOC.
    – kos
    Dec 1, 2015 at 16:11
  • Like: grep -c "aRandomStringYouWantToSearchFor" "someFile" ;-)
    – Sadi
    Dec 1, 2015 at 16:39
  • ofc. but for the purpose of simplicity ...the questionowner doesn't seem to be deeper in grep, e.g :)
    – Gewure
    Dec 1, 2015 at 17:22
  • 1
    Frankly a lot of your examples do not need pipes. Have you heard of demoggification? You are using cat and pipe when many of the commands will take the files as parameters directly: eg cat someFile | grep aRandomStringYouWantToSearchFor should be grep aRandomStringYouWantToSearchFor someFile Dec 2, 2015 at 17:39
  • guys.. i know. if you read the comments, Captain, you would have read my response. The guy who asked the questions won't understand REAL applications of the pipe - he does not even know what grep is. so shall i give him this example? kill $(ps aux | awk '/someString/ { print $2}' | sed -n '1p') no, cause it would not serve the purpose at all.
    – Gewure
    Dec 3, 2015 at 9:02

I have used this command only for getting the PID and killing that process

Other answers have answered your main question already, but I'd like to address this as well;

In general killing a process is often an overkill and leaves resources allocated by a process around in a messy state, you can often just terminate it;

Beside this, just use pkill to kill / terminate a process. pkill supports specifying an exact process name or a regular expression:

pkill -x foo # Terminates process foo
pkill ^foo$ # Terminates process foo
pkill -9 -x foo # Kills process foo
pkill -9 ^foo$ # Kills process foo
  • 1
    Don't use kill -9 unless you specifically know that no other signal will work. See also iki.fi/era/unix/award.html#kill
    – tripleee
    Dec 1, 2015 at 12:42
  • @tripleee OP stated they want to kill the process though.
    – kos
    Dec 1, 2015 at 12:44
  • That's what kill does. Specifying -9 is an additional and most often disastrous extra option.
    – tripleee
    Dec 1, 2015 at 12:44
  • @tripleee I believe the confusion is arising because of the terminology; to me kill = SIGKILL, not SIGTERM.
    – kos
    Dec 1, 2015 at 12:49
  • For most people, I would expect "kill" to mean kill, plain and simple. Any terminology aside, your answer should not advise people to use the -9 option unless you put in a meaty caveat.
    – tripleee
    Dec 1, 2015 at 12:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.