When running the command

ps -xo pid,stat,user,time

On MacOS (Monterey; version 12.5), I sometimes get a ? in the STAT column:

[...] Removed for brevity
72633 S    mbercx   0:00.06
72949 ?s   mbercx   0:00.00
72952 ?    mbercx   0:00.00
74045 S    mbercx  56:17.38

What does it mean to have a ? in the STAT column, i.e. the process state?

  • This would be he BSD process state code. Unfortunately, at present, I can’t find anything that describes the question mark.
    – Allan
    May 28 at 0:54
  • Are you running the default macOS version of ps here?
    – nohillside
    May 28 at 10:16
  • @nohillside yes, I have made no modifications as far as I know. I'm also not the only one to have run into these ? states, see github.com/aiidateam/aiida-core/issues/3107
    – mbercx
    May 28 at 10:31
  • It's unclear whether this is about macOS though.
    – nohillside
    May 28 at 12:06
  • Apologies, I discussed with the team members who encountered this, and both were using macOS. I've also never encountered this issue on e.g. Ubuntu, whereas I can reliably reproduce it on my macbook pro and mac mini.
    – mbercx
    May 28 at 14:54

3 Answers 3


It means Unknown state. (which basically should not happen)

Looking at the source code that nohillside pointed to and in other files https://github.com/apple-oss-distributions/adv_cmds/blob/7c10d3f757148b048a743f7d1d71be0153b2381f/ps/print.c#L441

The ? comes from this line in tasks.c together with a comment on how they match the numeric status.

                            /*01234567 */
char    mach_state_table[] = " RUSITH?";

From other googling https://github.com/osquery/osquery/issues/1886#issuecomment-191455988

I see a list of the eight states as

0 Zombie 1 Running 2 Stuck 3 Sleeping 4 Idle 5 Stopped 6 Halted 7 Unknown

The names here seem to match the letters in the ps code.

See @pwncat's answer for a more complete listing from Apple's code in that case from top.

man ps does not include the Halted and Unknown states. Nor does the xnu code for macos 13

Older versions did include a D status from manuals but the OSX 10.0 code has the same constants as current macOS.


On macOS, ps is roughly based on the libtop.c library whose source contains the following function (white-space truncated):

/* Return a pointer to a string representation of a process state. */
const char * libtop_state_str(uint32_t state) {
    const char *strings[] = {
#define LIBTOP_STATE_RUN    1
    assert(LIBTOP_NSTATES == sizeof(strings) / sizeof(char *));
    assert(state <= LIBTOP_STATE_MAX);
    assert(LIBTOP_STATE_MAXLEN >= 8); /* "sleeping" */
    return strings[state];

As correctly pointed out in another answer, ps's print.c takes process state symbols from tasks.c where they directly coincide with the state offsets found in libtop.c as shown above.

The last one is unknown, meaning the process state does not fall into any particular category. And the last symbol is a question mark, thus in rare cases you may see it in the STAT column.

  • 2
    The question here is about the "STAT" column, not the "TTY" column.
    – nohillside
    May 28 at 10:10
  • I'm aware and am taking an educated guess as this is undocumented. Despite correlation≠causation, the presence of ? in both TTY and STAT is worth looking into.
    – pwn'cat
    May 28 at 10:28
  • Just remove the portion with the irrelevant TTY states and you’ll be good.
    – Allan
    May 28 at 13:15
  • The top repo github.com/apple-oss-distributions/top shows no chnage in later versions - more complex command have their own repo in Apple's release of OSS code.
    – mmmmmm
    May 29 at 17:26
  • @mmmmmm Indeed, I mentioned "not much has changed" but pointed to the wrong repo. I'll correct that, thank you for noticing!
    – pwn'cat
    May 29 at 18:29

It means that the ps command doesn't match the operating system.

The inclusion of a question mark in the state column by the BSD ps command is the result of hitting a default: case in the code where the current process state as reported by the operating system is not one of the states that the code of ps actually understands.

MacOS doesn't use a straight vanilla BSD kernel. Some commands have been modified to work with the kernel differences. Clearly, a modification was missed here.

  • 1
    macOS doesn't include the FreeBSD version of ps, its ps has a different state() function (see github.com/apple-oss-distributions/adv_cmds/blob/…).
    – nohillside
    May 28 at 10:16
  • Actually, it's much the same. If you look more carefully, you'll spot that in the default: case the end of the string, for an unknown state that the code doesn't understand, as returned by a state translation function, is a question mark character.
    – JdeBP
    May 28 at 15:59
  • *cp = mach_state_table[k->state]; assumes quite a lot about the value of k->state though.
    – nohillside
    May 28 at 16:11
  • 2
    Again: if you look more carefully, you'll find that the state translation function provides all of the values of that field, including the value for when the code doesn't understand a state.
    – JdeBP
    May 29 at 7:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .