This tutorial will show you how to find the Parent Process ID (PPID) of processes from command line using the ps
and pstree
commands in Linux and Unix-like operating systems with examples.
This guide will cover methods for discovering the PPIDs of:
- A specific process: Find the PPID of a particular program you're curious about.
- All processes: Discover the PPID of every running process on your system.
- The current process: Identify the PPID of your own shell session.
Table of Contents
Benefits of PPID
Knowing the parent process ID (PPID) of a process in Linux can be useful in various scenarios, especially for system administration, troubleshooting, and understanding system behavior.
The Parent Process ID (PPID) in Linux is useful for:
- Analyzing process hierarchies to understand application and service behaviors.
- Identifying orphan processes that may consume resources or behave unpredictably after their parent process exits.
- Managing process trees, allowing for the targeted termination of groups of related processes.
- Debugging and development, particularly for troubleshooting and managing child processes within applications.
- Security analysis, helping to trace suspicious processes back to their origins and understand malware behavior.
- Performance monitoring and optimization, by identifying resource-intensive processes and their origins.
Let us get started!
Find Parent Process ID (PPID) of a Specific Process in Linux
There are a few ways to find the parent process ID (PID) of a given process in Linux from the command line. One common way is by using the ps
command, which stands for "process status".
This command is used to display information about active processes. Let us see how to find the PPID of a process with ps
command.
1. Open a Terminal: First, you need to open a terminal window. You can do this by searching for "Terminal" in your applications menu or by using a shortcut, which is often Ctrl+Alt+T
.
2. Find the PID of Your Process: Before finding the parent PID, you need to know the PID of your process. You can find this by using the ps
command combined with grep
.
For example, if you're looking for the PID of a process named bash
, you would use:
$ ps -aux | grep bash
This command lists all active processes, then filters the list to only show lines containing "bash". The output will show several columns; the second one lists PIDs.
ostechn+ 86631 0.0 0.0 8184 5136 pts/0 Ss 17:55 0:00 bash ostechn+ 87430 0.0 0.0 6240 652 pts/0 S+ 18:00 0:00 grep bash
The command ps -aux | grep bash
is commonly used to list processes and filter out those related to the "bash" shell. However, there's a more elegant way to achieve this without including the grep
process itself in the results. Here are a couple of alternatives:
Using egrep
with square brackets:
$ ps aux | egrep '[b]ash'
This will match lines containing "bash" but exclude the actual "grep" process from the results.
Sample Output:
ostechn+ 86631 0.0 0.0 8184 5136 pts/0 Ss 17:55 0:00 bash
Using pgrep
(a more reliable approach):
$ pgrep bash 86631
Unlike ps aux
, pgrep
directly looks for process names and is less prone to including the grep
process in the output.
Remember that these methods are more simple and avoid cluttering your results with the grep
process itself.
3. Display the Parent PID: Once you have the PID of your process, you can find its parent PID (PPID) by using the ps
command with specific options.
As you can see in the previous command's output, the PID of bash process is 86631.
Now, you can display the parent process ID of bash process using the following command:
$ ps -o ppid= -p 86631
Here, -o ppid=
tells ps
to only display the parent PID of the process, without headers, and -p 86631
specifies the PID of the process you're interested in. Replace 86631
with the actual PID of your process.
As per the above output, 86624 is the Parent Process ID (PPID) of the bash process.
This method is straightforward and works well for finding the parent PID of a given process in Linux. Remember to replace bash
with the actual process name you're interested in, and use the correct PID you find in your initial search.
Print PPIDs of all Processes
If you want to display the PPID's of all processes in your Linux box, you would use:
$ ps j
Sample Output:
PPID PID PGID SID TTY TPGID STAT UID TIME COMMAND 86624 86631 86631 86631 pts/0 90712 Ss 1000 0:00 bash 86631 90712 90712 86631 pts/0 90712 R+ 1000 0:00 ps j
As you see in the output above, the ps j
command displays a job control-oriented format, showing the PPID among other details for all processes. It's a quick way to get a snapshot of process hierarchies.
