Sometimes idle process(%98) and load average(98.32) are very high. When its happen I check with "top" command and I kill visible process. After killing machine status already same. How can I check high process using ps command.
I want to find that which processes are using more than %50 CPU or something like that witout top. Thanks for your kindly feedbacks.
ps usually shows the usage as average since the process was started. So spikes etc. are never visible that way. I am not completely sure if there is an option for ps on RedHat Linux to specify an interval.
So instead I would use the batch mode of top for a quick solution, which is -b and parse it's output.
You could look at the current C value from a ps command.
ps -ef | sort -nb -k4
You might need to check the column it is sorting on (I'm assuming the fourth) This should sort the processes based on what is busy that the moment. It's a little hit-and-miss I agree, but it can help. As a process is actually running, the counter gets incremented. When it is idle or swapped out it slowly reduces. This way, the process scheduler can determine which process is next in line so busy processes get (in theory) pushed out a little if the system is busy.
Of course processes will run as fast as they can, so they may get swapped in & out frequently. The trick is to run this a few times and compare the output. A process with a consistently high C value is busy - and you'll probably see the CPU time clocking up too.
How are you measuring your CPU use? If you just use something like:-
vmstat 1 1
... then the first (and only) line is the average since last boot. If the server has been very busy for a very long time, then that figure can be skewed. Can you post some sample stats and the commands you are getting them with? The tail end of the output from my ps command may help us to. Make sure you sanitise them if need be. We have plenty of users who start Oracle connections specifying the user/password on the command line for everyone to see.
To check the columns and their order, use:-
ps -ef | head -1
I hope that this helps,
Robin
Liverpool/Blackburn
UK
Thanks for reply. We fix our issue. Application user ran find command more than one times so load average and CPU were high. We can't saw these process on output of top command at that time. Later we killed find process and load average fixed.
I found below commands to show percentage of CPU and RAM process. These are very useful commands. I am going to test when load average is high. I think this shows unfinished find commands or somethings like that.
# ps axo %mem,comm,pid,euser | sort -nr | head -n 10 // top 10 memory
# ps axo pcpu,comm,pid,euser | sort -nr | head -n 10 // top 10 CPU
Thanks for posting these useful hints. Always nice to share and someone else may have need of them in future.
Robin
Sorry but that is usually not helping. It is exact the problem I formerly described. You just display the CPU usage of the process, since the process has been started and so with an average. An average over such a long time/interval never gets peaks of any kind. They will be flattened away. I saw Nagios-plugins, that used something like that, but they are useless in terms of alarming threshold of unwanted kinds of peaks for example.
Example:
So when a process runs for 20 hours now, with a CPU usage of 40% and then another hour with 99%, you will get displayed a somewhat constant value which is the average of 21 hours which would be (2040 + 199) / 21 = 42.8%.
If you take this to decide if you kill a process, then good night 
Sorry but, I strongly doubt that your ps helps you at all for this.
Maybe check out the top -b I mentioned.
The C column Robin stated is helpful too, but as he discribed is hard to set into relation to other processes and has to be monitored over some time to get a feeling for what is high and what is low.