diff --git a/bash.org b/bash.org
index 9cc1e09..f4169c4 100644
--- a/bash.org
+++ b/bash.org
@@ -32,3 +32,15 @@ cat urls.html | grep -Eo "(http|https)://[a-zA-Z0-9./?=_%:-]*"
 - ~:~: match colon
 - ~-~: match dash
 - ~*~: repeat the [...] group any number of times
+
+** Use Awk to print the first line of ~ps aux~ output followed by each grepped line
+
+To find all cron processes with ~ps aux~.
+
+#+BEGIN_SRC bash
+ps aux | awk 'NR<2{print $0;next}{print $0 | grep "cron"}' | grep -v "awk"
+#+END_SRC
+
+- ~ps aux~ : equivalent to ~ps -aux~. ~-a~ displays info about other users processes besides to current user. ~-u~ displays info associated with keywords ~user~, ~pid~, ~%cpu~, ~%mem~, ~vsz~, ~rss~, ~tt~, ~state~, ~start~, ~time~, and ~command~. ~-x~ includes processes which do not have a controlling terminal. See ~man 1 ps~.
+- ~awk 'NR<2{print $0;next}{print $0 | "grep cron"}' | grep -v "awk"~ : For number of input records (~NR~) less than 2, ~print~ the input record (~$0~), go to the next input record and repeat the ~{print $0}~ pattern until the end is reached, then execute the END rule. The End rule in this case is ~{print $0 | "grep cron"}~, it prints the remaining input records after piping them through the ~"grep cron"~ command. This allows printing the first line of the ~ps aux~ output, which consists of the column labels, and filters out everything besides what you want to grep for (e.g. "cron" processes).
+- ~grep -v "awk"~ : avoids printing the line containing this command.