As per the above output, the PID of bash process is 86631 and its PPID is 86624.
To view the PPID of a specific process, you simply include its PID, like ps j 86631
, to see the details including its PPID.
$ ps j 86631 PPID PID PGID SID TTY TPGID STAT UID TIME COMMAND 86624 86631 86631 86631 pts/0 93681 Ss 1000 0:00 bash
You can filter only the PPIDs using awk
command and exclude all other details like below:
$ ps j | awk 'NR>1 {print $1}'
86624
86631
86631
If you're on a BSD system (like on macOS), use ps j | awk 'NR>1 {print $3}'
to list the PPIDs of all processes.
View PPID of a Process using pstree Command
The pstree
command in Linux is a utility that displays running processes as a tree. This tree structure visually represents the hierarchy of processes, showing parent processes and their child processes in a nested manner.
This hierarchical view makes it easy to understand the relationship between processes, including which processes were spawned by others.
To list the PPID of a given process, say bash, using the pstree
command, run:
$ pstree -sg 86631
This command visualizes the tree of parent processes leading to the specified process (e.g., 86631
), which is especially useful for understanding process ancestry in a hierarchical view.
systemd(1)───systemd(1697)───gnome-terminal-(86624)───bash(86631)───pstree(94963)
Getting Current Process's PPID
The "current process" in the context of a Unix-like operating system (like Linux) refers to the process that is currently being executed by the shell or terminal you are working in.
Each time you run a command in the terminal, that command is executed as a process. The shell itself is also a process, and when you ask for the "current process," it generally means the shell process in which you're currently operating.
When you're interacting with a shell (like Bash, Zsh, etc.), several environment variables are automatically set, which provide information about the shell and its processes.
Two important variables in this context are:
$$
: This variable holds the Process ID (PID) of the current shell. It gives you the PID of the process running the shell instance you are currently using.$PPID
: This variable holds the Parent Process ID (PPID) of the shell. It tells you the PID of the process that started the current shell. For example, if you opened a terminal window from within a graphical desktop environment, the PPID would likely be the PID of the process associated with the desktop environment or window manager.
To see the PID of your current shell, you would use:
$ echo $$
And to see the PID of the parent process of your current shell, the command would be:
$ echo $PPID
Understanding these concepts is useful for process management, scripting, and system administration tasks.
Understanding Difference Between PID and PPID
We know now how to find the PPID of a given process. You might wonder what is the difference between PID (Process ID) and PPID (Parent Process ID). Let us discuss them.
PID (Process ID):
- The PID is a unique numerical identifier assigned to each running process in an operating system.
- It represents an instance of a program or application that is currently executing.
- PIDs are essential for managing processes, as they allow the system to track and interact with individual processes.
- When you start a new process (such as running a command in the terminal), the operating system assigns a unique PID to it.
- PIDs are used for various purposes, including process control, monitoring, and termination.
PPID (Parent Process ID):
- The PPID refers to the PID of the process that spawned or created another process.
- In other words, the PPID represents the parent process of a given process.
- When a new process is created (e.g., by executing a shell command), the system associates it with the PPID of the process that initiated it.
- The PPID establishes a hierarchical relationship among processes, forming a tree-like structure.
- For example:
- If you open a terminal (which becomes a process with a specific PID), the shell process that launched the terminal becomes its PPID.
- Any processes started within that terminal (such as running commands) inherit the terminal's PID as their PPID.
In summary, PIDs uniquely identify individual processes, while PPIDs indicate the parent-child relationship between processes. Understanding these concepts is crucial for process management and troubleshooting in an operating system.
Conclusion
In this tutorial, we explained how to obtain the Parent Process ID (PPID) for a specific process, the PPIDs for all processes, and the PPID for the current process using the ps
and pstree
commands in Linux.
We also discussed the difference between PID and the PPID and their importance.
Understanding and knowing the Parent Process ID (PPID) offers useful insights into the hierarchy and relationships between processes in Linux. This knowledge assists in tasks such as troubleshooting, managing resources, and enhancing security.
Related Read: